Nmap Study Guide for Bug Bounty Hunters
1. Introduction to Nmap
Nmap (Network Mapper) is an open-source tool for network discovery and security auditing. It's widely used
in bug bounty hunting to map attack surfaces, find open ports, detect services, and scan for vulnerabilities.
2. Basic Usage
Scan a host: nmap <target>
Scan multiple IPs or ranges: nmap [Link] [Link] or nmap [Link]/24
3. Port Scanning Techniques
- TCP Connect: nmap -sT <target>
- SYN Scan (Stealth): nmap -sS <target>
- UDP Scan: nmap -sU <target>
- Full Port Scan: nmap -p- <target>
4. Service and Version Detection
Use -sV to detect service versions:
nmap -sV <target>
5. OS Detection and Aggressive Scanning
- OS Detection: nmap -O <target>
- Aggressive Scan: nmap -A <target>
Nmap Study Guide for Bug Bounty Hunters
6. Nmap Scripting Engine (NSE)
- Default scripts: nmap -sC <target>
- Specific script: nmap --script=http-title <target>
- Script directory: /usr/share/nmap/scripts/
7. Cipher Support Detection
To check SSL/TLS ciphers supported by a service:
nmap --script ssl-enum-ciphers -p 443 <target>
Bug bounty benefit: Identify weak or deprecated ciphers (e.g., RC4, SSLv3), which can be reported as
security issues in some programs.
8. Output Options
- Normal: nmap -oN [Link] <target>
- XML: nmap -oX [Link] <target>
- Grepable: nmap -oG [Link] <target>
9. Firewall Evasion
- Fragment packets: nmap -f <target>
- Decoy: nmap -D RND:10 <target>
- MAC Spoofing: nmap --spoof-mac Apple <target>
10. Labs and CTFs to Practice Nmap
Nmap Study Guide for Bug Bounty Hunters
- TryHackMe: Network Services, Nmap room
- Hack The Box: Machines like 'Legacy', 'Blue', 'Bashed'
- VulnHub: Mr. Robot, Kioptrix series
- PortSwigger Academy: Recon modules
11. Daily Study Plan (1 Hour/Day for 1 Week)
Day 1: Intro, installation, basic scanning
Day 2: TCP/UDP scanning
Day 3: Version and OS detection
Day 4: NSE scripts and cipher scanning
Day 5: Output formats, grepable results
Day 6: Firewall evasion, MAC spoofing
Day 7: Practice labs and review
12. Bug Bounty Tips
- Use Nmap to enumerate open ports & identify hidden services
- Use NSE scripts to detect CVEs and insecure protocols
- Scan web apps for weak SSL ciphers and HTTP misconfigs
- Use Nmap before deeper scanning (e.g., Dirbuster, Nikto)