Target Specification:
........................................................................................................

Wildcards:	192.168.*.*
Range:	192.168.0-255.0-255
Mask Notation:	192.168.0.0/16
Ports:	-p 25,110,80
Common ports:	-p 21,22,23,25,53,80,110,115,135,139,143,194,443,445,1433,3306,3389,5632,5900,6129 (http://www.iana.org/assignments/port-numbers)

Load target list from file
nmap -iL d:\target.txt

.......................................................................................................
Timing:

Limit how often packets are send.

1 packet every 5 secound
nmap <TARGET> --scan-delay 5s

Only one packet at the time.
nmap <TARGET> --max-parallelism 1 

T1 to T5 (Higher is faster) Faster more risk of missed ports
nmap -T5 <TARGET> -Pn 

........................................................................................................
Log formats:

-oA > Logfile formats - Save all 3 types of logs > nmap -oA c:\test 
XML file can be opend in firefox

Pipe to txt file: 
nmap -sP >IP-TO-SCAN< > c:\scan.txt

Pipe to txt file and append to same file:
nmap -sP >IP-TO-SCAN< >> c:\scan.txt

.....................................................................................................
Used for commands:

-sT > TCP Scan connect scan
-sn > Ping Scan without port scan
-sU > UDP scan 
-sV > Sevice Detection - prober open ports
-I > Ident scanning Port 113 > nmap -I 192.168.1.1
-T1-5 > Timing template - Higher is faster
-O eller -A > OS detection
-PE > ICMP Echo
-PS > Portlist
-PA > TCP SYN/AcK
-P0 > IP Protocol scan ping
-Pn > Do not ping before scanning
-sn > Ping scan no portscan
-n  > NO DNS lookup - Make scanning faster.


Port scanning for specific ports between ip 10-20
nmap -p 25,80,110 192.168.10.0-20 -Pn

Port scanning for ports at a /24 network
nmap -p 25,110,80 192.168.10.0/24

Port scanning for a wildcard
namp -p 25,110 192.168.1.* -P0

........................................................................................................
Exampels for some common scannings:

Syn Connect Scan (All ports)
nmap -oA c:\Syn-connect -sT --open -p0-65535 --randomize_hosts 192.168.1.1-10 -Pn

Service scan   
nmap -oA c:\service scan -sV -PR --open -p0-65535 --randomize_hosts 192.168.1.1-10

Service scan - på bestemte porte
nmap -oA c:\service scan -sV --open -p21,25,80,443,3128,3389,8080,8081 192.168.1.1-10 -Pn

Can NOT be used if Anti-ARP protection is enabled on switches.
nmap -oA c:\MAC-scan -sU -p53000 -P0 192.168.1.*

Scanning of a telnet devise. Do not work with -sT.
nmap -oA c:\telnet -sS -p 23 192.168.1.*

Scan for TOP 10 ports
nmap --top-ports <TARGETS>

........................................................................................................
OT-Scanninger:

Modbus scanning:
nmap --script modbus-discover -p 502 <TARGETS>

Siemens S7 
nmap --script s7-info -p 102 <TARGETS>

DNP3
nmap --script snp3-info -p 20000 <TARGETS>

MQTT
nmap -p 1883 --script mqtt-subscribe <target>

Other ports:
BACnet UDP 47808
OPC UA TCP 4840
MQTT TCP 1883 (Ukrypteret)
MQTT TCP 8883 (Krypteret)
MQTT UDP 1884
HART-IP TCP 5094
MELSEC-Q TCP 5007
Tridium TCP 1911
PCWORX TCP 1962
Red Lion TCP 789
ProConsOS TCP 20547
GE-STRP TCP 18245
Omron protocol TCP/UDP 9600

........................................................................................................
UDP Scanninger:

UDP scan:
nmap -oA c:\UDP-Scan -sU 192.168.1.0/24 -Pn

UDP scan Common Ports:
nmap -oA c:\UDP-Scan -sU -p 53,67,68,69,123,161,162,500,520,521,2049,4500,5060,5004,10000 192.168.1.0/24 -Pn

........................................................................................................
Ping scans:

Ping sweep - No port scan
nmap -oA c:\ping sweep -sn -T4 -iL -PE 192.168.10.1-10

Ping scan ONLY
nmap -sn -PE 192.168.10.1-10

........................................................................................................
OS Detections:

OS-Detection
nmap -oA c:\os-detection -O 192.168.1.1

OS-Detection - on specified ports
nmap -oA c:\os-detection-ports -p80,137,138,443,445 192.168.1.1-10

Banner grabbing
nmap -oA c:\Banner-grabbing-Scan -sV --script=banner 192.168.1.0/24 -Pn

XMAS Scan
nmap -oA c:\XMAS-scan -sX -v 192.168.1.1

........................................................................................................
Script scannings:

HTTP bruteforce scanning (On web-site with no encryption)
nmap -Pn -p 80 --script http-enum www.netcowboy.dk

DNS Bruteforce scanning
nmap -Pn --script dns-brute netcowboy.dk

SMB OS Discoveryscanning
nmap -p 445 -Pn --script smb-os-discovery 192.168.1.1

SSL Enum scanning - poodle
nmap -Pn -p 443,465,563,636,989,992,993,994,995,25 -n ---script ssl-enum-ciphers 192.168.1.1

nmap ssl heartbleed scanning
nmap -Pn -p 443,465,563,636,989,992,993,994,995,25 -n --script ssl-heartbleed 192.168.1.1

........................................................................................................
SPAM sender lookup scanning:

Scanning for port 25 with reverse DNS lookup
nmap -oA c:\spam-lookup -sT -T4 -p 25 -R 192.168.20.1-255 -Pn

........................................................................................................
Firewalls:

Fin scan -  Good on firewalls: 
nmap -oA c:\FIN-Scan -sN 192.168.1.1

-PR - ARP ping - Good if you cant do ping I a Scan - Only work on same subnet

--randomize_hosts
Good for stealth scanning. And on local subnets.

Paranoide scanning:
Avoid firewall detection and IDS / IPS detection.
-T Paranoid (or -T0) scan will wait (generally) at least 5 minutes between each packet sent 

This scanning takes around 1 hour and 40 minutes pr IP med with tease ports
nmap -oA c:\paraniode -sT -p 21,22,23,25,53,80,110,115,135,139,143,194,443,445,1433,3306,3389,5632,5900,6129 -T0 -Pn 192.168.1.1

Firewalk
nmap --script=firewalk --traceroute 192.168.1.1

Firewalk - Find open ports on firewalls from inside.
nmap --traceroute --script firewalk --script-args firewalk.ttl <target>

.....................................................................................................
Decoy Scanning:

Remark:
All used decoy ip's have to be online or there is a risk of exposing real scanner IP.
You can use LAN ore WAN IP in same scanning

nmap -n -Ddecoy-ip1,decoy-ip2,decoy-ip3,decoy-ip4,decoy-ip5 remote-host-ip

nmap -p0-1024 -T4 -oA "c:\\Decoy-Scan" -Pn -D 192.168.1.9,192.168.1.34,192.168.1.1,192.168.1.15 192.168.1.20

.....................................................................................................
DNS Scan:

List scan Revers IP to DNS 
nmap -oA c:\IP-DNS -R -sn <target>

-R > Use DNS lookup for all targets

--system-dns 
Use local DNS server - Slow and often only used for tracing DNS errors in setup
nmap -sn -R  192.168.10.7 --system-dns 192.168.10.20 -Pn

--dns-servers > What DNS server have to be used. 
nmap -sn -R  <IP TO SCAN> --dns-servers 8.8.8.8,8.8.4.4 -Pn

.....................................................................................................
Conficker scanning:

Scanning for Conficker orm infected devices.
nmap -PN -T4 -p139,445 -n -v --script smb-check-vulns,smb-os-discovery --script-args safe=1 [targetnetworks]

You will only see Conficker-related output if either port 139 or 445 are open on a host. 
A clean machine reports at the bottom: “Conficker: Likely CLEAN”, while likely infected machines say: 
“Conficker: Likely INFECTED”. For more advice, see this nmap-dev post by Brandon Enright. Dan Kaminsky broke the story on Doxpara.com.

.....................................................................................................
Script Scannings
Use Zmap GUI to list possible sript scans and the commands to use them.

http://nmap.org/nsedoc/index.html

Banner grabber
nmap -sV --script=banner <target>

....................................................................................................