Nmap (Network Mapper) is a powerful open-source tool widely used for network discovery and
security auditing. It is designed to scan large networks, but it also works well against single
hosts. Nmap uses raw IP packets to determine the hosts available on the network, the services
(application name and version) those hosts are offering, the operating systems (and OS
versions) they are running, the type of packet filters/firewalls in use, and many other
characteristics.
Key Features of Nmap
1. Host Discovery: Identifying live hosts on a network.
2. Port Scanning: Discovering open ports on target hosts.
3. Service Detection: Identifying applications running on open ports.
4. Version Detection: Determining the version of the services running.
5. OS Detection: Inferring the operating system of a host.
6. Scriptable Interaction: Using the Nmap Scripting Engine (NSE) to write custom scripts for
advanced network interactions and vulnerability detection.
Common Nmap Commands
1. Basic Ping Scan: Discovering live hosts on a network.
nmap -sn [Link]/24
2. Port Scan: Scanning for open ports on a specific host.
nmap -p 1-65535 [Link]
3. Service and Version Detection: Identifying services and versions running on open ports.
nmap -sV [Link]
4. OS Detection: Determining the operating system of a host.
nmap -O [Link]
5. Aggressive Scan: Combining various scans to gather detailed information.
nmap -A [Link]
6. Scanning Multiple Hosts: Scanning a list of IPs or a range of IPs.
nmap [Link],[Link]
nmap [Link]-254
7. Using a Target List: Scanning a list of targets from a file.
nmap -iL target_list.txt
8. Running a Script Scan: Using the Nmap Scripting Engine for advanced scanning.
nmap -sC [Link]
Nmap Scripting Engine (NSE)
The Nmap Scripting Engine allows users to write scripts to automate a wide variety of
networking tasks. Scripts are written in Lua and can be used for:
Vulnerability detection
Advanced version detection
Network discovery
Vulnerability exploitation
Example of using NSE scripts:
nmap --script=vuln [Link]
Examples of Nmap Output
1. Host Discovery Output:
nmap -sn [Link]/24
Starting Nmap 7.80 ( [Link] ) at 2024-06-20 17:42 UTC
Nmap scan report for [Link]
Host is up (0.00013s latency).
Nmap scan report for [Link]
Host is up (0.00021s latency).
2. Port Scan Output:
nmap -p 22,80 [Link]
Starting Nmap 7.80 ( [Link] ) at 2024-06-20 17:43 UTC
Nmap scan report for [Link]
Host is up (0.00013s latency).
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Best Practices for Using Nmap
Permission: Always ensure you have permission to scan the network or hosts.
Use Stealth Options: To avoid detection and prevent triggering alarms, use stealth
scanning options such as -sS (TCP SYN scan).
Combine Options: Use a combination of options to get the most comprehensive
information.
Regular Updates: Keep Nmap updated to benefit from the latest features and vulnerability
checks.
Conclusion
Nmap is an essential tool for network administrators and security professionals. Its versatility,
combined with its powerful scanning and scripting capabilities, makes it an indispensable asset
for network discovery, security auditing, and vulnerability assessment. Whether you're
performing basic host discovery or complex vulnerability assessments, Nmap provides the tools
needed to accomplish these tasks effectively.
Need a GUI?
Zenmap
Must know parameters
-sn
Basic ping sweep
-n
Name resolution
-sV
For versioning
-Pn
For host discovery
-T5
Makes nmap scan faster!
Future reference
Ping sweep w/ name resolution
sudo nmap -sn -n <ip address>
Tech + Version check
sudo nmap -sV -T5 -n -Pn <ip address>
Useful commands
nmap --script=[Link]
For enumerating DNS servers and IPs
Helps you find what's in scope
And helps with finding good hosts
-A
Enable OS detection, version detection, script scanning, and traceroute
Do this after an initial scan and you know what ports are open and scan for
those ports
-sV
A necessity
-sT
Transmission Control Protocol (TCP) connect scan
Makes a full connection
SYN -> SYN/ACK -> ACK
A robust scan
Fully make a TCP connection to check and verify if a port is open
Disruptive but assurance of open ports
-Pn
Used quite often
Assume my target is up and do not perform a ping
Scan a host and do a name resolution
Treat all hosts as online -- skip host discovery
-O
Searches for operating systems
-sU
Runs a UDP scan
It takes awhile to run this
Takes 20min ~ 1 hour
Run if only desperate
-sS
Stealth scan
TCP/SYN scan
We do not fully complete the conversation
Default scan by nmap
-T1-5
Timing options
Higher is faster
Level 0 = Paranoid
Level 1 = Sneaky
Level 2 = Polite
Level 3 = Normal
Level 4 = Aggressive
Level 5 = Insane
--script
Nmap Scripting Engine (NSE) scripts
Runs script scans
-p
Look for specific ports
-p- will scan for all ports
You can also do -p 0-65535
-p- is better than writing ^^
[Link]
[Link]
[Link]