Nmap report: save XML, convert to HTML, import into Dradis

• Save Nmap output to a file
• Turn Nmap XML into an HTML report
• Import Nmap XML into Dradis
• What Dradis keeps from an Nmap scan
  • Before you write the report
• Combine Nmap with your vulnerability scanner
• Put the Nmap services table in your client report
• When an Nmap import looks wrong
• Nmap report FAQ
  • What does an Nmap scan show you?
  • Do I need Dradis Pro for the Nmap import?

Nmap won't write your client report. It maps the network. The findings come from your vulnerability scanners and your testers, and your client wants all of it in the template they signed off on.

So save every scan as XML. When you just want a quick look, turn it into a web page. When it goes in the report, import it into Dradis: the hosts, ports and services sit in the same project as the findings from your other tools, and go into your report template from there.

Only reading one scan yourself? The first two sections are all you need.

Save Nmap output to a file

Nmap prints to the screen unless you name a file. It has five output formats: the interactive one on screen, plus four you can write to disk.

Flag	Format	Use it for
-oN file	Normal	Reading the results yourself
-oX file	XML	Anything a program reads: HTML converters, parsers, Dradis
-oG file	Grepable	Old scripts only. Nmap calls it deprecated, and it leaves out features such as MAC address detection
-oS file	Script kiddie	Nothing in a report
-oA basename	Normal, XML and grepable	Every scan. It writes basename.nmap, basename.xml and basename.gnmap in one run

Our default is -oA. You get the XML for your tools and a normal file you can read, and you never re-run a scan because you picked the wrong format.

nmap -sV -oA acme-external 192.0.2.0/24

Four details that trip people up:

• The space after the flag matters. -oX scan.xml writes XML. -oXscan.xml writes a normal-format file named Xscan.xml.
• A dash sends XML to standard output. -oX - prints only the XML, ready to pipe into another tool.
• Filenames take date and time codes. -oX 'scan-%T-%D.xml' stamps each file, so a nightly scan never overwrites the last one.
• Don't append to an XML file. Nmap's manual says --append-output "doesn't work well for XML", and the result generally won't parse until you fix it by hand. One scan, one file.

nmap -sV -oX - 192.0.2.10
nmap -sV -oX 'scan-%T-%D.xml' 192.0.2.0/24

Turn Nmap XML into an HTML report

Nmap has no HTML output option. Near the top of the XML file there's usually a line that points at a stylesheet called nmap.xsl, and an XSLT processor applies it to produce a web page:

xsltproc acme-external.xml -o acme-external.html

Saxon and Xalan work too. Opening the XML straight in a browser "no longer works well", in Nmap's words. And the default stylesheet path is a local file on the machine that ran the scan, so the link breaks when you send the file to someone else. Two flags change the stylesheet line:

nmap -sV --webxml -oA acme-external 192.0.2.0/24
nmap -sV --no-stylesheet -oA acme-external 192.0.2.0/24

--webxml points at the copy on nmap.org, so the file renders as HTML on any machine with web access. --no-stylesheet leaves the line out.

Two community tools go further than the stock stylesheet:

• nmap-bootstrap-xsl is a drop-in stylesheet with filtering, export to CSV, Excel and PDF, and a CPE and CVE audit section.
• nmap-formatter (Go, MIT license) converts the XML to HTML, CSV, Markdown, JSON, Excel and a few graph formats. It's the quickest answer to "Nmap to CSV".

xsltproc -o report.html nmap-bootstrap.xsl acme-external.xml
nmap-formatter csv acme-external.xml > acme-external.csv

That's enough for your own records, or for a colleague who needs to read the scan. Your client's template is another job: it needs every host and port as data, in the same project as the findings.

Import Nmap XML into Dradis

1. Scan with XML output. Run Nmap with -oX or -oA, and add -sV.
2. Open the upload page. In your Dradis project, click Upload in the header.
3. Choose the Nmap plugin. Under Tool you are uploading output from, select the Nmap plugin.
4. Upload the XML file. Under Upload tool output file, pick the .xml file from your computer.
5. Check the result. Watch the Output console until it says Worker process completed. Each host is now a Node under the Scanner output node.

What Dradis keeps from an Nmap scan

We ran the dradis-nmap 5.4.0 importer, the code in Dradis CE 5.4.0, on two Nmap XML files: the plugin's own sample scans of scanme.nmap.org, made with Nmap 5.59BETA3 in 2011 and Nmap 6.00 in 2016. We swapped the database writes for a recorder and logged where every element ended up:

In the Nmap XML	In Dradis
Each <host>	One Node, labelled with the IP (IPv6 when the host has one, otherwise IPv4), not the hostname
<address>, <hostnames>, OS matches	Node properties ip, hostname and os, plus the IP and Hostnames fields of one Host note per host
Each <port> and its <service>	An entry in the services Node property (port, protocol, state, reason, name, product, version) and a row in the Host note's Services table
Each <port>, again	One Port note, titled like 22/tcp is open (syn-ack), with Service, Product, Version and Host fields
<script> output inside a port	The services_extras Node property, under a key like tcp/22. The Port note has no field for it
<hostscript> output, the scan command, the Nmap version, OS match accuracy, traceroute, uptime, MAC address, CPE	Not imported. It stays in the XML

The two runs:

• An -A scan of one host with two open ports and two script results became 1 Node and 3 notes: one Host note and two Port notes. Product and version were filled in (OpenSSH 5.3p1, Apache httpd 2.2.14), and the os property read "Linux 2.6.39".
• An -sC scan of one host with 21 ports (18 open, 3 filtered) and 7 script results became 1 Node and 22 notes, with 21 entries in the services property.

Before you write the report

• Every port gets a note. Filtered ports are imported too, with the state "filtered (no-response)". Closed ports show up only when Nmap lists them in the XML.
• Product and version need -sV. Our -sC scan ran without it, so those cells were blank in the Host note's Services table and read "n/a" in every Port note. Re-run with -sV, or -A, which includes it, and import the new file.
• A re-import adds notes, not hosts. Importing the same file again reuses the host's Node, as long as it still sits under Scanner output (move it, and the next import creates a fresh one there). The services entries merge by port and protocol, but the notes are created again (our 3 became 6) and the services_extras rows repeat. If you only want the re-scan's results, delete the old Nmap notes before you import it.
• Keep the XML with the project. Host-level script output, such as smb-os-discovery, and the exact scan command never reach Dradis. If your report quotes the command line, copy it from the args attribute of the <nmaprun> element.

Combine Nmap with your vulnerability scanner

The Nmap import creates no Issues and no Evidence. Import Nessus, OpenVAS or Qualys output into the same project, and the host Node label decides whether both tools' data ends up on one host. Nmap uses the IP.

Plugin (5.4.0)	Host Node label	Same Node as Nmap?
OpenVAS	The host's IP	Yes, when the IP matches
Qualys	The host's IP	Yes, when the IP matches
Nessus	The host name in the .nessus file	Only when that name is the bare IP

All four importers file host Nodes under the same Scanner output parent and reuse a Node with the same label, so a host that Nmap and OpenVAS both scanned at 192.0.2.10 is one Node. On a shared Node, the services table is de-duplicated when two tools find the same port, and any extra data from the second tool goes to the Services Extras section.

Put the Nmap services table in your client report

Nmap fills the Node properties itself, with no Mappings Manager setup. In a Word template, add a ServicesTable content control inside a Node content control, and the services export as a table with Protocol, Port, State, Product, Reason, Name and Version columns.

We recommend the Node properties route. Pull the table from the Host note instead only when you need a custom table style. Nmap notes import in the Default category, and a Word export picks them up only once they're in the AdvancedWordExport ready category. To change the fields in the Host and Port notes, edit the Nmap mapping in the Mappings Manager. The Nmap source fields are in the tools reference.

Or skip the template work. On every paid plan, you send us the report you deliver today, and we build your template from it and keep it up to date, at no extra cost.

When an Nmap import looks wrong

You get a note titled "Invalid file format" and no hosts. The file isn't Nmap XML. The importer creates that note when it finds no hosts, and .nmap or .gnmap files never import. Use the .xml file from -oX or -oA.

A hostname is listed twice. When you scan by name and the reverse DNS name is the same, the hostname property and the Host note list it twice. Scan by IP, or edit the property.

The upload says it worked but no hosts appear. Check the background worker first. In a 2019 forum thread, a second upload reported success but created no Nodes, and the user's worker couldn't connect to Redis.

Nmap report FAQ

What does an Nmap scan show you?

Nmap shows which hosts are up and the state of each port it scanned. By default that's the 1,000 most common ports for each protocol. You also get a service name per port, the product and version when version detection runs, OS matches when OS detection runs, and the output of any NSE scripts you ran.

Do I need Dradis Pro for the Nmap import?

No. The dradis-nmap plugin is open source (GPL-2) and ships with Dradis CE, so the import steps above work in the free edition too.