nmap is the most classic network scanner, with core advantages:Service version identification（-sV）+ NSE script ecosystem(600+ scripts) + Operating system fingerprinting(-O). Although not as fast as naabu, it is irreplaceable for deep probing.
Project address:https://nmap.org
Tool Selection Strategy
Recommended workflow: first use naabu to quickly discover open ports, then use nmap for deep probing of key ports. nmap is suitable for fine-grained scanning, not for large-scale rapid discovery.
Note: SYN scanning (-sS) requires root privileges; non-root automatically uses TCP Connect (-sT).
Phase 1: Basic Port Scanning
# SYN 半开扫描（默认，需 root，最快最隐蔽）
sudo nmap -sS target.com
nmap -sT target.com
Specify port rangenmap -p 1-1000 target.com
Specify common portsnmap -p 22,80,443,3306,8080 target.com
Full port scannmap -p- target.com
UDP scan (slow, requires root)sudo nmap -sU -p 53,161,500 target.com
## Phase 2: 服务版本与操作系统识别
```bash
# 服务版本探测（核心能力）
nmap -sV target.com
# 操作系统指纹识别
sudo nmap -O target.com
# 版本 + 操作系统 + 默认脚本（最常用组合）
sudo nmap -A target.com
# 精确版本探测（更慢但更准）
nmap -sV --version-intensity 9 target.com
Phase 3: NSE Script Scanning
# 默认安全脚本
nmap -sC target.com
# 漏洞扫描脚本
nmap --script vuln target.com
# 特定漏洞检测
nmap --script smb-vuln-ms17-010 -p 445 target.com
nmap --script http-shellshock -p 80 target.com
# 暴力破解脚本
nmap --script ssh-brute -p 22 target.com
nmap --script http-brute -p 80 target.com
# HTTP 信息收集
nmap --script http-title,http-headers,http-methods -p 80,443 target.com
# SMB 枚举
nmap --script smb-enum-shares,smb-enum-users -p 445 target.com
# SSL/TLS 检查
nmap --script ssl-cert,ssl-enum-ciphers -p 443 target.com
Phase 4: Advanced Scanning Techniques
# 绕过防火墙（分片包）
sudo nmap -f target.com
# 伪造源 IP（Decoy 扫描）
sudo nmap -D RND:5 target.com
# 指定源端口（绕过简单防火墙规则）
sudo nmap --source-port 53 target.com
# 空闲扫描（最隐蔽，需找到僵尸主机）
sudo nmap -sI zombie_host target.com
# 控制速率（避免 IDS）
nmap --scan-delay 1s --max-rate 10 target.com
# 时序模板（T0 最慢最隐蔽，T5 最快最暴力）
nmap -T4 target.com
Phase 5: Output Formats
# 正常输出
nmap -oN scan.txt target.com
# XML 输出（便于工具解析）
nmap -oX scan.xml target.com
# Grepable 输出（便于 grep 处理）
nmap -oG scan.gnmap target.com
# 三种格式同时输出
nmap -oA scan target.com
Common Combinations for Penetration Testing
| Scenario | Command |
|---|---|
| Fast full port | nmap -sS -p- -T4 --open target |
| Deep scan of known ports | nmap -sV -sC -p 22,80,443 target |
| Comprehensive scan | sudo nmap -A -T4 target |
| Vulnerability scanning | nmap --script vuln -p 80,443,445 target |
| Internal network liveness detection | nmap -sn 10.0.0.0/24 |
| SMB vulnerability detection | nmap --script smb-vuln* -p 445 target |
| Web information gathering | nmap --script http-title,http-headers -p 80,443,8080 target |