Nmap Command Builder
Build an nmap command from choices (targets, scan type, ports, detection, scripts, timing, output), with what each option does and warnings. Nothing is run.
Runs in your browser Your input never leaves your device.
Scan only systems you own or have written permission to test. This page builds a command line and runs nothing. Evasion options and the exploit, brute-force and DoS script categories are left out on purpose.
— What each part does
| Option | Meaning |
|---|
The command is built in your browser from your choices and nothing is run. Options were checked against the nmap manual page and the shell quoting against bash. Quote rules are for bash and similar shells; in PowerShell or cmd, quote the arguments your way.
Report a problem with this tool
About this tool
nmap has hundreds of options and the right combination depends on what you need to learn. This builder turns plain choices into a command line and explains every part of it. Choose targets (hosts, IPv4 and IPv6 addresses, CIDR blocks and nmap octet ranges such as 10.0.0-3.1-254, plus an exclude list or an input file), a scan type (SYN, connect, UDP, ACK, window, FIN, null, Xmas, SCTP, host discovery only or list only), a host discovery method, DNS behaviour, ports (default, fast, top N, all, or a list with T: and U: prefixes), service and version detection with intensity, OS detection, default and chosen NSE scripts, traceroute or the aggressive -A bundle, a timing template, rate limits, retries and a host timeout, and reporting options including normal, XML and all-format output files. Warnings appear when an option needs raw-socket privileges, when a scan will be slow (all ports, UDP, T0 and T1), when T5 may miss ports, or when a script category is intrusive, and a reminder to scan only with permission is always shown. Targets are checked so one that starts with a dash can never be read as an option, ports and numbers are validated, and every value is shell-quoted. By design the tool does not offer evasion options (decoys, fragmentation, spoofed sources) or the exploit, brute, dos, fuzzer and intrusive script categories; the vuln category is available with a warning, and you can still type a specific script name. The builder only writes text. It was tested without running nmap: every option it can produce was looked up in the nmap manual page, each command was passed through bash with printf in place of nmap to prove the quoting returns every argument unchanged, and target syntax was compared with Python's ipaddress module. Quoting follows POSIX shells; in PowerShell or cmd, quote arguments your own way.
How to use it
- Pick a preset or start from scratch, and enter the targets you are authorised to scan.
- Choose the scan type, ports and detection options.
- Read the warnings and the explanation of each option.
- Copy the command and run it yourself, with sudo if the warnings say raw sockets are needed.
Common problems
- The command is empty and a message appears
- Fix the listed problem first: a target that is not valid, a port list with a mistake, or a number out of range. The command is only shown when everything is valid.
- I need an option that is not offered
- Evasion options and the exploit, brute, dos and fuzzer script categories are left out on purpose. Add other options by hand after copying the command.
- The scan is very slow
- Use fewer ports (fast or top N), a higher timing template such as -T4 on a reliable network, a rate limit, or a host timeout. UDP and all-port scans are slow by nature.