QUICK REFERENCE — ALL FLAGS
The most used flags at a glance. Know these cold before any interview.
SCAN TYPES
-sSSYN / Stealth scan
-sTTCP Connect scan
-sUUDP scan
-sAACK scan (firewall map)
-sN/sF/sXNull, FIN, Xmas scans
-sVVersion detection
-sCDefault NSE scripts
HOST DISCOVERY
-snPing sweep (no port scan)
-PnSkip ping (assume up)
-PSTCP SYN ping
-PATCP ACK ping
-PEICMP echo ping
-PRARP ping (LAN only)
-nNo DNS resolution
PORTS
-p 80Specific port
-p 1-1000Port range
-p-All 65535 ports
-FTop 100 ports (fast)
--top-ports NTop N ports
-rSequential port order
TIMING
-T0Paranoid (IDS evasion)
-T1Sneaky
-T2Polite
-T3Normal (default)
-T4Aggressive (CTF/labs)
-T5Insane (unreliable)
OUTPUT
-oNNormal output
-oXXML output
-oGGrepable output
-oAAll formats at once
-v / -vvVerbose / Extra verbose
--openShow only open ports
EVASION & SPOOFING
-D RND:10Decoy IPs
-S IPSpoof source IP
-e eth0Use specific interface
-fFragment packets
--mtu 8Custom MTU
--proxiesRoute through proxies
// GURU TIP
In a SOC/pentest interview, if they ask "how would you scan a target without being detected?" — your answer is -sS -T1 -f -D RND:5 --data-length 25. That single command combo shows you understand stealth, IDS evasion, decoys, and packet fragmentation simultaneously.
HOST DISCOVERY
Find live hosts before scanning ports. Always start here in a real engagement.
// GURU TIP
Many firewalls block ICMP (ping). Use -Pn to skip host discovery entirely and assume the target is up. In CTFs and interviews, this is often the move when a target seems "dead" but isn't.
| COMMAND | SYNTAX | EXAMPLE | JOB OF COMMAND |
|---|---|---|---|
| -sn | nmap -sn [target] | nmap -sn 192.168.1.0/24 | RECON Ping sweep — discovers live hosts on a subnet without scanning any ports. Your first move in any internal assessment. |
| -Pn | nmap -Pn [target] | nmap -Pn 10.10.10.5 | STEALTH Skip host discovery. Treats target as online. Use when ICMP is blocked by firewall and host appears unreachable. |
| -PS | nmap -PS[ports] [target] | nmap -PS22,80,443 10.0.0.1 | RECON TCP SYN ping to specific ports. Discovers hosts that block ICMP but respond to TCP. More reliable than ICMP on hardened networks. |
| -PA | nmap -PA[ports] [target] | nmap -PA80 10.0.0.1 | RECON TCP ACK ping. Works differently from SYN — some stateful firewalls let ACK packets through. Used in combination with -PS. |
| -PE | nmap -PE [target] | nmap -PE 192.168.1.0/24 | RECON Standard ICMP echo (classic ping). Fast but often blocked. Only reliable on LANs or permissive networks. |
| -PR | nmap -PR [target] | nmap -PR 192.168.1.0/24 | RECON ARP ping — fastest and most reliable host discovery on local networks. Can't be blocked by host firewall. Nmap uses this automatically on LAN. |
| -iL | nmap -iL [file.txt] | nmap -sn -iL targets.txt | RECON Read targets from file. Essential for scanning large IP lists in real engagements. One IP/hostname/range per line. |
| --exclude | nmap [range] --exclude [IP] | nmap 10.0.0.0/24 --exclude 10.0.0.1 | RECON Exclude specific IPs from a scan range. Critical in production environments to protect fragile devices like printers, legacy systems, or out-of-scope hosts. |
SCAN TYPES
Different scan techniques leave different network footprints. Knowing WHY each exists is the interview differentiator.
STEALTH Low noise, harder to detect
LOUD Noisy, logs created on target
CRITICAL Must know for interviews
| COMMAND | SYNTAX | EXAMPLE | JOB OF COMMAND |
|---|---|---|---|
| -sS | nmap -sS [target] | nmap -sS -p 1-1000 10.10.10.5 | STEALTHCRITICAL SYN / Half-Open scan. Sends SYN, receives SYN-ACK, then sends RST (never completes handshake). Not logged by most apps. Requires root. Most popular scan type. |
| -sT | nmap -sT [target] | nmap -sT 10.10.10.5 | LOUDCRITICAL TCP Connect scan. Full 3-way handshake. Used when you don't have raw socket privileges (non-root). Gets logged by target OS. Slower and noisier than -sS. |
| -sU | nmap -sU [target] | nmap -sU -p 53,161,67 10.10.10.5 | LOUDCRITICAL UDP scan. Probes UDP ports (DNS=53, SNMP=161, DHCP=67). Very slow. Many services run on UDP — attackers love DNS and SNMP. Combine with -sS for complete picture. |
| -sA | nmap -sA [target] | nmap -sA 192.168.1.1 | STEALTH ACK scan. Maps firewall rules — distinguishes filtered vs unfiltered ports. Does NOT tell you if a port is open. Purely used to understand firewall topology. |
| -sN | nmap -sN [target] | nmap -sN 10.10.10.5 | STEALTH Null scan. Sends packet with NO flags set. RFC 793 says closed ports send RST. Open/filtered ports send nothing. Bypasses some stateless firewalls. Doesn't work on Windows. |
| -sF | nmap -sF [target] | nmap -sF 10.10.10.5 | STEALTH FIN scan. Sets only the FIN flag. Same logic as Null — closed ports respond with RST, open ports are silent. Evades some packet filters. Linux/UNIX targets only. |
| -sX | nmap -sX [target] | nmap -sX 10.10.10.5 | STEALTH Xmas scan. Sets FIN, PSH, URG flags (packet "lit up like a Christmas tree"). Same RFC 793 logic. Also fails on Windows. More unusual pattern — evades basic signature detection. |
| -sM | nmap -sM [target] | nmap -sM 10.10.10.5 | STEALTH Maimon scan. FIN+ACK flags. Some BSD systems respond oddly, revealing port states. Niche but good to know for advanced interviews. |
| -sW | nmap -sW [target] | nmap -sW 192.168.1.1 | RECON Window scan. Like ACK but examines TCP window size field. On some systems differentiates open vs closed ports. Used for firewall evasion research. |
// 🎯 INTERVIEW GOLD
"What's the difference between -sS and -sT?" This is a classic. Answer: -sS sends SYN and resets with RST before completing the handshake — no connection is ever fully established so it's not logged by the application. -sT completes the full 3-way handshake and IS logged. -sS requires root/admin. -sT does not.
PORT SELECTION
Control exactly which ports get scanned. Smart port selection is the difference between a 30-second scan and a 3-hour scan.
| COMMAND | SYNTAX | EXAMPLE | JOB OF COMMAND |
|---|---|---|---|
| -p [port] | nmap -p [port] [target] | nmap -p 443 10.10.10.5 nmap -p 22,80,443 10.10.10.5 | CRITICAL Scan specific port(s). Comma-separate for multiple. Use when you already know what service you're investigating. Fastest targeted approach. |
| -p [range] | nmap -p [start-end] [target] | nmap -p 1-1024 10.10.10.5 nmap -p 8000-9000 10.10.10.5 | RECON Scan a range of ports. Port 1-1024 covers all well-known/privileged ports. Great for focused enumeration of custom service ranges. |
| -p- | nmap -p- [target] | nmap -p- -T4 10.10.10.5 | LOUDCRITICAL Scan ALL 65,535 ports. Use in CTFs and full assessments. Slow on -T3, always combine with -T4 for speed. Essential — attackers and defenders both need the full picture. |
| -F | nmap -F [target] | nmap -F 10.10.10.5 | RECON Fast scan — top 100 most common ports only. Great for quick triage in incident response when speed matters more than completeness. |
| --top-ports | nmap --top-ports [N] [target] | nmap --top-ports 1000 10.10.10.5 | RECON Scan the N most common ports by frequency. Nmap's built-in frequency data from real-world scans. Balances coverage vs speed better than -F. |
| -p U:,T: | nmap -p U:[udp_ports],T:[tcp_ports] [target] | nmap -p U:53,161,T:80,443 -sU -sS target | PRO Specify separate UDP and TCP ports in one scan. Requires both -sU and -sS flags. Professional-grade enumeration combining both protocols simultaneously. |
| --exclude-ports | nmap --exclude-ports [ports] [target] | nmap -p- --exclude-ports 80,443 target | PRO Scan all ports except specified ones. Useful in authorized tests where certain ports/services must not be touched per scope rules. |
| -r | nmap -r [target] | nmap -r -p 1-1000 10.10.10.5 | Scan ports in sequential (numeric) order instead of random. Useful for deterministic testing and debugging, but more obvious to IDS systems. |
VERSION & OS DETECTION
Go beyond open/closed — identify exactly what software and version is running. Critical for vulnerability matching in SOC and pentesting.
// GURU TIP
The combination nmap -sV -O -sC --version-intensity 5 is your all-purpose enumeration command. In a CTF or pentest, run this after your initial -p- discovery to get full service and OS fingerprinting.
| COMMAND | SYNTAX | EXAMPLE | JOB OF COMMAND |
|---|---|---|---|
| -sV | nmap -sV [target] | nmap -sV 10.10.10.5 | CRITICAL Service version detection. Probes open ports to determine service name and exact version (e.g. Apache 2.4.29, OpenSSH 7.2). Maps directly to CVEs. Never skip this in a real assessment. |
| --version-intensity | nmap -sV --version-intensity [0-9] [target] | nmap -sV --version-intensity 9 target | PRO Controls how aggressively nmap probes for version info. 0=lightest, 9=try everything. Higher values find more but take longer and are louder. |
| --version-all | nmap -sV --version-all [target] | nmap -sV --version-all target | LOUD Try every single probe for version detection. Equivalent to --version-intensity 9. Use on stubborn services that don't respond to lighter probing. |
| -O | nmap -O [target] | nmap -O 10.10.10.5 | CRITICAL OS fingerprinting. Analyzes TCP/IP stack behavior to guess OS (Windows 10, Linux 4.x, etc). Requires root. Needs at least one open AND one closed port for accuracy. |
| --osscan-guess | nmap -O --osscan-guess [target] | nmap -O --osscan-guess 10.10.10.5 | PRO Makes nmap guess OS even when it's not confident. Shows best match with percentage. Useful when exact detection fails — gives you something to work with. |
| -A | nmap -A [target] | nmap -A 10.10.10.5 | LOUDCRITICAL Aggressive scan = -sV + -O + -sC + --traceroute. All-in-one. Extremely loud, logs everywhere. Gold standard for CTFs and authorized labs. Never use -A in stealth engagements. |
| --traceroute | nmap --traceroute [target] | nmap --traceroute 8.8.8.8 | RECON Traces network path to target. Reveals routers, hops, network topology. Useful in network mapping and understanding segmentation in an environment. |
NSE — NMAP SCRIPTING ENGINE
NSE transforms nmap from a port scanner into a vulnerability scanner. Scripts live in /usr/share/nmap/scripts/. Categories: auth, broadcast, brute, default, discovery, exploit, external, fuzzer, intrusive, malware, safe, version, vuln.
// 🎯 INTERVIEW GOLD
"Name some nmap scripts you've used." Answer with: http-title, smb-vuln-ms17-010 (EternalBlue), ftp-anon, ssh-brute, ssl-heartbleed, dns-zone-transfer, http-robots.txt. These show you know both recon and vulnerability detection scripts.
| COMMAND | SYNTAX | EXAMPLE | JOB OF COMMAND |
|---|---|---|---|
| -sC | nmap -sC [target] | nmap -sC -sV 10.10.10.5 | CRITICAL Run default NSE scripts — safe, enumeration-focused. Includes banner grabbing, SSL cert info, HTTP headers, SMB info. Safe to run without much noise. |
| --script=vuln | nmap --script=vuln [target] | nmap --script=vuln 10.10.10.5 | LOUDCRITICAL Run all vulnerability detection scripts. Checks for known CVEs, misconfigs, weak creds. Intrusive — logs created. Essential in pentest reporting and CTF initial scans. |
| --script=safe | nmap --script=safe [target] | nmap --script=safe 10.10.10.5 | RECON Run only scripts classified as "safe" — won't crash services or create significant load. Appropriate for use in production environments during authorized assessments. |
| smb-vuln-ms17-010 | nmap --script=smb-vuln-ms17-010 [target] | nmap -p 445 --script=smb-vuln-ms17-010 10.10.10.5 | CRITICAL EternalBlue detection (MS17-010 / WannaCry). Checks if SMB is vulnerable to the most famous exploit of the decade. Every SOC analyst must know this command. |
| ftp-anon | nmap --script=ftp-anon [target] | nmap -p 21 --script=ftp-anon 10.10.10.5 | RECON Check if FTP allows anonymous login. Unauthenticated FTP access is a critical misconfiguration. Extremely common finding in CTFs and real networks. |
| http-title | nmap --script=http-title [target] | nmap -p 80,443 --script=http-title target | RECON Grabs the HTML title of web pages. Quickly identifies what's running on web ports without opening a browser. Useful in large subnet sweeps. |
| ssl-heartbleed | nmap --script=ssl-heartbleed [target] | nmap -p 443 --script=ssl-heartbleed target | CRITICAL Checks for the Heartbleed bug (CVE-2014-0160) in OpenSSL. Allows memory leak of server process — credentials, keys. Still found in legacy systems today. |
| dns-zone-transfer | nmap --script=dns-zone-transfer --script-args dns-zone-transfer.domain=[domain] [target] | nmap -p 53 --script=dns-zone-transfer --script-args dns-zone-transfer.domain=target.com ns1.target.com | CRITICAL Attempts DNS zone transfer (AXFR). A successful zone transfer reveals ALL internal DNS records — entire network map. Classic misconfiguration that's still seen in real engagements. |
| http-robots.txt | nmap --script=http-robots.txt [target] | nmap -p 80 --script=http-robots.txt target | RECON Fetches and displays robots.txt. Often contains hidden directories and paths admins don't want indexed — directly useful for web enumeration. |
| --script-args | nmap --script=[script] --script-args [key=val] [target] | nmap --script=ssh-brute --script-args userdb=users.txt,passdb=pass.txt target | PRO Pass arguments to NSE scripts. Used for brute-force scripts (wordlists), DNS scripts (domain names), authentication scripts (credentials). Required for advanced script usage. |
| --script-updatedb | nmap --script-updatedb | sudo nmap --script-updatedb | Rebuild the NSE script database after adding custom scripts. Run whenever you add a new script to /usr/share/nmap/scripts/. |
TIMING & PERFORMANCE
Speed vs stealth. The timing profile you choose defines how visible you are to IDS/IPS and how fast results come back.
| COMMAND | SYNTAX | EXAMPLE | JOB OF COMMAND |
|---|---|---|---|
| -T0 (Paranoid) | nmap -T0 [target] | nmap -T0 -sS 10.10.10.5 | STEALTH One probe every 5 minutes. Designed to evade IDS thresholds. Practically unusable for full scans — only use for single-port checks where stealth is paramount. |
| -T1 (Sneaky) | nmap -T1 [target] | nmap -T1 -p 1-100 target | STEALTH 15 seconds between probes. Slow enough to avoid most IDS rate-based detection. Use in real APT-style engagements where you have hours and need to stay under radar. |
| -T2 (Polite) | nmap -T2 [target] | nmap -T2 10.10.10.5 | STEALTH Polite — slows scan to use less bandwidth. Good for scanning during business hours in authorized assessments without impacting network performance. |
| -T3 (Normal) | nmap -T3 [target] | nmap 10.10.10.5 | RECON Default timing. Balances speed and reliability. Used when you have no specific speed requirement. Nmap's baseline behavior. |
| -T4 (Aggressive) | nmap -T4 [target] | nmap -T4 -p- 10.10.10.5 | LOUDCRITICAL Recommended for CTFs and fast lab scans. Assumes fast, reliable network. Times out slow responses quickly. Most professionals use -T4 as their default on internal networks. |
| -T5 (Insane) | nmap -T5 [target] | nmap -T5 192.168.1.1 | LOUD Fastest possible — sacrifices accuracy for speed. Packets can be dropped, ports missed. Rarely used in practice. Only on extremely fast, local networks when speed is everything. |
| --min-rate | nmap --min-rate [packets/sec] [target] | nmap --min-rate 5000 -p- target | PRO Force nmap to send at least N packets per second. Overrides timing templates for raw speed control. --min-rate 5000 -p- is a popular CTF combo for blazing fast full port scans. |
| --max-rate | nmap --max-rate [packets/sec] [target] | nmap --max-rate 100 target | STEALTH Cap packet rate. Prevents overwhelming fragile systems and helps evade rate-based IDS detection. Essential when scanning production systems in authorized engagements. |
| --min-parallelism | nmap --min-parallelism [N] [target] | nmap --min-parallelism 100 target | PRO Force minimum number of parallel probes. Increases speed on reliable networks. Useful when scanning many hosts and default parallelism is too conservative. |
| --host-timeout | nmap --host-timeout [time] [target] | nmap --host-timeout 30s 192.168.1.0/24 | Give up on a host after this duration. Prevents slow/dead hosts from blocking large subnet scans. Use in bulk sweeps where some hosts are expected to be unresponsive. |
OUTPUT & FORMATTING
Always save your scan output. In professional engagements, the output IS your evidence. Use -oA to save all formats simultaneously.
| COMMAND | SYNTAX | EXAMPLE | JOB OF COMMAND |
|---|---|---|---|
| -oN | nmap -oN [filename] [target] | nmap -sV target -oN scan.txt | CRITICAL Normal output — human-readable, same as terminal output. Your primary report format. Always save scans with -oN in real work. |
| -oX | nmap -oX [filename] [target] | nmap -sV target -oX scan.xml | PRO XML output. Parseable by tools like Metasploit (db_import), Nessus importers, and custom scripts. Essential for integration with professional pentesting workflows. |
| -oG | nmap -oG [filename] [target] | nmap -sn 192.168.1.0/24 -oG hosts.txt | PRO Grepable output — easily parsed with grep, awk, cut. Use with grep "open" scan.gnmap to extract open ports quickly. |
| -oA | nmap -oA [basename] [target] | nmap -sV target -oA full_scan | CRITICAL Save in ALL formats simultaneously (-oN, -oX, -oG). Creates basename.nmap, basename.xml, basename.gnmap. Professional standard — always use -oA in real engagements. |
| -v / -vv | nmap -v [target] nmap -vv [target] | nmap -sV -vv target | CRITICAL Verbose output. -v shows results as they come in (don't wait for scan to finish). -vv gives more detail. Always use -v in long scans so you can see partial results immediately. |
| --open | nmap --open [target] | nmap -p- --open target | RECON Show ONLY open ports in output. Filters out closed/filtered noise. Cleaner output for quick triage — extremely useful in large scans with many filtered ports. |
| --reason | nmap --reason [target] | nmap --reason target | PRO Show WHY a port is in each state (syn-ack, rst, no-response, etc). Great for debugging scan results and explaining findings in professional reports. |
| --packet-trace | nmap --packet-trace [target] | nmap --packet-trace -p 80 target | PRO Show every packet sent and received. Debugging and learning tool. Understand exactly what nmap is doing at the packet level — invaluable for network interview questions. |
| -d / -d2 | nmap -d [target] | nmap -d2 -sS target | Debug mode. -d shows debug output, -d2 shows more. Use to troubleshoot why a scan is behaving unexpectedly. Deep technical insight into nmap's decision-making. |
FIREWALL EVASION & SPOOFING
Advanced techniques to bypass security controls. Knowing these shows you understand offensive and defensive mindsets simultaneously — exactly what SOC/pentest interviews want.
// 🎯 INTERVIEW GOLD
"How would you scan a target without triggering their IDS?" Combine: -sS -T1 -f --data-length 25 -D RND:10 --source-port 53. SYN scan + slow timing + fragmented packets + random decoys + spoofed source port (DNS port 53 often bypasses egress rules).
| COMMAND | SYNTAX | EXAMPLE | JOB OF COMMAND |
|---|---|---|---|
| -f | nmap -f [target] | nmap -f -sS 10.10.10.5 | STEALTHCRITICAL Fragment packets into 8-byte chunks. Many older IDS/firewalls can't reassemble and inspect fragmented packets — signatures don't trigger. Classic evasion technique. |
| --mtu | nmap --mtu [size] [target] | nmap --mtu 8 10.10.10.5 | STEALTH Custom MTU for packet fragmentation. Must be multiple of 8. Finer control than -f. Smaller MTU = more fragments = harder for some IDS to reassemble and inspect. |
| -D | nmap -D [decoy1,decoy2,...] [target] | nmap -D RND:10 10.10.10.5 nmap -D 1.1.1.1,2.2.2.2,ME target | STEALTHCRITICAL Decoy scan. Mix real scan packets with spoofed IPs so it looks like multiple hosts are scanning. Target's logs show many IPs — analyst can't easily identify real attacker. RND:10 = 10 random decoys. |
| -S | nmap -S [spoof_IP] -e [interface] [target] | nmap -S 192.168.1.100 -e eth0 target | STEALTH Spoof source IP address. Replies go to the spoofed IP, not you — results are blind. Useful in combination with -D or for framing/misdirection in advanced scenarios. |
| --source-port | nmap --source-port [port] [target] | nmap --source-port 53 10.10.10.5 nmap --source-port 80 target | STEALTHCRITICAL Spoof source port. Port 53 (DNS) and 80 (HTTP) are often whitelisted in egress rules. Firewalls configured to allow inbound traffic "from" port 53 can be fooled. |
| --data-length | nmap --data-length [bytes] [target] | nmap --data-length 25 target | STEALTH Append random data to packets to change their size. Default nmap packets have predictable sizes — IDS can fingerprint them. Random padding breaks size-based signatures. |
| --randomize-hosts | nmap --randomize-hosts [range] | nmap --randomize-hosts 192.168.1.0/24 | STEALTH Randomize the order hosts are scanned. Avoids sequential scan patterns that IDS systems detect as port scans. Looks more like organic network traffic. |
| --proxies | nmap --proxies [proxy_url] [target] | nmap --proxies socks4://proxy:1080 target | STEALTH Route TCP connections through HTTP/SOCKS4 proxies. Hides true origin IP. Note: only works with -sT (TCP Connect), not raw packet scans like -sS. |
| --spoof-mac | nmap --spoof-mac [MAC/vendor] [target] | nmap --spoof-mac Apple target nmap --spoof-mac 0 target | STEALTH Spoof MAC address in Ethernet frames. Only effective on local LAN (Layer 2). Use vendor name or 0 for random MAC. Evades MAC-based access controls and forensic attribution. |
| -e | nmap -e [interface] [target] | nmap -e eth0 target nmap -e tun0 target | PRO Specify which network interface to use. Essential when using a VPN (tun0) or when multiple NICs exist. Required with -S (IP spoofing) so nmap knows where to send packets. |
🎯 INTERVIEW COMMAND SCENARIOS
Real-world command combinations you'll be asked to demonstrate or explain. Memorize these scenarios cold.
| SCENARIO | COMMAND | WHY THIS WORKS |
|---|---|---|
| Quick initial recon of a subnet | nmap -sn 192.168.1.0/24 -oG alive_hosts.txt | Ping sweep entire subnet. Save grepable output. Fast, doesn't touch ports. First step of every internal pentest. |
| Full port scan, fast | nmap -p- --min-rate 5000 -T4 10.10.10.5 | All 65535 ports. Min 5000 pkt/sec. Aggressive timing. Classic CTF/lab initial scan combo. |
| Full enumeration after finding open ports | nmap -sV -sC -O -p 22,80,443,8080 -oA full_enum target | Version + default scripts + OS detection on discovered ports. Save all formats. Standard pentest step 2. |
| Stealth scan to evade IDS | nmap -sS -T1 -f -D RND:10 --source-port 53 --data-length 25 target | SYN + slow + fragmented + 10 decoys + DNS source port + random padding. Maximum stealth layering. |
| Check for EternalBlue (MS17-010) | nmap -p 445 --script=smb-vuln-ms17-010 10.10.10.5 | Target SMB port specifically. Run the EternalBlue detection script. Critical finding in Windows environments. |
| UDP service discovery | nmap -sU -sS -p U:53,161,67,T:22,80,443 -sV target | Combined UDP+TCP scan. Targets DNS, SNMP, DHCP on UDP and common TCP ports. Complete protocol coverage. |
| Scan target that blocks ping | nmap -Pn -sS -p- -T4 target | -Pn skips host discovery, assumes host is up. Essential when ICMP is firewall-blocked and target appears dead. |
| Vulnerability scan all services | nmap -sV --script=vuln -oA vuln_scan target | Detect versions then run ALL vuln scripts. Comprehensive automated vuln detection. First pass in authorized assessment. |
| Map firewall rules | nmap -sA -p 1-65535 target | ACK scan to determine which ports are filtered vs unfiltered. Reveals firewall topology without triggering open-port alerts. |
| Scan through VPN | nmap -e tun0 -sS -sV target | Force use of VPN interface. Essential in HTB/THM labs where tun0 is your tunnel to the target network. |
| Check SSL/TLS vulnerabilities | nmap -p 443 --script=ssl-heartbleed,ssl-poodle,ssl-dh-params target | Run multiple SSL/TLS vulnerability scripts at once. Catches Heartbleed, POODLE, and weak DH params in one shot. |
| SOC: Incident response triage | nmap -F -sV -T4 --open suspicious_ip -oN ir_triage.txt | Fast top-100 scan + version detection + show only open + save output. Quick triage of suspicious internal host during an incident. |
// GURU — WHAT SEPARATES YOU FROM OTHER CANDIDATES
Most candidates know nmap flags. You know the WHY behind each flag, what TCP handshake state it exploits, how IDS detects it, and how to chain flags for specific scenarios. When asked "how would you scan X", always explain your flag choices. That's what gets you hired.