By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

Active Reconnaissance: Network Scanning with Nmap

Nmap (Network Mapper) is the most powerful and widely-used network scanning tool. It discovers hosts, identifies open ports, detects services and versions, determines operating systems, and even runs vulnerability scripts. Nmap is essential for penetration testing, security auditing, and network inventory. If you master only one tool, make it nmap.

What You'll Learn

  • What nmap is and how it works
  • Host discovery techniques
  • Port scanning methods (SYN, connect, UDP, etc.)
  • Service and version detection
  • OS fingerprinting
  • NSE scripts for vulnerability scanning
  • Output formats and reporting
  • Stealth and evasion techniques
  • Defensive measures

What Is Nmap?

Overview:

Nmap = Network Mapper

Created by: Gordon "Fyodor" Lyon (1997)
Purpose:
- Discover live hosts
- Scan ports (open/closed/filtered)
- Detect services and versions
- Identify operating systems
- Run vulnerability scripts

Used for:
✓ Penetration testing
✓ Security auditing
✓ Network inventory
✓ Service monitoring

How It Works:

Nmap sends packets → Analyzes responses → Determines state

Example:
SYN packet to port 80 →
← SYN/ACK response =
Port 80 is open!

Installation

Linux:

# Debian/Ubuntu
sudo apt update
sudo apt install nmap

# RHEL/CentOS/Fedora
sudo dnf install nmap

# Arch
sudo pacman -S nmap

macOS:

# Homebrew
brew install nmap

# Or download from nmap.org

Windows:

1. Download from https://nmap.org/download.html
2. Run installer
3. Add to PATH

PowerShell:
nmap --version

Verify Installation:

nmap --version

Basic Nmap Usage

Scan a Single Host:

nmap 192.168.1.1

Default behavior:

  • Scans top 1000 most common ports
  • TCP SYN scan (if root/admin)
  • TCP connect scan (if non-root)

Scan Multiple Hosts:

# Specific IPs
nmap 192.168.1.1 192.168.1.5 192.168.1.10

# Range
nmap 192.168.1.1-50

# CIDR notation
nmap 192.168.1.0/24

# From file
nmap -iL targets.txt

Scan Specific Ports:

# Single port
nmap -p 80 192.168.1.1

# Multiple ports
nmap -p 22,80,443 192.168.1.1

# Port range
nmap -p 1-1000 192.168.1.1

# All ports
nmap -p- 192.168.1.1

# Top ports
nmap --top-ports 100 192.168.1.1

Host Discovery

Ping Scan (No Port Scan):

nmap -sn 192.168.1.0/24
  • Only checks if hosts are up
  • No port scanning
  • Fast network sweep

Skip Ping (Assume All Hosts Up):

nmap -Pn 192.168.1.1
  • Useful when ICMP is blocked
  • Treats all hosts as online
  • Scans even if no ping response

Host Discovery Methods:

# ICMP echo (ping)
nmap -PE 192.168.1.0/24

# TCP SYN to port 80
nmap -PS80 192.168.1.0/24

# TCP ACK to port 80
nmap -PA80 192.168.1.0/24

# UDP ping
nmap -PU 192.168.1.0/24

Port Scanning Techniques

1. TCP SYN Scan (Stealth Scan):

sudo nmap -sS 192.168.1.1

How it works:

1. Send SYN
2. Receive SYN/ACK (open) or RST (closed)
3. Send RST (don't complete handshake)

Advantages:
✓ Fast
✓ Stealthy (doesn't complete connection)
✓ Default scan type (if root)

Disadvantages:
✗ Requires root/admin
✗ Can still be logged

2. TCP Connect Scan:

nmap -sT 192.168.1.1

How it works:

1. Complete full 3-way handshake
2. If successful, port is open
3. Close connection

Advantages:
✓ Works without root
✓ Reliable

Disadvantages:
✗ Logged by target
✗ Slower
✗ Less stealthy

3. UDP Scan:

sudo nmap -sU 192.168.1.1

How it works:

Send UDP packet →
← ICMP port unreachable = closed
No response = open or filtered

Advantages:
✓ Finds UDP services (DNS, SNMP, DHCP)

Disadvantages:
✗ Very slow
✗ Less reliable

4. Other Scan Types:

# TCP ACK scan (check firewall rules)
sudo nmap -sA 192.168.1.1

# TCP FIN scan (stealthy)
sudo nmap -sF 192.168.1.1

# TCP NULL scan (stealthy)
sudo nmap -sN 192.168.1.1

# TCP Xmas scan (stealthy)
sudo nmap -sX 192.168.1.1

Service and Version Detection

Detect Service Versions:

nmap -sV 192.168.1.1

What it reveals:

PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.3
80/tcp  open  http     Apache httpd 2.4.41 ((Ubuntu))
443/tcp open  ssl/http nginx 1.18.0
3306/tcp open  mysql   MySQL 5.7.35

Version Intensity:

# Light (fast, less accurate)
nmap -sV --version-intensity 0 192.168.1.1

# Default
nmap -sV 192.168.1.1

# Aggressive (slow, more accurate)
nmap -sV --version-intensity 9 192.168.1.1

# All probes (slowest, most accurate)
nmap -sV --version-all 192.168.1.1

Operating System Detection

OS Fingerprinting:

sudo nmap -O 192.168.1.1

Example output:

Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6

Aggressive Detection:

sudo nmap -A 192.168.1.1

Enables:

  • OS detection (-O)
  • Version detection (-sV)
  • Script scanning (-sC)
  • Traceroute (--traceroute)

Nmap Scripting Engine (NSE)

What Are NSE Scripts?

NSE = Nmap Scripting Engine

Lua scripts that:
- Detect vulnerabilities
- Brute force credentials
- Check for exploits
- Enumerate services
- Extract information

Categories:
- auth: Authentication
- broadcast: Broadcast discovery
- brute: Brute force
- default: Default scripts
- discovery: Service discovery
- dos: Denial of Service
- exploit: Exploit vulnerabilities
- external: External resources
- fuzzer: Fuzzing
- intrusive: Invasive scripts
- malware: Malware detection
- safe: Safe scripts
- version: Version detection
- vuln: Vulnerability checking

Running Scripts:

Default Scripts:

nmap -sC 192.168.1.1

# Equivalent to:
nmap --script=default 192.168.1.1

Specific Script:

nmap --script=http-title 192.168.1.1

Multiple Scripts:

nmap --script=http-title,http-headers 192.168.1.1

Script Category:

# All vulnerability scripts
nmap --script=vuln 192.168.1.1

# All brute force scripts
nmap --script=brute 192.168.1.1

Script with Arguments:

nmap --script=http-wordpress-brute --script-args userdb=users.txt,passdb=passwords.txt 192.168.1.1

Useful NSE Scripts:

Vulnerability Scanning:

# Check for common vulnerabilities
nmap --script=vuln 192.168.1.1

# EternalBlue (MS17-010)
nmap --script=smb-vuln-ms17-010 192.168.1.1

# Heartbleed
nmap --script=ssl-heartbleed 192.168.1.1

# Shellshock
nmap --script=http-shellshock 192.168.1.1

Brute Force:

# SSH brute force
nmap --script=ssh-brute 192.168.1.1

# FTP brute force
nmap --script=ftp-brute 192.168.1.1

# MySQL brute force
nmap --script=mysql-brute 192.168.1.1

Enumeration:

# SMB shares
nmap --script=smb-enum-shares 192.168.1.1

# SMB users
nmap --script=smb-enum-users 192.168.1.1

# DNS zone transfer
nmap --script=dns-zone-transfer --script-args dns-zone-transfer.domain=example.com 192.168.1.1

# HTTP methods
nmap --script=http-methods 192.168.1.1

Script Help:

# Get help for a script
nmap --script-help http-title

# List all scripts
nmap --script-help all

# Search for scripts
nmap --script-help "*brute*"

Timing and Performance

Timing Templates:

# Paranoid (slowest, stealthiest)
nmap -T0 192.168.1.1

# Sneaky
nmap -T1 192.168.1.1

# Polite (slower than normal)
nmap -T2 192.168.1.1

# Normal (default)
nmap -T3 192.168.1.1

# Aggressive (fast)
nmap -T4 192.168.1.1

# Insane (fastest, less accurate)
nmap -T5 192.168.1.1

Recommendation: Use -T4 for most pentesting scenarios.

Parallelization:

# Limit parallelism
nmap --min-parallelism 10 --max-parallelism 50 192.168.1.0/24

# Adjust rate
nmap --min-rate 100 --max-rate 1000 192.168.1.0/24

Output Formats

Normal Output:

nmap 192.168.1.1

Default console output.

Save to File:

# Normal format
nmap -oN output.txt 192.168.1.1

# XML format
nmap -oX output.xml 192.168.1.1

# Grepable format
nmap -oG output.gnmap 192.168.1.1

# All formats
nmap -oA scan_results 192.168.1.1
# Creates:
# - scan_results.nmap
# - scan_results.xml
# - scan_results.gnmap

XML to HTML:

# Scan with XML output
nmap -oX scan.xml 192.168.1.1

# Convert to HTML
xsltproc scan.xml -o scan.html

Stealth and Evasion

Fragmentation:

# Fragment packets
sudo nmap -f 192.168.1.1

# Custom fragment size
sudo nmap --mtu 16 192.168.1.1

Decoy Scanning:

# Use decoys
sudo nmap -D RND:10 192.168.1.1

# Specific decoys
sudo nmap -D decoy1,decoy2,ME 192.168.1.1

Spoof Source:

# Spoof source IP
sudo nmap -S 192.168.1.100 192.168.1.1

# Spoof source port
sudo nmap --source-port 53 192.168.1.1

Randomize Scan Order:

nmap --randomize-hosts 192.168.1.0/24

Idle Scan (Zombie Scan):

# Use zombie host
sudo nmap -sI zombie_ip target_ip

Ultra-stealthy: Packets appear to come from zombie.

Common Nmap Commands

Quick Scan:

nmap -T4 -F 192.168.1.1
  • Fast timing
  • Top 100 ports only

Comprehensive Scan:

sudo nmap -sS -sV -O -A -T4 -p- 192.168.1.1
  • SYN scan
  • Version detection
  • OS detection
  • Aggressive (scripts + traceroute)
  • All ports

Network Sweep:

nmap -sn 192.168.1.0/24
  • Discover live hosts only

Vulnerability Scan:

nmap -sV --script=vuln 192.168.1.1
  • Version detection
  • Vulnerability scripts

Web Server Scan:

nmap -p 80,443 --script=http-* 192.168.1.1
  • Ports 80 and 443
  • All HTTP scripts

Real-World Examples

Example 1: Initial Network Discovery

# Phase 1: Find live hosts
nmap -sn 192.168.1.0/24 -oA hosts

# Phase 2: Quick port scan on live hosts
nmap -T4 -F -iL hosts.gnmap -oA quick_scan

# Phase 3: Deep scan on interesting hosts
nmap -sS -sV -O -A -p- 192.168.1.10 -oA deep_scan

Example 2: Web Application Assessment

# Scan web server
nmap -p 80,443,8080,8443 --script=http-* 192.168.1.50

# Check for vulnerabilities
nmap -p 80,443 --script=http-vuln-* 192.168.1.50

# Enumerate directories
nmap -p 80 --script=http-enum 192.168.1.50

Example 3: Windows Domain Scan

# Scan Windows host
nmap -p 445,139,135,3389 --script=smb-* 192.168.1.100

# Check for EternalBlue
nmap -p 445 --script=smb-vuln-ms17-010 192.168.1.100

# Enumerate users and shares
nmap -p 445 --script=smb-enum-users,smb-enum-shares 192.168.1.100

Defensive Measures

Detecting Nmap Scans:

Intrusion Detection Systems (IDS):

Snort rules:
- Detect SYN scans (many SYNs, few completes)
- Detect NULL/FIN/Xmas scans (unusual flags)
- Detect port scan patterns

Suricata:
- Threshold detection (many ports in short time)
- Signature matching

Firewall Logs:

# Linux (iptables logging)
iptables -A INPUT -j LOG --log-prefix "PORT SCAN: "

# Review logs
tail -f /var/log/syslog | grep "PORT SCAN"

Port Scan Detection Tools:

PortSentry:
- Detects and blocks port scans
- Automatic firewall rules

OSSEC:
- Log analysis
- Detects scan patterns

Fail2Ban:
- Ban IPs after suspicious activity

Protecting Against Scans:

1. Firewall Rules:

# Drop SYN scans
iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -j DROP

# Rate limit
iptables -A INPUT -p tcp -m limit --limit 5/minute -j ACCEPT

2. Disable Unnecessary Services:

# Linux
sudo systemctl stop <service>
sudo systemctl disable <service>

# Only run essential services

3. Use Non-Standard Ports:

SSH on port 2222 instead of 22
Less likely to be scanned
(Security through obscurity - not a primary defense!)

4. Monitor Logs:

Watch for:
- Connection attempts to closed ports
- Many connections from single IP
- Unusual scan patterns

Try It Yourself

Exercise 1: Basic Scans

# Scan your localhost
nmap localhost

# Scan specific ports
nmap -p 22,80,443 localhost

# Version detection
nmap -sV localhost

Exercise 2: Vulnerability Scanning

# Scan for vulnerabilities (use test lab!)
nmap --script=vuln scanme.nmap.org

Exercise 3: NSE Scripts

# HTTP title
nmap -p 80 --script=http-title scanme.nmap.org

# HTTP methods
nmap -p 80 --script=http-methods scanme.nmap.org

# SSL certificate info
nmap -p 443 --script=ssl-cert scanme.nmap.org

Exercise 4: Network Discovery

# Discover hosts on your network (authorized only!)
nmap -sn 192.168.1.0/24

Quick Reference

Basic Scans:
nmap <target>                    # Default scan
nmap -p 80,443 <target>          # Specific ports
nmap -p- <target>                # All ports
nmap -F <target>                 # Fast (top 100 ports)

Scan Types:
nmap -sS <target>                # SYN scan (stealth)
nmap -sT <target>                # Connect scan
nmap -sU <target>                # UDP scan
nmap -sn <target>                # Ping scan (no ports)

Detection:
nmap -sV <target>                # Version detection
nmap -O <target>                 # OS detection
nmap -A <target>                 # Aggressive (all)

Scripts:
nmap -sC <target>                # Default scripts
nmap --script=vuln <target>      # Vulnerability scripts
nmap --script=<name> <target>    # Specific script

Timing:
nmap -T0 <target>                # Paranoid (slowest)
nmap -T4 <target>                # Aggressive (fast)

Output:
nmap -oN file.txt <target>       # Normal output
nmap -oX file.xml <target>       # XML output
nmap -oA scan <target>           # All formats

Common Combos:
nmap -sS -sV -O -T4 -p- <target> # Comprehensive
nmap -sn <network>               # Host discovery
nmap -sV --script=vuln <target>  # Vuln scan

Resources

Official:

Documentation:

  • Man Page: man nmap
  • Script Help: nmap --script-help <script>

Practice:

  • scanme.nmap.org: Official scan target
  • HackTheBox: CTF platform with labs
  • TryHackMe: Guided pentesting labs

Reading:

Next Steps

  1. Master basic scans (host discovery, port scanning)
  2. Learn NSE scripts for specific tasks
  3. Practice in labs (scanme.nmap.org, personal VMs)
  4. Automate with scripts (bash, Python)
  5. Integrate with other tools (Metasploit, vulnerability scanners)

Nmap is the cornerstone of network reconnaissance. Master it, and you've mastered network scanning!

Up next

Active Recon - Nikto

Web server vulnerability scanning.