<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Nmap Scanning Workflows — API Reference

## Nmap CLI

```bash
# Host discovery (ping scan)
nmap -sn 192.168.1.0/24

# TCP SYN scan (requires root)
sudo nmap -sS -T4 -p 1-1024 target

# Service version detection
nmap -sV --version-intensity 5 -p 22,80,443 target

# OS detection
sudo nmap -O --osscan-guess target

# Aggressive scan (OS, version, scripts, traceroute)
nmap -A -T4 target

# Top 100 ports, fast
nmap -F -T4 target

# Full port scan
nmap -p- -T4 target

# UDP scan (requires root)
sudo nmap -sU --top-ports 20 target

# Output formats
nmap -sV -oA scan_results target  # Normal, XML, grepable
nmap -sV -oX results.xml target   # XML only
nmap -sV -oG results.gnmap target # Grepable only
```

## NSE Script Categories

```bash
# Vulnerability detection
nmap --script vuln target

# Authentication testing
nmap --script auth target

# Brute force
nmap --script brute target

# Discovery scripts
nmap --script discovery target

# SSL/TLS analysis
nmap --script ssl-enum-ciphers,ssl-cert -p 443 target

# HTTP enumeration
nmap --script http-enum,http-headers,http-methods -p 80,443 target

# SMB enumeration
nmap --script smb-enum-shares,smb-enum-users,smb-os-discovery -p 445 target

# DNS enumeration
nmap --script dns-brute target
```

## python-nmap API

```python
import nmap

nm = nmap.PortScanner()

# Basic scan
nm.scan('192.168.1.1', '22,80,443')
nm.all_hosts()              # List of scanned hosts
nm['192.168.1.1'].state()   # 'up' or 'down'

# Access port info
nm['192.168.1.1']['tcp'][80]['state']    # 'open'
nm['192.168.1.1']['tcp'][80]['name']     # 'http'
nm['192.168.1.1']['tcp'][80]['version']  # '2.4.51'

# Async scanning
nma = nmap.PortScannerAsync()
nma.scan('192.168.1.0/24', arguments='-sn', callback=my_callback)
while nma.still_scanning():
    nma.wait(2)

# Command line used
nm.command_line()  # 'nmap -oX - -sV 192.168.1.1 -p 22,80,443'

# Scan info
nm.scaninfo()  # {'tcp': {'method': 'syn', 'services': '22,80,443'}}
```

## XML Output Parsing

```python
import xml.etree.ElementTree as ET

tree = ET.parse('scan_results.xml')
root = tree.getroot()

for host in root.findall('host'):
    addr = host.find('address').get('addr')
    for port in host.findall('.//port'):
        portid = port.get('portid')
        state = port.find('state').get('state')
        service = port.find('service')
        name = service.get('name', '') if service is not None else ''
```

## Timing Templates

| Flag | Name | Description |
|------|------|-------------|
| `-T0` | Paranoid | IDS evasion, very slow |
| `-T1` | Sneaky | IDS evasion, slow |
| `-T2` | Polite | Reduced bandwidth usage |
| `-T3` | Normal | Default timing |
| `-T4` | Aggressive | Fast, reliable networks |
| `-T5` | Insane | Fastest, may miss results |
