What does this tool do?
Nmap Command Builder generates a ready-to-run nmap command by clicking scan type (-sS SYN, -sT connect, -sU UDP, -sn ping sweep, -sA ACK), port range, timing template (-T0..-T5) and options like -sV, -O, -A, -sC, -Pn and --open. With NSE scripts (vuln, smb-vuln-ms17-010, ssl-enum-ciphers, ftp-anon) and an inline "?" explanation next to every option, it is both a learning aid and a speed tool. Everything runs in your browser — no data is sent to any server.
How to use it
- Enter your listener IP and port.
- Pick the command or payload that fits your setup.
- Copy it and use it only on systems you are authorized to test.
What it solves
When you first land on a CTF box or a real target you need host discovery, port scanning and service/version detection. This tool lets you assemble a full command like 'nmap -sS -sV -sC -p- -T4 --open 10.10.10.5' by clicking, without memorising the right flag combination. It is an ideal starting point for OSCP and HackTheBox initial enumeration.
NSE scripts and vuln scanning
The builder adds common NSE scripts through --script: vuln, smb-vuln-ms17-010 (EternalBlue), ssl-enum-ciphers, http-enum, ftp-anon and dns-brute. For example '-p445 --script smb-vuln-ms17-010' checks SMB targets for MS17-010, while '--script ssl-enum-ciphers -p443' reveals weak TLS ciphers. Combine script options with -sV to gather both version and vulnerability data in a single scan.
Frequently asked questions
What is the difference between -sS and -sT?
-sS (SYN/half-open) never completes the TCP handshake — it sends a SYN and reads the reply, so it is faster and stealthier but needs root/privileges to craft raw packets. -sT (connect) uses the OS connect() call, runs unprivileged but is noisier and leaves a full connection in the target's logs.
Why should I use -Pn?
By default nmap pings a host first to check it is up; many Windows hosts and firewalls block ICMP, so the host looks "down" and gets skipped. -Pn skips the ping phase and treats the host as alive, scanning the ports anyway — it is almost always required on HackTheBox boxes.
Is Nmap Command Builder free?
Yes. Nmap Command Builder and all 300+ tools on MagmaNex are completely free with no signup or account required.
Is my data safe?
Yes. Everything runs locally in your browser. The data you enter is never sent to a server, stored, or shared.
Does it work on mobile?
Yes. Nmap Command Builder works on phones, tablets and desktops — no app download needed.
🔒 Privacy: everything runs in your browser, your data is never sent to a server.