🔹 PART 1: What is Nmap?
Nmap is an open-source tool used to:
● Discover live hosts on a network
● Find open ports
● Detect running services & versions
● Identify operating systems
● Detect vulnerabilities (with scripts)
Who uses Nmap?
● Ethical hackers / pentesters
● System & network administrators
● SOC analysts
● Cybersecurity students
🔹 PART 2: How Nmap Works (Concepts)
1️⃣ Hosts
Devices connected to a network (PC, server, router, phone).
2️⃣ Ports
Logical communication endpoints.
● Common ports:
○ 80 → HTTP
○ 443 → HTTPS
○ 22 → SSH
○ 21 → FTP
○ 3389 → RDP
3️⃣ Protocols
● TCP
● UDP
● ICMP
🔹 PART 3: Installing Nmap
Windows
👉
Download from:
[Link]
Install Nmap + Zenmap (GUI)
Linux (Kali/Ubuntu)
sudo apt install nmap
Check installation
nmap --version
🔹 PART 4: Basic Nmap Commands
🔸 1. Scan a Single Target
nmap [Link]
🔸 2. Scan a Website
nmap [Link]
🔸 3. Scan Multiple Targets
nmap [Link] [Link]
🔸 4. Scan a Network Range
nmap [Link]/24
🔹 PART 5: Host Discovery (Ping
Scanning)
🔸 Find live hosts only
nmap -sn [Link]/24
🔸 Skip ping (useful if ICMP blocked)
nmap -Pn [Link]
🔹 PART 6: Port Scanning Types (VERY
IMPORTANT)
1️⃣ TCP SYN Scan (Stealth)
nmap -sS [Link]
✔ Fast
✔ Default scan (needs root)
2️⃣ TCP Connect Scan
nmap -sT [Link]
❌
✔ No root needed
More detectable
3️⃣ UDP Scan
nmap -sU [Link]
❌
✔ Finds DNS, SNMP, NTP
Slow
4️⃣ Scan Specific Ports
nmap -p 22,80,443 [Link]
5️⃣ Scan All Ports (1–65535)
nmap -p- [Link]
🔹 PART 7: Service & Version Detection
Detect running services
nmap -sV [Link]
Aggressive detection
nmap -A [Link]
Includes:
● OS detection
● Version detection
● Default scripts
● Traceroute
🔹 PART 8: Operating System Detection
nmap -O [Link]
🔹 PART 9: Nmap Scripts (NSE – Nmap
Scripting Engine)
Scripts are written in Lua.
Run default scripts
nmap -sC [Link]
Run vulnerability scripts
nmap --script vuln [Link]
Example: Check FTP anonymous login
nmap --script ftp-anon [Link]
🔹 PART 10: Firewall & IDS Evasion
Fragment packets
nmap -f [Link]
Decoy scan
nmap -D RND:10 [Link]
Spoof MAC address
nmap --spoof-mac 0 [Link]
🔹 PART 11: Output & Reporting
Save output to file
nmap -oN [Link] [Link]
XML output
nmap -oX [Link] [Link]
All formats
nmap -oA fullscan [Link]
🔹 PART 12: Interpreting Results
Port States
● open → Service accepting connections
● closed → No service running
● filtered → Firewall blocking
● open|filtered → Cannot determine
🔹 PART 13: Real-World Scanning
Workflow (Pentesting)
1️⃣ Host discovery
2️⃣ Port scanning
3️⃣ Service detection
4️⃣ OS detection
5️⃣ Vulnerability scanning
6️⃣ Exploitation (with permission)
🔹 PART 14: Common Beginner Mistakes
❌
● Scanning without permission
● Running aggressive scans too early
● Ignoring UDP scans
● Not saving scan results
● Misinterpreting filtered ports
🔹 PART 15: Zenmap (GUI Version)
Zenmap provides:
● Visual network topology
● Pre-configured scan profiles
● Easy reports
Good for learning & presentations.
🔹 PART 16: Practice Lab (Safe)
Practice legally using:
● TryHackMe
● Hack The Box
● Local VM (Metasploitable)
🔹 PART 17: Cheat Sheet (Must
Remember)
nmap target
nmap -sn network
nmap -sS target
nmap -sU target
nmap -sV target
nmap -A target
nmap --script vuln target
🔥 Want to go further?
I can:
● Teach Nmap for beginners in Bangla
● Create a PDF cheat sheet
● Give real hacking lab walkthroughs
● Teach how to bypass firewalls properly
● Compare Nmap vs Masscan
Just tell me 👉 what level you want next (Beginner / Intermediate / Advanced)