• Nmap Reference Guide
• man page
• Find scripts on your system: locate *.nse

nmap [Scan Type(s)] [Options] {target specification}
# need to run as root

#TCP Ports:
nmap -sS -T4 -p- -A -vv [IP Address]
nmap -sS -T4 -p- -A -vv --reason [IP Address]

#UDP Ports: 
nmap -sU -T4 -A -vv [IP Address]
nmap -sU -T4 -A -vv --reason [IP Address]

The following is a list and description of the 30 most common basic commands in nmap (for beginners).

• Source: Top 30 Basic NMAP Commands for Beginners

• NSE Documentation

• Source

https://www.tecmint.com/use-nmap-script-engine-nse-scripts-in-linux/

To find the scripts on your system: locate *.nse

The syntax for enabling scripts is as follows:

namp -sC [target]     #load default scripts
# OR
nmap --script filename|category|directory|expression,...[target]

Syntax: To perform a scan with most of the default scripts, use the -sC flag or alternatively use –script=default as shown here:

nmap -sC [target IP or domain name]
# OR
nmap --script=default [target IP or domain name]
# OR
nmap --script default [target IP or domain name]

Examples:

nmap --script smb-vuln* -p 445 10.10.10.4

nmap -sV --script=smb-enum-shares -p 445 10.10.10.4

nmap --script "http-*" 
# quotes to protect the wildcard from the shell

nmap --script +ms-sql-config

nmap --script-help ftp-anon

nmap --script-help default

nmap -sC example.com
# simple script scan using the default set of scripts

nmap -sn -sC example.com
# script scan without a port scan; only host scripts are eligible to run

nmap -Pn -sn -sC example.com
# script scan without host discovery or a port scan.
# All hosts are assumed up and only host scripts are eligible to run.

## Common Go-To Example:
nmap -Pn -p [csv,ports,to,scan] --script safe,discovery,vuln,exploit -T4 -vv --reason [target IP]