Nmap Commands with Examples 2026 — The Complete Reference (Every Flag, Every Scan Type, Free PDF Cheat Sheet)

This article provides a comprehensive reference guide to Nmap commands, flags, and scan types for penetration testers and security professionals. It covers syntax, all major scanning methodologies, service detection, timing options, NSE scripting, output formats, and firewall evasion techniques, with commands tested against current Nmap 7.95. The guide emphasizes authorised use only and provides six professional scan sequences used in real penetration testing engagements.

• Scan type determines visibility to defensesThe article explains that scan type fundamentally determines how Nmap probes target ports and therefore how visible the scan is to IDS systems and firewalls. SYN scans (-sS) are the default, fastest, and most stealthy but require root; TCP connect scans (-sT) complete the full handshake and are more visible but don't require root. NULL, FIN, and Xmas scans can bypass older stateless firewalls but are unreliable on modern systems. Understanding this distinction is critical because it directly affects which scan type to use in different testing scenarios.
• Service and OS detection maps to CVEsService version detection (-sV) identifies exact software versions running on open ports, which directly maps to known CVEs and vulnerability databases. OS detection (-O) fingerprints the target operating system. The article demonstrates that combining these two flags transforms a simple port list into a vulnerability assessment surface. For example, the article shows how Apache 2.4.54 can then be searched in a CVE database for known vulnerabilities.
• Six-step professional reconnaissance workflowThe article provides six specific scan sequences used in actual penetration testing engagements, executed in order: (1) rapid host discovery using ICMP variants, (2) quick triage with SYN scan and top 1000 ports, (3) complete baseline with all ports and default scripts, (4) vulnerability scanning on open ports found previously, (5) UDP key services (DNS, SNMP, NTP, NetBIOS, IKE, OpenVPN), and (6) web surface enumeration with HTTP-specific scripts. This sequence constitutes a complete initial reconnaissance on any authorised target.
• NSE scripts extend scanning to vulnerability assessmentThe Nmap Scripting Engine provides 600+ bundled scripts that transform Nmap from a port scanner into a vulnerability platform. Script categories include default (-sC), vulnerability detection (--script vuln), authentication bypass (--script auth), brute force (--script brute), and specific checks like EternalBlue detection (--script smb-vuln-ms17-010). Scripts are located in /usr/share/nmap/scripts/ on Kali Linux and can be searched by keyword.
• Timing templates balance speed and accuracyThe article presents timing options from T0 (Paranoid, 5 minutes per port for IDS evasion) through T5 (Insane, very fast but may miss ports on slow targets). T3 is the default, T4 provides aggressive speed suitable for fast networks with approximately 4x speed boost, and fine-grained control is available through --min-rate (packets per second) and --max-retries flags. The tradeoff is that faster scans may miss ports on slow or heavily filtered networks.
• Output formats enable integration and reportingNmap supports multiple output formats: -oN for normal text, -oX for XML (imports into Metasploit), -oG for grepable format (compatible with grep piping), and -oA to save all formats simultaneously. The grepable format is specifically demonstrated for parsing — extracting IPs with open ports using grep and awk. This flexibility allows scan results to be integrated into vulnerability management platforms and penetration testing reports.
• Firewall evasion techniques probe filter behaviorThe article describes methods for authorised targets in filtered environments: packet fragmentation (-f with 8-byte or 16-byte fragments), decoy scanning (-D to send from multiple spoofed IPs), source port spoofing (--source-port 53 to appear as DNS traffic), and IDS threshold evasion through scan delays (--scan-delay 1s). The --badsum flag sends packets with incorrect checksums specifically to probe firewall responses without triggering full inspection.
• Authorised use is a legal and ethical requirementThe article explicitly and repeatedly emphasizes that all commands must be run only on systems you own, have explicit written authorisation to scan, or on legal practice platforms like TryHackMe and Hack The Box. It states scanning any system without permission violates computer misuse laws in most jurisdictions regardless of intent, making authorisation a fundamental prerequisite rather than an optional consideration.

Bottom line: Master the six-step professional scan sequence (host discovery, quick triage, complete baseline, vulnerability scan, UDP services, web surface) and run them as habits on authorised targets; the difference between amateur and professional reconnaissance is thoroughness and consistency in applying these methodologies, not individual technical knowledge. Always verify explicit written authorisation before scanning any system, as unauthorised scanning violates computer misuse laws.