Skip to content

Nmap

Nmap

Bases: Scanner

arun(timeout=None, **kwargs) async

Run nmap command asynchronously.

Parameters:

Name Type Description Default
timeout Optional[float]

Timeout for nmap process, defaults to None

 None

Returns:

Type Description
Optional[NmapRun]

NmapRun object or None

run(timeout=None, **kwargs)

Run nmap command.

Parameters:

Name Type Description Default
timeout Optional[float]

Timeout for nmap process, defaults to None

 None

Returns:

Type Description
Optional[NmapRun]

NmapRun object or None

with_ack_discovery(*ports)

TCP ACK Discovery (-PA): Send ACK packets to specified ports.

Parameters:

Name Type Description Default
ports str

Ports to perform ACK discovery on

 ()

with_ack_scan()

TCP ACK Scan (-sA).

with_aggressive_scan()

Enable aggressive scan options (-A).

with_ascii_data(data)

Send specified ASCII data (--data-string).

Parameters:

Name Type Description Default
data str

ASCII data string

 required

with_bad_sum()

Send packets with a bogus TCP/UDP/SCTP checksum (--badsum).

with_connect_scan()

TCP Connect Scan (-sT).

with_consecutive_port_scanning()

Scan ports sequentially (-r), do not randomize the order.

with_custom_dns_servers(*servers)

Specify custom DNS servers (--dns-servers).

Parameters:

Name Type Description Default
servers str

List of DNS servers to use

 ()

with_data_dir(dirname)

Specify custom data directory (--datadir).

Parameters:

Name Type Description Default
dirname str

Path to data directory

 required

with_data_length(length)

Append random data to sent packets (--data-length).

Parameters:

Name Type Description Default
length int

Length of random data

 required

with_debugging(level=1)

Increase debugging level (-d, -dd, ...).

Parameters:

Name Type Description Default
level int

Debugging level

 1

with_decoys(*decoys)

Use decoys to obfuscate scan origin (-D).

Parameters:

Name Type Description Default
decoys str

List of decoy IP addresses

 ()

with_default_script()

Run default script scan (-sC).

with_fast_mode()

Enable fast mode (-F), scans fewer ports than the default scan.

with_forced_dns_resolution()

Force DNS resolution of all targets (-R).

with_fragment_packets()

Fragment packets to evade firewall/IDS (-f).

with_ftp_bounce_scan(ftp_relay_host)

FTP Bounce Scan (-b) using a relay host.

Parameters:

Name Type Description Default
ftp_relay_host str

IP address of the FTP relay host

 required

with_hex_data(data)

Send specified hex data (--data).

Parameters:

Name Type Description Default
data str

Hex data string

 required

with_host_timeout(timeout)

Give up on target after this long (--host-timeout).

Parameters:

Name Type Description Default
timeout int

Host timeout in milliseconds

 required

with_hostgroup_size(min=None, max=None)

Parallel host scan group sizes (--min-hostgroup, --max-hostgroup).

Parameters:

Name Type Description Default
min Optional[int]

Minimum host group size, defaults to None

 None
max Optional[int]

Maximum host group size, defaults to None

 None

Raises:

Type Description
NmapArgumentError

If both min and max are None

with_icmp_echo_discovery()

ICMP Echo Request Discovery (-PE): Send ICMP Echo Request packets.

with_icmp_netmask_discovery()

ICMP Netmask Request Discovery (-PM): Send ICMP Netmask Request packets.

with_icmp_timestamp_discovery()

ICMP Timestamp Request Discovery (-PP): Send ICMP Timestamp Request packets.

with_idle_scan(zombie_host, probe_port)

Idle Scan using a zombie host (-sI).

Parameters:

Name Type Description Default
zombie_host str

IP address of the zombie host

 required
probe_port int

Probe port number

 required

with_interface(iface)

Specify network interface to use (-e).

Parameters:

Name Type Description Default
iface str

Network interface name

 required

with_ip_options(options)

Send specified IP options (--ip-options).

Parameters:

Name Type Description Default
options str

IP options string

 required

with_ip_protocol_ping_discovery(*protocols)

IP Protocol Ping Discovery (-PO): Send packets for specified protocols.

Parameters:

Name Type Description Default
protocols str

Protocols to use for IP ping discovery

 ()

with_ip_protocol_scan()

IP Protocol Scan (-sO).

with_ipv6()

Scan targets using IPv6 (-6).

with_list_scan()

List Scan (-sL): Simply list targets to scan.

with_maimon_scan()

TCP Maimon Scan (-sM).

with_max_retries(tries)

Caps number of port scan probe retransmissions (--max-retries).

Parameters:

Name Type Description Default
tries int

Maximum number of retries

 required

with_most_common_ports(top)

Scan the most common ports (--top-ports).

Parameters:

Name Type Description Default
top int

Number of top common ports to scan

 required

Raises:

Type Description
NmapArgumentError

If top is not between 1 and 65535

with_mtu(offset)

Specify MTU (Maximum Transmission Unit) offset (--mtu).

Parameters:

Name Type Description Default
offset int

MTU offset, must be a multiple of eight

 required

Raises:

Type Description
NmapArgumentError

If offset is not a multiple of eight

with_os_detection()

Enable OS detection (-O).

with_osscan_guess()

Guess OS when detection is not conclusive (--osscan-guess).

with_osscan_limit()

Limit OS detection to promising targets (--osscan-limit).

with_packet_trace()

Show all packets sent and received (--packet-trace).

with_parallelism(min=None, max=None)

Probe parallelization (--min-parallelism, --max-parallelism).

Parameters:

Name Type Description Default
min Optional[int]

Minimum parallelism, defaults to None

 None
max Optional[int]

Maximum parallelism, defaults to None

 None

Raises:

Type Description
NmapArgumentError

If both min and max are None

with_ping_scan()

Ping Scan (-sn): Disable port scan, only discover hosts.

with_port_exclusion(*ports)

Exclude specified ports from scanning (--exclude-ports).

Parameters:

Name Type Description Default
ports str

List of ports to exclude

 ()

with_port_ratio(ratio)

Scan ports more common than a specified ratio (--port-ratio).

Parameters:

Name Type Description Default
ratio float

Ratio for common ports

 required

Raises:

Type Description
NmapArgumentError

If ratio is not between 0 and 1

with_privileged()

Assume that the user has special privileges (--privileged).

with_proxies(*proxies)

Use specified proxies for scanning (--proxies).

Parameters:

Name Type Description Default
proxies str

List of proxy addresses

 ()

with_random_targets(number)

Choose random targets for scanning.

Parameters:

Name Type Description Default
number int

Number of IPs to generate for scanning

 required

with_rate(min=None, max=None)

Send packets no slower/faster than min/max per second (--min-rate, --max-rate).

Parameters:

Name Type Description Default
min Optional[int]

Minimum rate, defaults to None

 None
max Optional[int]

Maximum rate, defaults to None

 None

Raises:

Type Description
NmapArgumentError

If both min and max are None

with_reason()

Display the reason a port is in a particular state (--reason).

with_rtt_timeout(min=None, max=None, initial=None)

Specifies probe round trip time (--min-rtt-timeout, --max-rtt-timeout, --initial-rtt-timeout).

Parameters:

Name Type Description Default
min Optional[int]

Minimum RTT timeout, defaults to None

 None
max Optional[int]

Maximum RTT timeout, defaults to None

 None
initial Optional[int]

Initial RTT timeout, defaults to None

 None

Raises:

Type Description
NmapArgumentError

If all parameters are None

with_scan_delay(time=None, max_time=None)

Adjust delay between probes (--scan-delay, --max-scan-delay).

Parameters:

Name Type Description Default
time Optional[int]

Scan delay time, defaults to None

 None
max_time Optional[int]

Maximum scan delay time, defaults to None

 None

Raises:

Type Description
NmapArgumentError

If both time and max_time are None

with_script_arguments(**arguments)

Pass arguments to scripts (--script-args).

Parameters:

Name Type Description Default
arguments str

Dictionary of script arguments

 {}

with_script_arguments_file(filename)

Load script arguments from a file (--script-args-file).

Parameters:

Name Type Description Default
filename str

File containing script arguments

 required

with_script_help(*scripts)

Show help for specified scripts (--script-help).

Parameters:

Name Type Description Default
scripts str

List of scripts to show help for

 ()

with_script_trace()

Show all data sent and received during script scan (--script-trace).

with_script_update_db()

Update the script database (--script-updatedb).

with_scripts(*scripts)

Run specified scripts (--script).

Parameters:

Name Type Description Default
scripts str

List of scripts to run

 ()

SCTP COOKIE-ECHO Scan (-sZ).

with_sctp_discovery(*ports)

SCTP INIT Discovery (-PY): Send SCTP INIT packets to specified ports.

Parameters:

Name Type Description Default
ports str

Ports to perform SCTP discovery on

 ()

with_sctp_init_scan()

SCTP INIT Scan (-sY).

with_send_ethernet()

Send packets at raw ethernet level (--send-eth).

with_send_ip()

Send packets at raw IP level (--send-ip).

with_service_info()

Detect service versions (-sV).

with_source_port(port)

Specify source port number (--source-port).

Parameters:

Name Type Description Default
port int

Source port number

 required

with_spoof_address(ip)

Spoof source IP address (-S).

Parameters:

Name Type Description Default
ip str

IP address to spoof

 required

with_spoof_mac(mac)

Spoof MAC address (--spoof-mac).

Parameters:

Name Type Description Default
mac str

MAC address to spoof

 required

with_syn_discovery(*ports)

TCP SYN Discovery (-PS): Send SYN packets to specified ports.

Parameters:

Name Type Description Default
ports str

Ports to perform SYN discovery on

 ()

with_syn_scan()

TCP SYN Scan (-sS).

with_system_dns()

Use OS's DNS resolver (--system-dns).

with_tcp_fin_scan()

TCP FIN Scan (-sF).

with_tcp_null_scan()

TCP Null Scan (-sN).

with_tcp_scan_flags(*flags)

Custom TCP Scan Flags (--scanflags).

Parameters:

Name Type Description Default
flags TCPFlag

List of TCP flags to set

 ()

with_tcp_xmas_scan()

TCP Xmas Scan (-sX).

with_time_to_live(ttl)

Set IP time-to-live (TTL) field (-ttl).

Parameters:

Name Type Description Default
ttl int

TTL value

 required

Raises:

Type Description
NmapArgumentError

If TTL is not between 0 and 225

with_timing_template(template)

Set timing template (-T).

Parameters:

Name Type Description Default
template TimingTemplate

Timing template to use

 required

with_traceroute()

Perform traceroute to discovered hosts (--traceroute).

with_udp_discovery(*ports)

UDP Discovery (-PU): Send UDP packets to specified ports.

Parameters:

Name Type Description Default
ports str

Ports to perform UDP discovery on

 ()

with_udp_scan()

UDP Scan (-sU).

with_verbose(level=1)

Increase verbosity level (-v, -vv, ...).

Parameters:

Name Type Description Default
level int

Verbosity level

 1

with_version_all()

Try every single probe (--version-all, intensity 9).

with_version_intensity(intensity=7)

Set version scan intensity (--version-intensity).

Parameters:

Name Type Description Default
intensity int

Intensity level (0 to 9)

 7

Raises:

Type Description
NmapArgumentError

If intensity is not between 0 and 9

with_version_light()

Limit version scan to most likely probes (--version-light, intensity 2).

with_version_trace()

Show detailed version scan activity (--version-trace, for debugging).

with_window_scan()

TCP Window Scan (-sW).

without_closed_ports()

Only show open (or possibly open) ports (--open).

without_dns_resolution()

Skip DNS resolution (-n).

without_ping()

Treat all hosts as online -- skip host discovery (-Pn).

without_privileged()

Assume that the user does not have special privileges (--unprivileged).