I'm looking to scan a network with multiple subnets. I'm looking for a way to shorten this to one command rather than entering each subnet. So let's say I'm try to scan 192.168.1.xx, 192.168.2.xx and so on until 192.168.10.xx. with a specified port. Is there a better way to do this or can I only scan one at a time?
2 Answers
Let's see the first five lines of the help:
Nmap 7.92 ( https://nmap.org ) Usage: nmap [Scan Type(s)] [Options] {target specification} TARGET SPECIFICATION: Can pass hostnames, IP addresses, networks, etc. Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
The notation from the last example would give you a short option:
nmap -p22 192.168.1-10.0-255
Or you could use CIDR notation:
nmap -p22 192.168.1.0/24 192.168.2.0/23 192.168.4.0/22 192.168.8.0/23 192.168.10.0/24
-
To avoid typing a ridiculously long command, you can use the -iL parameter to specify a list of IP ranges. Apr 21, 2022 at 21:24
Create a list of the subnets in a text file with the following format:
10.0.2.0/24
10.0.3.0/24
10.0.4.0/24
10.10.0.0/16
Now, when you run your nmap command, use the -iL
parameter:
nmap -p 22 -iL subnets.txt
if your text file was saved as subnets.txt