> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/active-reconnaissance-approach/nmap/target-specification.md).

# Target Specification

Target specification is a fundamental step when using **Nmap**, as it defines the hosts, networks, or IP addresses to be scanned. Users can specify targets in multiple ways, including individual IP addresses, CIDR notation for IP address ranges, or hostnames. Additionally, Nmap supports various input formats, such as reading target lists from files or standard input.

The following sections outline common methods for specifying targets in **Nmap**, along with command examples:

***

#### **1. Specifying Hostnames or IP Addresses**

One of the simplest ways to define a target is by specifying a hostname or an IP address.

**Examples:**

* Scanning a hostname:

  ```bash
  nmap -v scanme.nmap.org
  ```
* Scanning a single IP address:

  ```bash
  nmap -v 192.168.1.1
  ```

***

#### **2. Using CIDR Notation**

**CIDR (Classless Inter-Domain Routing)** notation allows users to specify a range of IP addresses by defining a prefix length.

**Examples:**

* Scanning a subnet (e.g., all hosts in the **192.168.1.x** range):

  ```bash
  nmap -v 192.168.1.1/24
  ```
* Scanning a specific domain with CIDR notation:

  ```bash
  nmap -v -p 80,443 example.com/24
  ```

***

#### **3. Specifying an IP Range**

Users can define a specific range of IP addresses using hyphen notation.

**Examples:**

* Scanning all IP addresses from **192.168.0.1 to 192.168.0.254**:

  ```bash
  nmap 192.168.0.1-254
  ```
* Scanning a more complex IP range (e.g., multiple subnets):

  ```bash
  nmap 10.0.0-255.1-254
  ```

***

#### **4. Input from a List of Hosts or Networks**

Nmap allows scanning multiple targets by reading them from a file using the **`-iL`** option.

**Example:**

If a file named **targets.txt** contains a list of hosts and networks, the following command scans all listed targets:

```bash
nmap -v -iL targets.txt
```

or

```bash
nmap -iL targets.txt
```

***

#### **5. Choosing Random Targets**

The **`-iR`** option allows scanning a random selection of hosts.

**Examples:**

* Selecting three random targets:

  ```bash
  nmap -iR 3
  ```
* Randomly scanning **three hosts** on specific ports (80, 443, 22, 21, 445):

  ```bash
  nmap -v -p 80,443,22,21,445 -iR 3
  ```

***

#### **6. Excluding Specific Hosts or Networks**

The **`--exclude`** option allows users to exclude specific hosts or networks from the scan.

**Example:**

To scan the entire **192.168.0.0/24** subnet **except** for **192.168.0.1** and **192.168.0.2**, use:

```bash
nmap 192.168.0.0/24 --exclude 192.168.0.1,192.168.0.2
```

***

#### **7. Excluding Targets from a File**

If multiple hosts or networks need to be excluded, the **`--excludefile`** option allows users to specify exclusions from a file.

**Example:**

If a file named **exclude.txt** contains a list of hosts and networks to be excluded, use:

```bash
nmap 192.168.0.0/24 --excludefile exclude.txt
```