nmap
A collection of Nmap NSE scripts and commands for brute-forcing and enumerating network services.
$ host discovery first
Before brute-forcing anything, work out which hosts are actually up. A ping sweep with -sn skips port scanning entirely, so it is fast and quiet.
# Ping sweep a subnet (no port scan)
nmap -sn 192.168.1.0/24
# Ping sweep with a list of targets from a file
nmap -sn -iL targets.txt
# Skip host discovery entirely (useful when ICMP is blocked)
nmap -Pn <target>$ fast scans with top ports
# Scan the 1000 most common TCP ports (default)
nmap <target>
# Scan the top 100 ports — much faster, still finds most services
nmap --top-ports 100 <target>
# Scan the top 20 ports for a very quick triage
nmap --top-ports 20 <target>
# Fast scan: fewer probes, no fragmentation, parallel groups
nmap -F <target>
# Full TCP SYN scan of every port (slow but thorough)
nmap -sS -p- <target>
# Speed up a full scan with a bigger min-rate
nmap -sS -p- --min-rate 5000 <target>$ service version and default script detection
# Detect service versions on open ports
nmap -sV <target>
# Version detection with the default script set (common combos)
nmap -sV -sC <target>
# Aggressive scan: OS detection, version detection, script scanning and traceroute
nmap -A <target>
# Only run version detection against a specific port
nmap -sV -p 3306 <target>$ database services
MySQL on 3306, Microsoft SQL on 1433, PostgreSQL on 5432, MongoDB on 27017, Redis on 6379, Cassandra on 9160 and Oracle on 1521 all have dedicated NSE scripts.
# Basic MySQL brute force
nmap --script=mysql-brute <target>
# MySQL brute force with custom credentials
nmap --script=mysql-brute --script-args userdb=/path/to/users.txt,passdb=/path/to/passwords.txt <target>
# MySQL enum
nmap -p 3306 --script mysql-enum <target>
# MySQL users enum
nmap -p 3306 --script mysql-users --script-args="mysqluser='root',mysqlpass='password'" <target>
# MySQL databases enum
nmap -p 3306 --script mysql-databases --script-args="mysqluser='root',mysqlpass='password'" <target>
# MySQL hashdump
nmap -p 3306 --script mysql-dump-hashes --script-args="username='root',password='password'" <target>
# MS SQL brute force
nmap -p 1433 --script ms-sql-brute <target>
# MS SQL empty password check
nmap -p 1433 --script ms-sql-empty-password <target>
# MS SQL xp_cmdshell command execution (requires credentials)
nmap -p 1433 --script ms-sql-xp-cmdshell --script-args mssql.username=sa,mssql.password=sa,ms-sql-xp-cmdshell.cmd="ipconfig" <target>
# MS SQL information gathering
nmap -p 1433 --script ms-sql-info,ms-sql-ntlm-info,ms-sql-empty-password <target>
# MS SQL dump hashes
nmap -p 1433 --script ms-sql-dump-hashes --script-args mssql.username=sa,mssql.password=password <target>
# PostgreSQL brute force
nmap -p 5432 --script pgsql-brute <target>
# PostgreSQL brute force with specific credentials
nmap -p 5432 --script pgsql-brute --script-args userdb=/path/to/users.txt,passdb=/path/to/passwords.txt <target>
# PostgreSQL info gathering
nmap -p 5432 --script pgsql-info <target>
# MongoDB brute force
nmap -p 27017 --script mongodb-brute <target>
# MongoDB info gathering
nmap -p 27017 --script mongodb-info <target>
# MongoDB database list (no auth)
nmap -p 27017 --script mongodb-databases <target>
# MongoDB database list (with auth)
nmap -p 27017 --script mongodb-databases --script-args="mongodb-databases.username='admin',mongodb-databases.password='password'" <target>
# Redis brute force
nmap -p 6379 --script redis-brute <target>
# Redis info gathering
nmap -p 6379 --script redis-info <target>
# Redis key enumeration
nmap -p 6379 --script redis-keys <target>
# Cassandra brute force
nmap -p 9160 --script=cassandra-brute <target>
# Cassandra info gathering
nmap -p 9160 --script=cassandra-info <target>
# Oracle SID enumeration
nmap -p 1521 --script oracle-sid-brute <target>
# Oracle brute force
nmap -p 1521 --script oracle-brute --script-args oracle-brute.sid=ORCL <target>
# Oracle TNS version
nmap -p 1521 --script oracle-tns-version <target>$ web services
# AJP Tomcat brute force
nmap -p 8009 --script ajp-brute <target>
# Tomcat manager brute force (HTTP)
nmap -p 8080 --script http-tomcat-manager-brute <target>
# Tomcat default credentials check
nmap -p 8080 --script http-default-accounts --script-args http-default-accounts.category=web <target>
# WordPress brute force
nmap -p 80 --script http-wordpress-brute <target>
# WordPress user enumeration
nmap -p 80 --script http-wordpress-enum <target>
# Joomla brute force
nmap -p 80 --script http-joomla-brute <target>
# Drupal brute force
nmap -p 80 --script http-form-brute --script-args http-form-brute.path=/drupal/,http-form-brute.method=POST,http-form-brute.form=form_id:user_login_form&name:^USER^&pass:^PASS^&op:Log+in <target>$ email services
# POP3 brute force
nmap -sV --script=pop3-brute <target>
# POP3 capabilities check
nmap -p 110 --script pop3-capabilities <target>
# POP3 with specific credentials
nmap -p 110 --script pop3-brute --script-args userdb=/path/to/users.txt,passdb=/path/to/passwords.txt <target>
# IMAP brute force
nmap -p 143 --script imap-brute <target>
# IMAP capabilities
nmap -p 143 --script imap-capabilities <target>
# SMTP brute force
nmap -p 25 --script smtp-brute <target>
# SMTP user enumeration
nmap -p 25 --script smtp-enum-users <target>
# SMTP commands
nmap -p 25 --script smtp-commands <target>$ network protocols
# SNMP brute force (community strings)
nmap -sU --script snmp-brute <target>
# SNMP with custom communities list
nmap -sU -p 161 --script snmp-brute --script-args snmp-brute.communitiesdb=/path/to/communities.txt <target>
# SNMP information gathering (with known community)
nmap -sU -p 161 --script snmp-info --script-args snmp-info.community=public <target>
# SNMP system processes
nmap -sU -p 161 --script snmp-processes --script-args snmp-processes.community=public <target>
# SSH brute force
nmap -p 22 --script ssh-brute --script-args userdb=/path/to/users.txt,passdb=/path/to/passwords.txt <target>
# SSH host key enumeration
nmap -p 22 --script ssh-hostkey <target>
# SSH authorised keys
nmap -p 22 --script ssh-auth-methods <target>
# SIP brute force
nmap -sU -p 5060 --script=sip-brute <target>
# SIP methods enumeration
nmap -sU -p 5060 --script=sip-methods <target>
# RDP NTLM information
nmap -p 3389 --script rdp-ntlm-info <target>
# RDP security check
nmap -p 3389 --script rdp-enum-encryption <target>
# FTP brute force
nmap -p 21 --script ftp-brute <target>
# FTP anonymous login
nmap -p 21 --script ftp-anon <target>
# FTP bounce (scan through FTP server)
nmap -b anonymous:password@<ftp_target> <scan_target>
# SMB brute force
nmap -p 445 --script smb-brute <target>
# SMB OS discovery
nmap -p 445 --script smb-os-discovery <target>
# SMB security mode
nmap -p 445 --script smb-security-mode <target>
# SMB enum shares
nmap -p 445 --script smb-enum-shares <target>
# SMB enum users
nmap -p 445 --script smb-enum-users <target>$ other services
# RTSP URL brute force (media streaming)
nmap --script rtsp-url-brute -p 554 <target>
# RTSP methods
nmap --script rtsp-methods -p 554 <target>
# XMPP (Jabber) brute force
nmap -p 5222 --script xmpp-brute <target>
# XMPP info
nmap -p 5222 --script xmpp-info <target>
# IPMI brute force
nmap -sU -p 623 --script ipmi-brute <target>
# IPMI version and cipher suites
nmap -sU -p 623 --script ipmi-version <target>
# LDAP brute force
nmap -p 389 --script ldap-brute <target>
# LDAP search
nmap -p 389 --script ldap-search <target>
# LDAP rootDSE
nmap -p 389 --script ldap-rootdse <target>
# DNS brute force subdomains
nmap --script dns-brute <domain>
# DNS zone transfer
nmap --script dns-zone-transfer --script-args dns-zone-transfer.domain=<domain> <target>$ NSE vulnerability scanning
The vuln category runs scripts that check for known CVEs. Combine it with version detection so the scripts have good fingerprints to work from.
# Run every script in the vuln category
nmap -sV --script vuln <target>
# Vuln scanning on a specific port
nmap -sV -p 3306 --script vuln <target>
# Check for a specific class of weakness, e.g. brute-forcing and auth bypass
nmap --script "auth or brute" <target>
# List all available NSE scripts matching a pattern
nmap --script-help "mysql*"$ timing templates
-T0 (paranoid) through -T5 (insane) control scan speed. -T4 is the usual choice for internal networks; -T5 can produce unreliable results.
# Aggressive timing — fast, still reliable on a LAN
nmap -T4 <target>
# Insane timing — may miss services or get filtered
nmap -T5 <target>
# Very slow and quiet: evade rate-based IDS alerts
nmap -T1 --max-retries 1 <target>
# Slow scan with randomised host order to blend in
nmap -T2 --randomize-hosts -iL targets.txt$ output formats
# Save results in all three formats at once (normal, XML, grepable)
nmap -oA scan_results <target>
# Normal output to file
nmap -oN output.txt <target>
# XML output (good for importing into other tools)
nmap -oX output.xml <target>
# Grepable output (good for quick pipelines)
nmap -oG output.grep <target>
# Increase verbosity and show debugging detail
nmap -v -d <target>$ port range tricks
# Scan specific ports and ranges
nmap -p 22,80,443,3306-3310 <target>
# Scan all UDP ports (slow — narrow it down)
nmap -sU -p 53,161,623,5060 <target>
# Combine TCP and UDP in one sweep
nmap -sS -sU -p T:22,80,U:53,161 <target>
# Scan ports excluding noisy ranges
nmap -p- --exclude-ports 9100-9102 <target>
# Source port spoofing — sometimes slips past naive firewall rules
nmap --source-port 53 <target>$ wordlists and hydra
# Generate custom wordlist from a website
cewl -d 2 -m 5 http://target.com -w wordlist.txt
# Extract words from files in current directory
grep -r -a -o "\w\{5,\}" . | sort -u > wordlist.txt
# Generate username variations
john --wordlist=names.txt --rules=Wordlist --stdout > usernames.txt
# HTTP POST form brute force with hydra
hydra -l admin -P /path/to/passwords.txt <target> http-post-form "/login.php:username=^USER^&password=^PASS^:F=Login failed"
# SSH
hydra -L /path/to/users.txt -P /path/to/passwords.txt <target> ssh
# FTP
hydra -l admin -P /path/to/passwords.txt <target> ftp
# MySQL
hydra -l root -P /path/to/passwords.txt <target> mysql
# RDP
hydra -L /path/to/users.txt -P /path/to/passwords.txt <target> rdp