Ports 1 to 1023 are well-known ports reserved for privileged services, meaning you must be a superuser (root) to bind services to them. Port 0 is treated as a wildcard port and is typically used by applications to let the OS assign an ephemeral port automatically.
By default, Nmap scans the top 1000 TCP ports using a SYN scan (-sS) if run as root. If not, it defaults to a TCP connect scan (-sT) due to socket permission limits. If no scan type or ports are specified, Nmap sets them automatically. When using Nmap with proxychains, use -sT -n for full TCP scan and to skip DNS resolution.
Port State
Description
open
Port is accessible and actively listening for connections.
closed
Port is accessible but not listening for connections.
filtered
Nmap cannot determine if the port is open due to firewall or other network filters.
unfiltered
Port is accessible, but Nmap was unable to determine whether it is open or closed.
open | filtered
No response received; the port may be open or protected by a firewall.
closed | filtered
Seen only in idle scans; Nmap cannot determine if the port is closed or filtered.
Flag
Nmap Scan Technique
Description
-6
IPv6 Scan
Conducts scan over IPv6 addresses
-PR
ARP Scan
Local hosts identification via ARP requests
-sn
Ping Scan
Detects online hosts without scanning ports
-sS
TCP SYN Scan
Stealthy half-open scan using SYN packets
-sT
TCP Connect Scan (Default)
Full TCP handshake for open port detection
-sN
TCP NULL Scan
Uses no flags to find open ports on RFC systems
-sF
TCP FIN Scan
Uses FIN flag to bypass some firewalls
-sX
TCP Xmas Scan
Sets FIN, PSH, and URG flags to probe ports
-sA
TCP ACK Scan
Analyzes ACK packets to understand firewall rules
-sW
TCP Window Scan
Utilizes TCP window size variations
-sM
TCP Maimon Scan
Exploits BSD-based systems with FIN/ACK flags
-sO
IP Protocol Scan
Discovers supported IP protocols
-sY
SCTP INIT Scan
Checks open SCTP ports with INIT packets
-sI
Idle Scan
Stealthy scan using a zombie host
-b
FTP Bounce Scan
Uses FTP servers to scan on attacker's behalf
-sP
Protocol Discovery Scan
Checks for supported protocols
-sZ
SCTP COOKIE-ECHO Scan
Similar to TCP SYN for SCTP ports
Option
Description
-n
Skip DNS resolution
-F
Fast scan mode – scans fewer ports (the top 100 most common ones)
-Pn
Disable ICMP Echo requests
-vv
Extra verbosity
-sU
Performs a UDP scan
-p-
All 65535 TCP ports
-T0
Paranoid - Very slow, used to avoid detection (Timing template)
-T1
Sneaky - Slow, used for IDS evasion (Timing template)
-T2
Polite - Slower to reduce bandwidth usage (Timing template)
## ------------------| Decoys
### Decoy scanning helps hide the real origin of the scan by making it look like multiple sources are scanning the target.
sudo nmap -sS -sV -F -D xxx.xxx.xxx.xxx,xxx.xxx.xxx.xxx -oN nmap-decoys.out $IP
sudo nmap -sS -sV -F -D RND:3 -oN nmap.out $IP
## ------------------| MTU (Maximum Transmission Unit)
### This manipulates the MTU size for the scan to potentially avoid detection or network filtering.
sudo nmap -sS -sV -F --mtu 16 -D xxx.xxx.xxx.xxx -oN nmap-mtu.out $IP
## ------------------| Fragmentation
### Fragments the packets to avoid detection by some firewalls and IDS systems.
sudo nmap -f $IP
## ------------------| BadSum
### Sends packets with invalid checksums to potentially bypass firewalls or IDS that aren't configured to check checksums properly.
sudo nmap --badsum $IP
## ------------------| Source Ports
### Source port manipulation can help bypass some firewalls and security measures that inspect specific ports.
sudo nmap -p- -n -Pn -PS -g 88 $IP
sudo nmap -p- -n -Pn -PS -g 20 $IP
## ------------------| Other
sudo nmap -p- -n -Pn -PS $IP
sudo nmap -p- -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53 $IP
sudo nmap --script firewall-bypass --script-args firewall-bypass.helper="ftp", firewall-bypass.targetport=22 10.10.10.10 $IP
### The Nmap Scripting Engine (NSE) allows users to write and use scripts to automate a wide variety of networking tasks, from vulnerability detection to exploitation and brute force.
### Language: Lua
### Location of scripts: `/usr/share/nmap/scripts/`
### NSE categories: auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, vuln
## ------------------| Update the Nmap Scripts Database
sudo nmap --script-updatedb
## ------------------| Run all scripts (⚠️ noisy and slow)
nmap --script all $IP
## ------------------| Run a single script
nmap --script <script-name> $IP
## ------------------| Run a category of scripts
nmap --script <category> $IP
## ------------------| Run multiple categories
nmap --script "default,vuln" $IP
## ------------------| Logical operations / expression
nmap --script "(default or safe) and not intrusive" $IP
## ------------------| Checks for known vulnerabilities, reports only if found.
--script "vuln"
## ------------------| Loads all HTTP-related scripts (e.g., http-auth, http-title), use quotes to prevent wildcard expansion.
--script "http-*"
## ------------------| Loads all scripts except those marked as intrusive; safe for passive scanning.
--script "not intrusive"
## ------------------| Loads scripts in either the default or safe category; general-purpose non-intrusive scanning.
--script "default or safe"
## ------------------| Loads only scripts that are in both default and safe categories; minimal and secure.
--script "default and safe"
## ------------------| Loads scripts in default, safe, or intrusive categories excluding all http-* scripts; avoids web checks during deep scans.
--script "(default or safe or intrusive) and not http-*"
### | -S = SYN | -A = ACK | -F = FIN |
### | -R = RST | -P = PSH | -U = URG |
## ------------------| ICMP Ping (like traditional ping)
hping3 -1 $IP
## ------------------| Full TCP Port Scan (0-65535)
hping3 $IP --scan 0-65535 -S
## ------------------| TCP SYN Ping (Check if host is up)
hping3 -S $IP -p 80 -c 1
## ------------------| TCP Port Scan (Incremental)
hping3 -S $IP -p ++1
## ------------------| TCP SYN Scan on common ports
hping3 -S $IP --scan 22,80,443
## ------------------| Stealth Scan (No 3-way handshake)
hping3 -S $IP -p 80 -c 1 --scan 80,443,22
## ------------------| Null Scan (no flags set)
hping3 $IP -p 80 -c 1
## ------------------| XMAS Scan (FIN, PSH, URG)
hping3 -F -P -U $IP -p 80
## ------------------| ACK Scan (Firewall stateful filtering test)
hping3 -A $IP -p 80 -c 3
## ------------------| Send packet with multiple TCP flags (for IDS testing or evasion).
hping3 $IP -p 80 -S -A -F -P -U -c 1
## ------------------| TCP SYN Flood (⚠️ aggressive and noisy) (for testing IDS, rate limits)
hping3 -S $IP -p 80 --flood
## ------------------| ICMP Ping with spoofed IP
hping3 -1 $IP -a 1.2.3.4
## ------------------| TCP SYN with spoofed source IP (bypass IP-based ACLs)
hping3 -S $IP -p 22 -a 192.168.1.100
## ------------------| Randomize source port (evade stateless filtering)
hping3 -S $IP -p 80 --rand-source
## ------------------| Fragment packets (evade IDS)
hping3 -S $IP -p 80 -f
## ------------------| TCP Ping with custom TTL
hping3 -S $IP -p 80 --ttl 42
## ------------------| Send custom payload (file or string)
hping3 $IP -p 80 -E payload.txt -d 100
## ------------------| Verbose RTT measurement (like ping with TCP)
hping3 -S $IP -p 80 -V
## ------------------| Scan DNS port (UDP/TCP testing)
hping3 -S $IP -p 53
## ------------------| Test outbound port filtering (reverse shell prep)
hping3 -A $IP -p 443 --flood --rand-source
## ------------------| Basic Flags
-D # List interface/devices
-i # Select interface
-n # Do not use DNS names
-c 5 # Captures 5 number of packets and then stops
-s # To change the capture size (-s64 inspect the packet headers only)
-w # Write the output to file
-r # Read pcap file
-X # See the content of the packets in HEX & ASCII format (use -XX to shows the ethernet header)
ip6 # Show only IP6 Traffic
-q # Be less verbose (more quiet) with your output. / Show less protocol information
-t # Give human-readable timestamp output.
-tttt # Give maximally human-readable timestamp output.
-vv # Verbose output (more v’s gives more output).
-S # Print absolute sequence numbers.
-e # Get the ethernet header as well.
-E # Decrypt IPSEC traffic by providing an encryption key.
## ------------------| IP/Range
src # Source IP address
dst # Destination IP address
net # Find packets going to or from a particular network or subnet
## ------------------| Ports
port 53 # Capture DNS traffic for both source or destination
src port 53 # Capture DNS traffic for source
dst port 53 # Capture DNS traffic for destination
portrange 21-23 # Find Traffic Using Port Ranges
## ------------------| Capture all traffic on interface eth0
sudo tcpdump -i eth0 ## (tcp|udp|icmp)
## ------------------| List all available interfaces
sudo tcpdump -D
## ------------------| Capture traffic with specific IP protocol number
sudo tcpdump ip proto 6
## ------------------| Capture traffic with specific MAC address
sudo tcpdump ether host <MAC>
## ------------------| Capture traffic on a specific VLAN
sudo tcpdump vlan 10
## ------------------| Capture traffic on specific host
sudo tcpdump host $IP
## ------------------| Capture traffic on port 80 (HTTP)
sudo tcpdump port 80
## ------------------| Capture traffic from a specific source host
sudo tcpdump src host $IP
## ------------------| Capture traffic from a specific source port
sudo tcpdump src port 443
## ------------------| Capture traffic from a specific source IP and port
sudo tcpdump src host $IP and src port 22
## ------------------| Capture traffic from a specific IP on ports 80 or 443
sudo tcpdump src host $IP and \( port 80 or port 443 \)
## ------------------| Capture traffic within a specific subnet
sudo tcpdump net 192.168.1.0/24
## ------------------| Capture traffic to a specific destination host
sudo tcpdump dst host $IP
## ------------------| Capture traffic to a specific destination port
sudo tcpdump dst port 443
## ------------------| Capture traffic to a specific destination IP and port
sudo tcpdump dst host $IP and dst port 22
## ------------------| Capture traffic between two hosts
sudo tcpdump host $IP1 and host $IP2
## ------------------| Capture traffic excluding a specific host
sudo tcpdump not host $IP
## ------------------| Capture traffic excluding a specific port
sudo tcpdump not port 22
## ------------------| Save captured packets to a file
sudo tcpdump -w capture.pcap -i eth0
## ------------------| Read packets from a saved file
sudo tcpdump -r capture.pcap
## ------------------| Display packet contents in
sudo tcpdump -A -i eth0 ## ASCII
sudo tcpdump -x -i eth0 ## hex
sudo tcpdump -X -i eth0 ## hex and ASCII
## ------------------| Capture a specific number of packets
sudo tcpdump -c 10 -i eth0
## ------------------| Capture packets with a specific size snapshot
sudo tcpdump -s 0 -i eth0
## ------------------| Capture packets with a timestamp
sudo tcpdump -tttt -i eth0
sudo tcpdump -tt -i eth0 ## relative timestamp
sudo tcpdump -ttt -i eth0 ## microsecond resolution
sudo tcpdump -ttttt -i eth0 ## nanosecond resolution
## --------------------| Show ARP Packets with MAC address
sudo tcpdump -vv -e -nn ether proto 0x0806
## --------------------| Find HTTP User Agents
sudo tcpdump -vvAls0 | grep 'User-Agent:'
## --------------------| Cleartext GET Requests
sudo tcpdump -vvAls0 | grep 'GET'
## --------------------| Find HTTP Host Headers
sudo tcpdump -vvAls0 | grep 'Host:'
## --------------------| Find HTTP Cookies
sudo tcpdump -vvAls0 | grep 'Set-Cookie|Host:|Cookie:'
## --------------------| Find SSH Connections
sudo tcpdump 'tcp[(tcp[12]>>2):4] = 0x5353482D'
## --------------------| Find DNS Traffic
sudo tcpdump -vvAs0 port 53
## --------------------| Find FTP Traffic
sudo tcpdump -vvAs0 port ftp or ftp-data
## --------------------| Find NTP Traffic
sudo tcpdump -vvAs0 port 123
## --------------------| Find Cleartext Passwords
sudo tcpdump port http or port ftp or port smtp or port imap or port pop3 or port telnet -lA | egrep -i -B5 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd= |password=|pass:|user:|username:|password:|login:|pass |user '
## --------------------| Find Traffic With Evil Bit
sudo tcpdump 'ip[6] & 128 != 0'
### If you run nmap scan in brackground, never run this! this will effect to the nmap scan results
for i in {1..65535};do (nc -zvn -w 1 <IP> $i 2>&1 | grep -v -i "Connection timed out\|Connection refused"); done
#!/bin/bash
ip=172.20.0
for i in $(seq 2 255);
do
ping -c 1 -W 1 $ip.$i 1>/dev/null 2>&1
if [[ $? -eq 0 ]];
then
echo "[+] $ip.$i - is Alive!"
fi
done
#### One linner
for i in {1..254}; do (ping -c 1 172.18.0.${i} | grep "bytes from" | grep -v "Unreachable" &); done;
#!/bin/bash
## Run this script like ./portscan.sh 2>/dev/null
ip=127.0.0.1
for port in $(seq 1 65535);
do
echo 1 > /dev/tcp/$ip/$port 1>/dev/null 2>&1
if [[ $? -eq 0 ]];
then
echo "[+] $ip : $port - is Open!"
fi
done
#!/bin/bash
## Run this script like ./portscan.sh 2>/dev/null
ip=127.0.0.1
for port in $(seq 1 65535);
do
timeout .1 bash -c "echo > /dev/tcp/$ip/$port" &&
echo "[+] $ip : $port - is Open!"
done
echo "==========[ Finished ]============"
import socket
s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW)
s.bind(("eth0", 0))
ethernet = b'\x00\x0c\x29\xd3\xbe\xd6' # MAC Address Destination
ethernet += b'\x00\x0c\x29\xe0\xc4\xaf' # MAC Address Source
ethernet += b'\x08\x00' # Protocol-Type: IPv4
ip_header = b'\x45\x00\x00\x28' # Version, IHL, Type of Service | Total Length
ip_header += b'\xab\xcd\x00\x00' # Identification | Flags, Fragment Offset
ip_header += b'\x40\x06\xa6\xec' # TTL, Protocol | Header Checksum
ip_header += b'\x0a\x0a\x0a\x02' # Source Address
ip_header += b'\x0a\x0a\x0a\x01' # Destination Address
tcp_header = b'\x30\x39\x00\x50' # Source Port | Destination Port
tcp_header += b'\x00\x00\x00\x00' # Sequence Number
tcp_header += b'\x00\x00\x00\x00' # Acknowledgement Number
tcp_header += b'\x50\x02\x71\x10' # Data Offset, Reserved, Flags | Window Size
tcp_header += b'\xe6\x32\x00\x00' # Checksum | Urgent Pointer
packet = ethernet + ip_header + tcp_header
s.send(packet)
## --------------------| Setup
use filter as "smb2"
## --------------------| NTLM hash structure
[UserName]::[DoaminName]:[NTLMServerChallenge]:[NTProofStr]:[RestofNTLMv2Response]
