Nmap Scan Types
|
Scan Type |
Command Flag |
How It Works |
Use Case |
|
TCP SYN |
-sS |
Sends SYN, doesn’t complete handshake (stealth) |
Default, fast, hard to detect |
|
TCP Connect |
-sT |
Full TCP handshake |
No root needed, noisy |
|
UDP Scan |
-sU |
Sends UDP packets, checks response |
Find DNS, SNMP, DHCP |
|
ACK Scan |
-sA |
Sends ACK packets |
Map firewall rules |
|
Null Scan |
-sN |
No flags set |
Bypass some firewalls |
|
Xmas Scan |
-sX |
FIN+PSH+URG flags set |
Bypass some firewalls |
Service and Version Detection
- nmap -sV –version-intensity 9 <target> — Deep version detection
- nmap -A <target> — Aggressive scan: OS detect + version + scripts + traceroute
- nmap –script=banner <target> — Grab service banners
|
Placement Tip: Know the important port numbers by heart — Port 21=FTP, 22=SSH, 23=Telnet, 25=SMTP, 53=DNS, 80=HTTP, 110=POP3, 143=IMAP, 443=HTTPS, 445=SMB, 3306=MySQL, 3389=RDP, 8080=HTTP-Alt. |