Complete Nmap Guide: Network reconnaissance from scratch

427 words

2 minutes

Complete Nmap Guide: Network reconnaissance from scratch

2025-01-15

Tools & Tutorials

Nmap

/

Reconnaissance

/

Pentesting

/

Tools

What is Nmap?#

Nmap (Network Mapper) is the most widely used reconnaissance tool in the pentesting world. It lets you discover active hosts, open ports, running services and even the operating system of your targets.

⚠️ Disclaimer: Use Nmap only on networks and systems for which you have explicit authorization. Unauthorized scanning is illegal.

Installation#

1
# Debian/Ubuntu/Kali
2
sudo apt install nmap -y
3

4
# Check version
5
nmap --version

Essential scan types#

1. Basic port scan#

1
# Scan the 1000 most common ports
2
nmap 192.168.1.1
3

4
# Scan a specific host with DNS resolution
5
nmap scanme.nmap.org

2. SYN scan (Half-Open) — The most used#

1
# Requires root privileges
2
sudo nmap -sS 192.168.1.1
3

4
# With version detection
5
sudo nmap -sS -sV 192.168.1.1

The SYN scan sends a SYN packet and waits for SYN-ACK without completing the TCP handshake. It’s faster and less detectable than a full scan.

3. Scan all ports#

1
# Scan all 65535 ports
2
sudo nmap -p- 192.168.1.1
3

4
# With aggressive speed
5
sudo nmap -p- --min-rate 5000 192.168.1.1

4. OS and version detection#

1
# Operating system detection
2
sudo nmap -O 192.168.1.1
3

4
# Aggressive scan (OS + version + scripts + traceroute)
5
sudo nmap -A 192.168.1.1

NSE Scripts (Nmap Scripting Engine)#

NSE scripts are one of Nmap’s most powerful features.

1
# Scan with default scripts
2
nmap -sC 192.168.1.1
3

4
# List all available scripts
5
ls /usr/share/nmap/scripts/
6

7
# Use a specific script
8
nmap --script=http-title 192.168.1.1
9

10
# Vulnerability scripts
11
nmap --script=vuln 192.168.1.1
12

13
# SMB script (very useful on Windows networks)
14
nmap --script=smb-vuln-ms17-010 192.168.1.1

My reconnaissance workflow#

This is the flow I use in pentests and CTFs:

1
# 1. Quick discovery of active hosts
2
sudo nmap -sn 192.168.1.0/24
3

4
# 2. Quick port scan (top 1000)
5
sudo nmap -sS -T4 --open 192.168.1.1
6

7
# 3. Full port scan
8
sudo nmap -p- --min-rate 5000 -T4 192.168.1.1 -oN ports.txt
9

10
# 4. Deep scan of discovered ports
11
PORTS=$(cat ports.txt | grep "^[0-9]" | cut -d'/' -f1 | tr '\n' ',')
12
sudo nmap -sC -sV -p$PORTS 192.168.1.1 -oN services.txt

Firewall / IDS Evasion#

1
# Packet fragmentation
2
sudo nmap -f 192.168.1.1
3

4
# Using decoys
5
sudo nmap -D RND:10 192.168.1.1
6

7
# Slow scan to evade IDS
8
sudo nmap -T1 192.168.1.1
9

10
# MAC address spoofing
11
sudo nmap --spoof-mac 0 192.168.1.1
12

13
# Scan from a specific source IP
14
sudo nmap -S 192.168.1.100 -e eth0 192.168.1.1

Saving results#

1
# Normal format
2
nmap -oN result.txt 192.168.1.1
3

4
# XML format (to import into other tools)
5
nmap -oX result.xml 192.168.1.1
6

7
# Grepable format
8
nmap -oG result.gnmap 192.168.1.1
9

10
# All formats at once
11
nmap -oA result 192.168.1.1

Quick reference#

Flag	Description
`-sS`	SYN scan (stealth)
`-sU`	UDP scan
`-p-`	All ports
`-sV`	Version detection
`-sC`	Default scripts
`-O`	OS detection
`-A`	Aggressive mode
`-T4`	Fast speed
`--open`	Only open ports
`-oN`	Text output