You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<spanclass="tldr-card-title">🧱 The Foundation — Build Your Own</span>
2796
+
</div>
2797
+
<pclass="tldr-card-desc">The perfect starting point for any custom scan. This gives you the core scanning logic, allowing you to easily add or tweak flags to meet your specific target's needs without starting from scratch.</p>
<span>Version intensity (<code>--version-intensity</code>) goes from 0 to 9. A value of <code>5</code> provides a great middle ground for speed vs accuracy. Tweak <code>-T4</code> down to <code>-T3</code> if you need to be less aggressive.</span>
2814
+
</div>
2815
+
</div>
2816
+
2772
2817
<!-- TLDR Command 1 -->
2773
2818
<divclass="tldr-card">
2774
2819
<divclass="tldr-card-header">
2775
2820
<spanclass="tldr-card-number stealth">01</span>
2776
2821
<spanclass="tldr-card-title">🥷 Stealth SYN Scan — Low & Slow</span>
2777
2822
</div>
2778
-
<pclass="tldr-card-desc">A quiet, under-the-radar scan that avoids tripping IDS/IPS. Uses half-open SYN packets, fragmented payloads, skips DNS resolution, and outputs to all three file formatsfor documentation.</p>
2823
+
<pclass="tldr-card-desc">A quiet, under-the-radar scan that avoids tripping IDS/IPS. Uses half-open SYN packets, fragmented payloads, skips DNS resolution, and outputs to all three file formats. Progress tracking added for those long waits.</p>
<spanclass="tldr-card-title">🔍 Full Port Scan + Service Detection + File Output</span>
2848
+
<spanclass="tldr-card-title">🔍 Full Port Scan + Service Detection + Status Tracking</span>
2804
2849
</div>
2805
-
<pclass="tldr-card-desc">The workhorse scan. Covers all 65,535 ports, identifies service versions, runs default NSE scripts, filters for open ports only, and saves everything to disk in all formats. This is what you run after initial discovery.</p>
2850
+
<pclass="tldr-card-desc">The stable workhorse scan for thorough enumeration. Covers all 65,535 ports, identifies service versions, runs default NSE scripts, filters for open ports only, and provides timed status updates so you're never left guessing.</p>
<span>Combine <code>-sV</code> + <code>-sC</code> for comprehensive enumeration — version detection plus safe default scripts. <code>-oA</code>saves <code>.nmap</code> + <code>.xml</code> + <code>.gnmap</code> — always use it so you never lose scan data.</span>
2869
+
<span>Combine <code>-sV</code> + <code>-sC</code> for comprehensive enumeration. Adding <code>--stats-every 10s</code>(or just pressing the Spacebar/Enter key during a scan) is an absolute lifesaver for these long-running scans.</span>
2825
2870
</div>
2826
2871
</div>
2827
2872
2828
2873
<!-- TLDR Command 3 -->
2829
2874
<divclass="tldr-card">
2830
2875
<divclass="tldr-card-header">
2831
2876
<spanclass="tldr-card-number os">03</span>
2832
-
<spanclass="tldr-card-title">🖥️ OS Detection + Aggressive Enumeration + All Output Formats</span>
2877
+
<spanclass="tldr-card-title">🔥 Aggressive Pentest / CTF Scan — Loud & Fast</span>
2833
2878
</div>
2834
-
<pclass="tldr-card-desc">Deep fingerprinting scan with OS detection, aggressive guessing when uncertain, balanced version intensity, default scripts, and explicit output to all three file formats. The go-to command when you need to know exactly what's running.</p>
2879
+
<pclass="tldr-card-desc">When you don't care about stealth, are running a CTF, or just need answers yesterday. Forces extreme speed with a minimum packet rate and aggregates OS detection, version checks, scripts, and traceroute via the `-A` flag.</p>
<pre><spanclass="cmd-root">sudo nmap</span><spanclass="cmd-flag">-sS -A -p- --min-rate</span><spanclass="cmd-value">1000</span><spanclass="cmd-flag">--max-retries</span><spanclass="cmd-value">2</span><spanclass="cmd-flag">--stats-every</span><spanclass="cmd-value">10s</span><spanclass="cmd-flag">-T4 -vv -oA</span><spanclass="cmd-value">aggressive-ctf</span><spanclass="cmd-target">TARGET</span></pre>
2850
2894
</div>
2851
2895
<divclass="tldr-tip os-tip">
2852
2896
<spanclass="tip-icon">💡</span>
2853
-
<span>OS detection (<code>-O</code>) requires <strong>root/sudo</strong> and works best when the target has at least 1 open + 1 closed port. If results are uncertain, <code>--osscan-guess</code> makes Nmap print its best guess with a confidence percentage.</span>
2897
+
<span>The <code>-A</code> flag is a powerful shortcut for <code>-O -sV -sC --traceroute</code>. Paired with <code>-T4</code> and <code>--min-rate 1000</code>, this scan will tear through ports quickly. <strong>Beware:</strong> It generates immense noise and will trigger every IDS/IPS sensor immediately.</span>
💡 <strong>Pro Tip:</strong> Running these commands with <code>sudo</code> enables SYN scan (<code>-sS</code>), OS detection (<code>-O</code>), and raw socket access — resulting in <strong>faster</strong>, <strong>stealthier</strong>, and <strong>more accurate</strong> scans. Without <code>sudo</code>, Nmap falls back to the slower TCP connect scan (<code>-sT</code>).
<pstyle="margin-bottom: 12px;">💡 <strong>Pro Tip 1 — Sudo Matters:</strong> Running these commands with <code>sudo</code> enables SYN scan (<code>-sS</code>), OS detection (<code>-O</code>/-<code>A</code>), and raw socket access — resulting in <strong>faster</strong>, <strong>stealthier</strong>, and <strong>more accurate</strong> scans. Without <code>sudo</code>, Nmap falls back to the slower TCP connect scan (<code>-sT</code>).</p>
2961
+
<p>💡 <strong>Pro Tip 2 — Status Tracking:</strong> Never guess if your terminal is frozen. Appending <code>--stats-every 10s</code> to any long scan (or just hitting <strong>Spacebar / Enter</strong> mid-scan) produces real-time ETAs, completion percentages, and network timing info.</p>
0 commit comments