nmap

Always check your privilages before writing a report. (ROOT)

Docs

Insane speed, no DNS resolution and port specification

nmap -T5- -n -p1-65535 192.168.0.102

Insane speed, no host discovery, no DNS resolution and all ports

nmap -T5- -Pn -n -p- 192.168.0.102

No host discovery, Stealth Scan and specify ports

nmap -Pn -sS -p 1-65535 10.10.11.202

Script, Stealth Scan, Version Detection and verbose output

nmap -sCVS -vvv 10.10.11.202

Stealth Scan, Version Detection, no host discovery and no DNS resolution

nmap -sS -sV -Pn -n 192.168.60.130

Aggresive Scan, no host discovery and no DNS resolution

nmap -A -Pn -n 192.168.130.60

Version detection, no host discovery, vulnerability script and no DNS resolution

nmap -sV -Pn --script vuln -n 192.168.60.130

nmap -Pn -n -sV 10.10.159.242

nmap -Pn -n -T5 -p- 10.10.69.159

nmap -sn 192.168.1.0/24

nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5 > hosts.lst

reason gives why the port is up

nmap -iL hosts.lst -sn -oA host -PE --reason

nmap 10.129.2.28 -sU -Pn -n --disable-arp-ping --packet-trace -p 137 --reason

ICMP Ping Scan (-PE, -PP, -PM): Nmap sends ICMP echo requests, timestamp requests, or netmask requests to determine if a host is online. If the target responds, it confirms the host is reachable.
TCP Ping Scan (-PS, -PA, -PU, -PY): Instead of ICMP, Nmap sends TCP SYN or ACK packets to specific ports. If the target replies (e.g., with a SYN-ACK), it indicates the host is active. This method is useful when ICMP is blocked by firewalls.
Ping Scan (-sn): This disables port scanning and only performs host discovery using the selected method (ICMP, TCP, or UDP).
ARP Scan (-PR): Instead of sending ICMP or TCP packets, Nmap sends ARP requests to determine if a host is online.

On most LANs, especially those using private address ranges granted by RFC 1918

nmap -sn -PR 192.168.60.130

Like -sn but only ICMP Echo requests are used

nmap -sn -PE 192.168.60.130

Nmap sends an ICMP timestamp request to the target.
If the target responds with an ICMP timestamp reply, it confirms the host is online
Useful when standard ICMP Echo Requests (-PE) are blocked but timestamp requests are allowed.

nmap -sn -PP 192.168.60.130

Address mask ping is another alternative to the traditional ICMP ECHO ping
Attackers send an ICMP address mask query to the target host to acquire information related to the Subnet Mask
The address mask response from the destination host is conditional
- it may or may not respond with the appropriate subnet value depending on its configuration by the administrator at the target’s end
This type of ping method is also effective in identifying the active hosts similarly to the ICMP timestamp ping
the -PM option is used to perform an ICMP address mask ping scan.

nmap -sn -PM 10.10.1.13

nmap -sn -PS 192.168.60.130

nmap -sn -PU 192.168.60.130

nmap 10.129.2.28 --top-ports=10

nmap -sn --traceroute 192.168.60.130

Shodan is required

nmap -sS -sU -T4 -A -v -PE -PP -PS80,443 -PA3389 -PU40125 -PY -g 53 --script "default or (discovery and safe)" 192.168.60.129-130

sudo nmap -O 192.168.64.5

nmap -sU -p- TARGETIP

nmap -sU -p 8080 TARGETIP

nmap --script smb-os-discovery TARGET

nmap --script smb-enum-users TARGET

nmap -sV -Pn -F -n -oN scan1.txt 192.168.60.130

for Privledged users, the default option is the -sS scan (nmap - syn scan)
for unpriledged users, the default option is the -sT scan ((Full Open Scan))