A clean, practical nmap reference guide for CTF players and security professionals. Bookmark it, star it, share it. Take a look around for noobs, students, CTF players, and pros. Click the arrows, scroll. Part of the SudoCode Pentesting Methodology Guide — by SudoChef.

• What is nmap?
• Scan Menu
• Flag Reference
• CTF vs Professional Use
• Common Ports
• Complementary Tools
• Cheat Sheet

nmap (Network Mapper) is a free, open-source tool used to discover hosts and services on a network. Think of it like knocking on every door in a building to see who answers — and then noting what kind of door each one has.

It is one of the first tools you will run on any target during a penetration test (authorized security assessment) or CTF (Capture the Flag) challenge.

Official documentation: https://nmap.org/docs.html

These are the most useful named scan combinations. Pick the one that fits your situation.

These tools work alongside nmap to give you a fuller picture.

# Quick start — standard scan
nmap -sV -sC -oN scan.txt <target>

# Full port scan
nmap -sV -sC -p- -oN full.txt <target>

# Host discovery only
nmap -sn 192.168.1.0/24

# Stealth scan
nmap -sS -T2 <target>

# Vulnerability scripts
nmap --script vuln <target>

# UDP top ports
nmap -sU --top-ports 20 <target>

# Web enumeration
nmap -sV -p 80,443,8080 --script http-enum <target>

# Verbosity — add to any scan
nmap -sV -sC -v <target>        # see results as they come in
nmap -sV -sC -vv <target>       # more detail
nmap -sV -sC -vvv <target>      # maximum — nothing hidden

by SudoChef · Part of the SudoCode Pentesting Methodology Guide