Core Concepts & Installation

Nmap uses raw IP packets to determine what hosts are available, what services they offer, and what operating systems they run.

Installation (Linux/Ubuntu):

sudo apt update && sudo apt install nmap -y

Installation (Windows/macOS): Download the installer from the official Nmap website or use brew install nmap on macOS.

The Nmap Formula

A standard Nmap command follows a logical formula. You combine a Target, Scan Type, Port Specification, Detection methods, Timing, Scripts, and Evasion techniques.

Target Specification

Define what you are scanning before you begin:

• Single IP/Hostname: nmap 192.168.1.1 or nmap scanme.nmap.org
• IP Range: nmap 192.168.1.1-50
• Subnet (CIDR): nmap 192.168.1.0/24
• From a File: nmap -iL targets.txt
• Exclude Hosts: nmap 192.168.1.0/24 --exclude 192.168.1.5

Host Discovery (Finding Live Hosts)

Before scanning ports, find which hosts are actually online. This is often the first step in any assessment.

• Ping Scan (no port scan): nmap -sn 192.168.1.0/24 (This is the fastest way to map a network).
• Disable Host Discovery (Scan even if down): nmap -Pn 192.168.1.1 (Use this if a firewall blocks ping requests).

Port Scanning Techniques

Nmap’s core function is identifying open ports. Different scan types vary in speed, stealth, and reliability.

• TCP SYN Scan (-sS): The default and most popular scan. It is fast and relatively stealthy because it never completes a full TCP connection (half-open scan).
• TCP Connect Scan (-sT): Uses the full TCP three-way handshake. Use this if you do not have raw packet privileges (e.g., non-root users).
• UDP Scan (-sU): Essential for services like DNS (53), SNMP (161), and DHCP (67). UDP scanning is slower and less reliable than TCP.
• Port Selection: By default, Nmap scans the top 1000 ports. You can customize this:
  • Specific Ports: -p 80,443
  • Range: -p 1-1000
  • All Ports: -p- (Scans all 65,535 ports).

Service & OS Detection

Once ports are open, you need to know what is running on them.

• Version Detection (-sV): Probes open ports to determine the service name and version (e.g., Apache httpd 2.4.41).
• OS Detection (-O): Attempts to identify the target’s operating system by analyzing TCP/IP stack fingerprints.
• Aggressive Scan (-A): A convenience flag that enables OS detection, version detection, script scanning, and traceroute all at once.

The Nmap Scripting Engine (NSE)

The NSE is Nmap’s most powerful feature, allowing automation of tasks like vulnerability detection and enumeration.

• Run Default Scripts: nmap -sC <target> (Same as --script=default).
• Run a Specific Category: nmap --script=vuln <target> (Checks for known vulnerabilities).
• Run Specific Scripts: nmap --script=http-title,smb-os-discovery <target>.
• Script Arguments: nmap --script=ssh-brute --script-args userdb=users.txt <target>.

Timing & Performance

Speed and stealth are a trade-off. Nmap has timing templates -T0 (Paranoid) to -T5 (Insane).

• -T4 (Aggressive): Recommended for fast, reliable scans on local networks.
• -T2 (Polite): Slower, uses less bandwidth, and is less likely to crash fragile devices.
• --max-rate 5: Sends no more than 5 packets per second (great for evading rate-based IDS).

Firewall & IDS Evasion

When you need to be stealthy or bypass filtering, these techniques help.

• Decoy Scan (-D): nmap -D RND:10 <target> (Spoofs 10 random IPs alongside yours to confuse logs).
• Fragment Packets (-f): nmap -f <target> (Splits packets into tiny fragments to evade simple packet filters).
• Source Port Spoofing: nmap --source-port 53 <target> (Makes traffic look like DNS replies to bypass misconfigured firewalls).
• Idle/Zombie Scan (-sI): nmap -sI <zombie_host> <target> (The ultimate anonymous scan; uses a third-party idle host to scan the target without revealing your IP).

Output Formats

Always save your scan results for later analysis.

• Normal (-oN): Human-readable text (nmap -oN scan.txt 192.168.1.1).
• XML (-oX): Machine-readable, perfect for importing into tools like Metasploit (-oX scan.xml).
• All (-oA): Saves in all formats at once (-oA myscan).

Practical Workflow Example

A typical penetration testing workflow might look like this:

• Discovery: sudo nmap -sn 192.168.1.0/24 (Find live hosts).
• Fast Port Scan: sudo nmap -sS -T4 -iL live_hosts.txt (Quickly find open ports).
• Deep Enumeration: sudo nmap -sV -sC -O -p 22,80,443 -iL live_hosts.txt (Get versions and default scripts on found ports).
• Vulnerability Check: sudo nmap --script=vuln -p 80,443 <target>.

Legal & Ethical Warning: Only use Nmap on systems you own or have explicit written permission to test. Unauthorized port scanning is illegal in many jurisdictions and can be considered a precursor to an attack.