In nearly all situations nmap gets the job done. So the saying “Jack of all trades, and master of none” does not apply to nmap as it is clearly master of nearly all. Therefore in this post I will discuss 5 alternatives to nmap. These are not alternatives to all the features of nmap just some areas of focus they are better.
Nmap History
Nmap is first released in Phrack magazine in 1997 and has remained the number one tool for scanning down networks and ports since. It has a vast array of tools, from service identification, to scripts for exploiting. Most of the tools listed below work well with nmap and are not simplify a replacement for it. Once they do their job, then nmap can do its job.
Set up
All the commands on this list are run on “Kali Linux” that has docker installed.
Alternatives to nmap
netdiscover
Netdiscover is a great tool to sit and wait for systems to appear on a network. Leave it running in a terminal and once a new host joins a network then it will pop up.
sudo netdiscover -i enp0s8 -r 192.168.186.0.24
rustscan
Rustscan is a superfast network port scanner. And if used as recommended in a docker image, then its even faster. After rustscan runs and identifies a list of ports, it then runs these through “nmap -A” to identify the service and can use nmaps scripts. Stealth is not something you are looking for when using rustscan as it blasts out 5000 scans a second. This makes it perfect for CTF challenges.
docker run -it --rm --name rustscan cmnatic/rustscan:debian-buster rustscan 127.0.0.1
arp-scan
arpscan is a command-line tool that uses the ARP protocol (layer 2) to discover and fingerprint IP hosts on the local network.
sudo arp-scan 192.168.186.0/24masscan
Masscan is designed to be a Internet level IP port scanner. It can be used to scan 10,000s of systems and is not intended to scan single hosts. And so just like rustscan, masscan can run nmap commands on the results.
sudo masscan -p- 192.168.186.0/24 --rate 10000000
Nessus
Nessus is enterprise level scanner. So it can track down all port and all IPs on a cooperate network and check for vulnerabilities. The reporting is second to none and if you are in a Cybersecurity Role you should aware of it and how it works.
Nessus Essentials is free version with most of the tools enabled. The main limitation is that it only lets you manage up to 15 IP addresses. See my post on setting up Nessus and running a scan for more information.
Alternatives to nmap for CTF challenges
All of the above are useful for CTF challenges. Rustscan is about the most useful as although it’s a really noisy network scan and easily detected by intrusion tools, we don’t care about such thing for Capture the Flag challenges.
Wrap-Up
I hope you found some value in “5 Alternatives to nmap” and if you have any comments please add them below.
Support
I really enjoy making this content and if you would like to support the cost of keeping this site up and running, please make a purchase through one of my affiliate links.