Nmap
Nmap is the most popular port scanner. Next are described some common uses:
Standard scan on a single IP:
nmap 192.168.0.200
Scan an IP range, equivalent to a ping sweep, to discover which hosts are up (-sn = "Sweep Network"):
nmap -sn 192.168.0.200-250
Standard scan on a single IP, with greppable output, sent to a text file:
nmap -v -sn 192.168.1.200-250 -oG ping-sweep.txt
Look for hosts with port 80 open in a range of IPs, and send result to a text file:
nmap -p 80 192.168.1.100-200 -oG web-sweep.txt
Scan the 20 most common ports in a range of IPs, and use a connect() scan (-sT = TCP connect scan, which uses higher level packets, if SYN cannot be used):
nmap -sT -A --top-ports=20 192.168.1.200-250
Scan all ports:
nmap -p- 192.168.1.100
Scan a host and identify services running on the 1000 most common ports (-sV = services):
nmap -sV -sT 10.0.0.19
Scan the 1000 most common ports of a host and try to detect its OS (-O = OS discovery):
nmap 192.168.1.200 -O
Exhaustive analysis of a host (-A = detailed scan, OS, version, scripts and traceroute):
nmap 192.168.1.200 -A
Scan UDP port 161 in a range of IPs and save the open ports to a file (-sU = scan UDP ports):
nmap -sU --open -p 161 192.168.1.132-140 -oG mega-snmp.txt
Can help if some hosts are not up in a network sweep (--unprivileged):
nmap 192.168.1.0/24 -sP --unprivileged
Nmap allows timing options. Going faster is more supicious. Faster scans are achieved with the options -T4 and -T5, as opposed to slower scans with -T0 or -T1. The latter are super slow, only for paranoic users.
nmap -T5 192.168.1.200
Nmap scripting engine. Edit
Scripts are located in /usr/share/nmap/scripts
Run default scripts agains a host (-sC = default scripts):
nmap -sC 192.168.1.200
Run non intrusive scripts against a host.
nmap --script safe 192.168.1.200
Run vulnerability detecting scripts against a host.
nmap --script vuln 192.168.1.200
Run all relevant scripts against a host. Can be very slow and "noisy"
nmap --script all 192.168.1.200
Examples of specific scripts:
Scan a host and use SMB OS discovery script (--script = use specified script):
nmap 10.0.0.19 -p 139,445 --script smb-os-discovery.nse
Detect users using SMB:
nmap -p 139, 145 --script smb-enum-users 192.168.1.200
Check for known SMB vulnerabilities_
nmap -p 139,445 --script=smb-check-vulns --script-args=unsafe=1 192.168.1.200
Zone transfer against hosts running a DNS server:
nmap --script=dns-zone-transfer -p 53 ns2.example.com
Script against a Coldfusion server to try to get admin password using directory traversal:
nmap -v -p 80 --script=http-vuln-cve2010-2861 192.168.1.139
Script to check if FTP server allows anonymous login:
nmap -v -p 21 --script=ftp-anon.nse 192.168.1.130-140