Nmap � Network Scanning Reference

// What is Nmap?

Nmap (Network Mapper) is an open-source network scanning tool used to discover hosts, enumerate open ports, identify running services and their versions, detect operating systems, and run scripted checks against network services. It's available on Windows, Linux, and macOS.

For blue team analysts, Nmap is used in asset discovery, vulnerability assessments, and verifying network segmentation controls. For penetration testers, it's the standard reconnaissance tool for mapping attack surface before exploitation.

// Basic Syntax

nmap [scan type] [options] [target]

# Target formats
nmap 192.168.1.1               # Single IP
nmap 192.168.1.1-20            # IP range
nmap 192.168.1.0/24            # CIDR subnet
nmap 192.168.1.1 10.0.0.1      # Multiple IPs (space separated)
nmap -iL targets.txt           # Read targets from file
nmap scanme.nmap.org            # Hostname

Scan speed (-T timing)

// Host Discovery

Before port scanning, Nmap checks whether hosts are up. By default it sends ICMP echo requests, TCP SYN to 443, TCP ACK to 80, and ICMP timestamp requests.

// Port Scanning

Scan types

Port selection

Port states

// Service & Version Detection

Service detection probes open ports to identify the application and version running behind them � much more useful than just knowing a port is open.

PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
80/tcp  open  http     Apache httpd 2.4.52 ((Ubuntu))
443/tcp open  ssl/http Apache httpd 2.4.52 ((Ubuntu))
3306/tcp open mysql   MySQL 8.0.32

// OS Detection

OS detection works by analysing TCP/IP stack characteristics � TTL values, window sizes, IP flags, and responses to crafted probes. It requires at least one open and one closed port to work reliably, and must be run as root/Administrator.

// NSE Scripts

The Nmap Scripting Engine (NSE) extends Nmap with Lua scripts for vulnerability detection, service enumeration, brute forcing, and more. Scripts live in /usr/share/nmap/scripts/.

# Default scripts + version detection (standard recon)
nmap -sV -sC -T4 192.168.1.0/24

# Check for EternalBlue (MS17-010) / WannaCry vulnerability
nmap -p 445 --script smb-vuln-ms17-010 192.168.1.0/24

# HTTP service enumeration
nmap -p 80,443,8080,8443 --script http-title,http-headers,http-methods 192.168.1.0/24

# SSL certificate inspection
nmap -p 443 --script ssl-cert,ssl-enum-ciphers 192.168.1.1

# SMB enumeration
nmap -p 445 --script smb-enum-shares,smb-enum-users,smb-security-mode 192.168.1.0/24

// Output Formats

Always save scan output � you'll want to refer back to it during an investigation or report.

# Extract all hosts with port 22 open
grep "22/open" scan.gnmap | awk '{print $2}'

# List all open ports across all hosts
grep "Ports:" scan.gnmap | grep -oP '\d+/open' | sort -t/ -k1 -n | uniq -c | sort -rn

// Common Ports Reference

// Tips & Best Practices