Nmap Tutorial

Nmap is the standard tool for network discovery and security auditing. At its core you point it at a target and it tells you which hosts are up, which ports are open, what services run on them and often which versions. The command you will use most is a service and version scan on the ports that turned out to be open, not a blind scan of all 65535.

What Nmap actually does

Nmap sends crafted packets to a target and interprets the responses to build a picture: live hosts, open ports, running services, versions, and sometimes the operating system. Every reconnaissance phase of every engagement starts here.

Installing Nmap

On Kali and Parrot it is preinstalled. On Debian or Ubuntu use the package manager. On Windows use the official installer, which includes the Zenmap GUI. Verify with:

nmap --version

Host discovery: what is alive

Before scanning ports, find live hosts. A ping sweep across a range:

nmap -sn 192.168.1.0/24

The -sn flag does host discovery only, no port scan. Use it to map a network fast before you commit to deeper scans.

Port scanning: the core

A practical first scan finds open ports fast, then a second scan investigates only those:

nmap -sS -p- --min-rate 1000 10.10.10.5
nmap -sV -sC -p 22,80,443 10.10.10.5

Service and version detection

The -sV flag is where recon gets useful. It fingerprints what is actually running:

nmap -sV 10.10.10.5

Knowing a service version is the bridge from scanning to exploitation. An outdated version is a lead.

NSE: the Nmap Scripting Engine

NSE runs scripts for deeper checks, from safe enumeration to vulnerability detection. The -sC flag runs the default safe set. Targeted example:

nmap --script vuln 10.10.10.5
nmap --script smb-enum-shares -p 445 10.10.10.5

Timing and evasion

Timing templates from -T0 (paranoid) to -T5 (insane) trade speed for stealth. -T4 is the sensible default for labs. Evasion flags like fragmentation and decoys exist, but if a firewall is the only thing stopping you, the finding still stands.

Saving output

Always save. -oA writes all formats at once, which matters when you feed results into other tools:

nmap -sV -oA scan_results 10.10.10.5

The workflow professionals use

1. Host discovery across the range
2. Fast all-ports scan to find what is open
3. Targeted version and script scan on open ports only
4. NSE scripts for specific services
5. Save everything, feed it forward

Common mistakes

• Scanning all 65535 ports with scripts on, then waiting forty minutes for output you do not read
• Forgetting UDP entirely, where DNS, SNMP and others live
• Not saving output and having to rescan
• Trusting version detection blindly instead of confirming

Practise this

Reading Nmap teaches the flags. Using it teaches the tool. Scan deliberately vulnerable machines on free labs and read every line of output. Next step after enumeration is exploitation, covered in the Metasploit tutorial.