CySA+ - Nmap
Nmap Security Scanner - ANS-A versatile port scanner used for topology, host, service,
and OS discovery and enumeration
List Scan (-sL) - ANS-Lists the IP addresses from the supplied target range(s) and
performs a reverse-DNS query to discover any host names associated with those IPs
TCP SYN ping (-PS <PortList>) - ANS-Probes specific ports from the given list using a
TCP SYN packet instead of an ICMP packet to conduct the ping
Sparse Scanning (--scan-delay ) - ANS-Issues probes with significant delays to become
stealthier and avoid detection by an IDS or IPS
Scan Timing (-Tn) - ANS-Issues probes with using a timing pattern with n being the
pattern to utilize (0 is slowest and 5 is fastest)
TCP Idle Scan (-sI) - ANS-Another stealth method, this scan makes it appear that
another machine (a zombie) started the scan to hide the true identity of the scanning
machine
Fragmentation (-f or --mtu) - ANS-A technique that splits the TCP header of each probe
between multiple IP datagrams to make it hard for an IDS or IPS to detect
Saving results of a discovery scan - ANS-▪ Interactive (default) to screen
▪ Normal (-oN) to file
▪ XML (-oX) to file
▪ Grepable (-oG) to file
XML or grepable output can be integrated with most SIEM products
Service Discovery - ANS-Determine which network services and operating systems are
in use by a target
TCP SYN (-sS) - ANS-Conducts a half-open scan by sending a SYN packet to identify
the port state without sending an ACK packet afterwards
Nmap Security Scanner - ANS-A versatile port scanner used for topology, host, service,
and OS discovery and enumeration
List Scan (-sL) - ANS-Lists the IP addresses from the supplied target range(s) and
performs a reverse-DNS query to discover any host names associated with those IPs
TCP SYN ping (-PS <PortList>) - ANS-Probes specific ports from the given list using a
TCP SYN packet instead of an ICMP packet to conduct the ping
Sparse Scanning (--scan-delay ) - ANS-Issues probes with significant delays to become
stealthier and avoid detection by an IDS or IPS
Scan Timing (-Tn) - ANS-Issues probes with using a timing pattern with n being the
pattern to utilize (0 is slowest and 5 is fastest)
TCP Idle Scan (-sI) - ANS-Another stealth method, this scan makes it appear that
another machine (a zombie) started the scan to hide the true identity of the scanning
machine
Fragmentation (-f or --mtu) - ANS-A technique that splits the TCP header of each probe
between multiple IP datagrams to make it hard for an IDS or IPS to detect
Saving results of a discovery scan - ANS-▪ Interactive (default) to screen
▪ Normal (-oN) to file
▪ XML (-oX) to file
▪ Grepable (-oG) to file
XML or grepable output can be integrated with most SIEM products
Service Discovery - ANS-Determine which network services and operating systems are
in use by a target
TCP SYN (-sS) - ANS-Conducts a half-open scan by sending a SYN packet to identify
the port state without sending an ACK packet afterwards
