███╗ ██╗███╗ ███╗ █████╗ ██████╗ ███╗ ███╗ █████╗ ███████╗████████╗███████╗██████╗ ██╗ ██╗
████╗ ██║████╗ ████║██╔══██╗██╔══██╗ ████╗ ████║██╔══██╗██╔════╝╚══██╔══╝██╔════╝██╔══██╗╚██╗ ██╔╝
██╔██╗ ██║██╔████╔██║███████║██████╔╝ ██╔████╔██║███████║███████╗ ██║ █████╗ ██████╔╝ ╚████╔╝
██║╚██╗██║██║╚██╔╝██║██╔══██║██╔═══╝ ██║╚██╔╝██║██╔══██║╚════██║ ██║ ██╔══╝ ██╔══██╗ ╚██╔╝
██║ ╚████║██║ ╚═╝ ██║██║ ██║██║ ██║ ╚═╝ ██║██║ ██║███████║ ██║ ███████╗██║ ██║ ██║
╚═╝ ╚═══╝╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝ ╚═╝
God-Level Interactive Reference for SOC Analysts & Penetration Testers
A single-file, fully interactive NMAP cheatsheet built for cybersecurity professionals preparing for SOC analyst, penetration tester, and blue team interviews. No frameworks, no dependencies, no internet required — open the HTML file and it just works.
"Most candidates know nmap flags. You know the WHY behind each flag, what TCP handshake state it exploits, how IDS detects it, and how to chain flags for specific scenarios. That's what gets you hired."
| Overview Tab | Scan Types | Interview Scenarios |
|---|---|---|
| Quick-reference flag grid | Deep-dive with TCP logic | 12 real interview combos |
| Tab | Contents |
|---|---|
| Overview | Master quick-reference grid — every flag group at a glance |
| Host Discovery | Ping sweeps, ARP, ICMP, -Pn, -PS/PA — find live hosts first |
| Scan Types | SYN vs TCP Connect vs UDP, Null/FIN/Xmas stealth scans with handshake logic |
| Port Selection | Single ports, ranges, all 65535, UDP+TCP combos, --min-rate tricks |
| Version & OS | -sV, -O, -A, --osscan-guess, version intensity control |
| NSE Scripts | EternalBlue, Heartbleed, DNS zone transfer, FTP anon, HTTP enumeration |
| Timing | -T0 through -T5 explained, --min-rate, --max-rate, parallelism |
| Output | -oA as the professional standard, --reason, --packet-trace |
| Firewall Evasion | Decoys (-D), fragmentation (-f), source port spoofing, MAC spoofing |
| Interview Scenarios | 12 real-world command combos with full explanations of WHY |
Option 1 — Just open it:
git clone https://github.com/Oracleo/Nmap-GOD-Level-Cheatsheet.git
cd nmap-mastery-cheatsheet
open nmap-cheatsheet.html # macOS
xdg-open nmap-cheatsheet.html # LinuxOption 2 — Live on GitHub Pages:
Visit the live demo → oracleo.github.io/Nmap-GOD-Level-Cheatsheet
HOST DISCOVERY │ SCAN TYPES │ PORT CONTROL │ VERSION & OS
──────────────────┼───────────────────┼───────────────────┼──────────────────
-sn ping sweep │ -sS SYN stealth │ -p- all ports │ -sV versions
-Pn skip ping │ -sT TCP connect │ -F top 100 │ -O OS detect
-PS SYN ping │ -sU UDP │ --top-ports N │ -A aggressive
-PR ARP (LAN) │ -sA ACK/fw map │ -p U:,T: combo │ --version-all
-PE ICMP echo │ -sN/F/X stealth │ --min-rate 5000 │ --osscan-guess
NSE SCRIPTS │ TIMING │ EVASION │ OUTPUT
──────────────────┼───────────────────┼───────────────────┼──────────────────
-sC defaults │ -T0 paranoid │ -f fragment │ -oN normal
--script=vuln │ -T1 sneaky │ -D decoys │ -oX XML
smb-vuln-ms17-010 │ -T3 normal │ --source-port 53 │ -oG grepable
ssl-heartbleed │ -T4 aggressive │ --spoof-mac │ -oA all formats
dns-zone-transfer │ -T5 insane │ --data-length │ --open --reason
Real command combinations you'll be asked to demonstrate:
# 1. Full port scan, fast (CTF standard)
nmap -p- --min-rate 5000 -T4 10.10.10.5
# 2. Full enumeration after finding open ports
nmap -sV -sC -O -p 22,80,443 -oA full_enum target
# 3. Maximum stealth — evade IDS
nmap -sS -T1 -f -D RND:10 --source-port 53 --data-length 25 target
# 4. Check for EternalBlue (MS17-010)
nmap -p 445 --script=smb-vuln-ms17-010 10.10.10.5
# 5. Scan target that blocks ping
nmap -Pn -sS -p- -T4 target
# 6. SOC incident response triage
nmap -F -sV -T4 --open suspicious_ip -oN ir_triage.txt
# ... 6 more inside the cheatsheet- Live Search — Filter any command, flag, or keyword instantly across all categories
- Tabbed Navigation — 9 organized sections, zero clutter
- Terminal Aesthetic — Dark, hacker-themed UI built with pure HTML/CSS/JS
- Responsive — Works on desktop and mobile
- Zero Dependencies — Single HTML file, works fully offline
- Severity Badges — Commands tagged as STEALTH / LOUD / RECON / CRITICAL / PRO
- Guru Tips — Contextual interview insights throughout each section
✅ SOC Analyst candidates preparing for technical interviews
✅ Penetration tester trainees (OSCP, CEH, eJPT prep)
✅ Blue teamers who want to think like red teamers
✅ CTF players (HackTheBox, TryHackMe)
✅ Security engineers needing a quick reference
✅ Anyone learning network reconnaissance fundamentals
| Layer | Choice | Why |
|---|---|---|
| Structure | Pure HTML5 | Zero build step, instant open |
| Styling | CSS3 + Custom Properties | No framework bloat |
| Logic | Vanilla JavaScript | Live search, tab switching |
| Fonts | Google Fonts (Orbitron, Share Tech Mono, Rajdhani) | Terminal aesthetic |
| Hosting | GitHub Pages | Free, fast, permanent URL |
Nmap-GOD-Level-Cheatsheet/
│
├── Nmap-GOD-Level-Cheatsheet.html # ← The entire app. One file.
├── README.md # ← You are here
└── LICENSE # MIT
Found a missing command? Know a better interview answer? PRs are welcome.
# Fork → Clone → Edit → PR
git clone https://github.com/yourusername/nmap-mastery-cheatsheet.gitOpen an issue if you want to suggest a new section (e.g., Metasploit integration, masscan comparison, Nmap vs RustScan).
MIT — use it, share it, build on it. Credit appreciated but not required.
If this helped you land a role or pass an interview, I'd love to know.
Built for the security community. Master the tool, master the interview.
nmap · cybersecurity · soc · penetration-testing · blue-team · red-team · ctf · interview-prep