5

I'm looking to scan a network with multiple subnets. I'm looking for a way to shorten this to one command rather than entering each subnet. So let's say I'm try to scan 192.168.1.xx, 192.168.2.xx and so on until 192.168.10.xx. with a specified port. Is there a better way to do this or can I only scan one at a time?

Improve this question

2 Answers 2

Reset to default
14

Let's see the first five lines of the help:

Nmap 7.92 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254

The notation from the last example would give you a short option:

nmap -p22 192.168.1-10.0-255

Or you could use CIDR notation:

nmap -p22 192.168.1.0/24 192.168.2.0/23 192.168.4.0/22 192.168.8.0/23 192.168.10.0/24
Improve this answer
1
  • To avoid typing a ridiculously long command, you can use the -iL parameter to specify a list of IP ranges.
    – dcom-launch
    Apr 21, 2022 at 21:24
2

Create a list of the subnets in a text file with the following format:

10.0.2.0/24
10.0.3.0/24
10.0.4.0/24
10.10.0.0/16

Now, when you run your nmap command, use the -iL parameter:

nmap -p 22 -iL subnets.txt if your text file was saved as subnets.txt

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .