This educational article teaches network reconnaissance using Nmap, a packet-crafting tool that identifies live hosts, open ports, running services, and potential vulnerabilities. It is Day 8 of a 100-day ethical hacking course, building on foundational knowledge of TCP, ports, subnets, and packet analysis from previous days. The article argues that mastering Nmap—understanding what happens at the packet level in each scan type—is essential for professional penetration testing and security assessments, providing a structured workflow from basic host discovery to vulnerability detection.
- Nmap's four-phase reconnaissance architectureThe article structures Nmap's operation into four sequential phases: Phase 1 uses ICMP pings, ARP requests, and TCP probes to identify live hosts; Phase 2 probes ports to determine if they are open, closed, or filtered; Phase 3 connects to open ports and identifies services and versions (e.g., Apache httpd 2.2.8, vsftpd 2.3.4); Phase 4 executes Nmap Scripting Engine (NSE) scripts for user enumeration, vulnerability checks, and misconfiguration testing. Understanding this layered approach allows practitioners to build scan complexity incrementally.
- Packet-level differences between scan typesDifferent scan types create different detectability and reliability profiles based on TCP packet construction. SYN scans (-sS) send SYN→SYN-ACK→RST without completing a handshake, requiring root but appearing stealthy; TCP Connect scans (-sT) perform full three-way handshakes and work without root but are slower and more logged; UDP scans (-sU) probe connectionless services like DNS (53) and SNMP (161); ACK scans (-sA) map firewall rules rather than finding open ports; and NULL/Xmas scans (-sN, -sX) attempt to evade stateless firewalls. The article emphasizes that understanding these packet-le
- Service version detection transforms reconnaissance into exploitation intelligenceThe -sV flag connects to open ports and identifies exact software versions, converting generic port knowledge into actionable vulnerability data. The article demonstrates this with concrete examples: vsftpd 2.3.4 is identified as backdoored (CVE-2011-2523), Apache httpd 2.2.8 is flagged as a 2008 release with many known CVEs, and MySQL 5.0.51a is noted as exposed to the network. Version detection intensity can be controlled from 0 (light banner grab) to 9 (exhaustive), allowing practitioners to cross-reference detected versions against the NIST National Vulnerability Database for immediate pri
- NSE scripts extend scanning beyond port detectionThe Nmap Scripting Engine contains over 600 Lua scripts that perform active enumeration and vulnerability assessment. The article describes script categories: 'vuln' checks for known CVEs, 'safe' performs non-destructive information gathering, 'auth' tests authentication and default credentials, 'discovery' enumerates users and shares, and 'brute' attempts forced credential entry. Specific examples include ftp-anon detecting anonymous FTP login, ftp-vsftpd-backdoor confirming exploitation, smb-vuln-ms17-010 checking for EternalBlue, and http-enum discovering directories like /phpMyAdmin and /d
- Professional workflow prioritizes output saving and timing controlThe article prescribes using -oA (which creates .nmap, .xml, and .gnmap formats simultaneously) on every assessment to preserve results for later analysis and tool integration. Timing templates (-T0 to -T5) balance speed versus detectability: -T0 to -T1 for IDS evasion, -T3 (normal) for real assessments, and -T4 (aggressive) for controlled lab environments. The article provides a five-step professional scanning sequence: host discovery, quick port scan on common ports, full version and script scan, complete 65535-port scan, and targeted UDP scanning on key ports, enabling practitioners to gath
- Root privilege requirement stems from raw packet craftingThe article explains that scan types requiring sudo (SYN, UDP, OS detection, NULL, Xmas) need root because they construct and send raw network packets via privileged socket access. Without root, Nmap falls back to -sT (TCP Connect), which uses the operating system's standard socket API and is slower and more detectable because each connection is logged. This technical distinction directly affects both the speed of reconnaissance and the likelihood of detection by monitoring systems.
- Output interpretation translates scan results into attack prioritizationThe article demonstrates reading a full -A scan output on Metasploitable 2 and mapping discovered services directly to risk: vsftpd 2.3.4 with CVE-2011-2523 backdoor is marked HIGH priority, anonymous FTP access is HIGH, exposed MySQL database is HIGH, older Apache 2.2.8 with known CVEs is MEDIUM, telnet cleartext protocol is MEDIUM, and VNC with default password risks is LOW. This interpretation process converts raw Nmap output into an ordered attack plan within minutes, separating methodical security testing from random exploration.
- Lab-based learning builds understanding without external riskThe article mandates scanning only Metasploitable 2 (a deliberately vulnerable VM) within a private host-only network (192.168.56.0/24) and explicitly prohibits scanning external targets. The practical task requires confirming the target's IP via arp -a, running the five-step professional workflow, executing NSE scripts to detect the vsftpd backdoor, and enumerating HTTP services, with results saved in multiple formats for Metasploit database import. This controlled environment allows practitioners to learn scan mechanics and interpretation without legal or ethical risk.
Bottom line: Mastering Nmap requires understanding what each scan type does at the packet level—why different techniques produce different results with different detectability profiles—rather than memorizing copy-paste commands. The professional reconnaissance workflow combines host discovery, port scanning, service version detection, and NSE scripting to transform a target machine into an ordered list of prioritized vulnerabilities, which is the actual foundation of every real penetration test and security
Day 100 — Professional Pentester
Nmap (Network Mapper) was created by Gordon “Fyodor” Lyon in 1997 and has been actively developed ever since. It is installed on more professional penetration testers’ machines than any other tool. The OSCP exam, every CTF, every real-world assessment — Nmap is the starting point. Understanding it deeply is not optional.
I’m going to teach you Nmap the way I teach it in professional training: by building from simple host discovery upward to full service enumeration and scripted vulnerability detection. Each layer of complexity builds directly on the previous one. No magic commands you copy-paste without understanding.
arp -a from Kali after booting it. We scan only within our own lab — never external targets.How Nmap Works — What Happens When You Run a Scan
Nmap is fundamentally a packet-crafting and response-reading tool. It constructs specific network packets, sends them to targets, and interprets the responses to draw conclusions about what’s running. Understanding this at the packet level — which you can now do thanks to Days 5 and 7 — means you understand why different scan types produce different results and have different detectability profiles.
Phase 1: Host Discovery — Finding What’s Alive
Before scanning ports, Nmap needs to know which hosts are alive. Scanning thousands of ports on IP addresses that aren’t even up wastes enormous time. Host discovery is the filter that tells Nmap where to focus its effort.
Phase 2: Scan Types — Choosing How to Probe Ports
Different scan types use different techniques to probe ports — each with different speed, reliability, and detectability trade-offs. You need to know what each type actually does at the packet level, because that determines when and why you’d choose it in a real assessment.
| Flag | Scan Type | Root Needed? | How It Works | When to Use |
|---|---|---|---|---|
| -sS | SYN (Stealth) | Yes | SYN → SYN-ACK → RST (never completes handshake) | Default for authorised scans — fast, reliable, less logged |
| -sT | TCP Connect | No | Full three-way handshake — uses OS connect() syscall | When no root access — slower and more detectable |
| -sU | UDP | Yes | Sends UDP probes — no response=open|filtered, ICMP=closed | Find UDP services: DNS (53), SNMP (161), TFTP (69) |
| -sA | ACK | Yes | Sends ACK packets — maps firewall rules, not open ports | Understanding firewall rules — which ports are filtered vs unfiltered |
| -sN | NULL | Yes | Sends packet with no TCP flags set | Evade some stateless firewalls — unreliable on Windows |
| -sX | Xmas | Yes | Sets FIN, PSH, and URG flags — “lights up like a Christmas tree” | Same as NULL — specific evasion scenarios |
Phase 3: Service & Version Detection (-sV) — What’s Actually Running
Knowing port 80 is open tells you something. Knowing it’s running Apache httpd 2.2.8 tells you everything — because now you can look up every known CVE for that exact version. Service and version detection is where reconnaissance becomes actionable intelligence.
-sV scan, I take each detected version and search the NIST National Vulnerability Database (nvd.nist.gov) for known CVEs. A list of open ports becomes a prioritised attack plan within minutes. This is what separates methodical security testing from random clicking.OS Fingerprinting (-O) — Identify the Target’s Operating System
Nmap’s OS detection analyses subtle differences in how different operating systems implement the TCP/IP stack — things like initial TTL values, window sizes, and response timing. This fingerprint is compared against a database of known OS signatures to produce a best guess. It requires root and at least one open and one closed port to work reliably.
Phase 4: NSE Scripts — Nmap’s Hidden Superpower
The Nmap Scripting Engine (NSE) contains over 600 Lua scripts that extend Nmap far beyond port scanning. Scripts can enumerate users, check for specific vulnerabilities, test authentication, and pull detailed information from services. This is where Nmap transitions from reconnaissance to vulnerability assessment.
Timing Templates & Output Formats — The Professional Workflow
Reading & Interpreting Nmap Results — What It All Means
Running a scan is step one. Interpreting the output into actionable intelligence is what actually matters. Let me walk you through a realistic full-scan output from Metasploitable 2 and show you exactly what I look for and why.
📋 Nmap Cheat Sheet — The Commands You’ll Use Every Day
| Command | What It Does |
|---|---|
| nmap -sn <range> | Host discovery — find live hosts, no port scan |
| sudo nmap -sS <target> | SYN scan — fast stealth scan, top 1000 ports |
| sudo nmap -sV <target> | Service version detection |
| sudo nmap -sC <target> | Default NSE scripts |
| sudo nmap -O <target> | OS fingerprinting |
| sudo nmap -A <target> | All of the above: -sV -sC -O + traceroute |
| nmap -p- <target> | All 65535 ports (slow but thorough) |
| nmap -sU <target> | UDP port scan |
| nmap –script vuln <target> | Run all vulnerability detection scripts |
| nmap –script http-enum <target> | Web directory enumeration |
| nmap -T4 <target> | Aggressive timing (good for labs) |
| nmap -oA scan <target> | Save all output formats simultaneously |
| nmap -Pn <target> | Skip host discovery (treat as alive) |
| nmap -v –reason <target> | Show why each port is classified as open/closed |
🎯 Day 8 Practical Task — Your First Real Target
arp -a
sudo nmap -sS -sV -sC -T4 -oA ~/Day8/metasploitable 192.168.56.101
Your -oA scan created three files. Open the .xml file in your browser — it renders as a structured document. Then try importing it into Metasploit’s database with db_import ~/Day8/metasploitable.xml inside msfconsole. You’ll see all discovered hosts and services inside Metasploit — ready for exploitation. Post your open port count with #Day8Done 🎯
You know what’s running. You know what’s vulnerable.
Eight days in — and you have a full enumeration of a target machine. That is real reconnaissance. Day 9 takes this further into the internet: Google Dorking and OSINT — how to find information about targets using only publicly available sources before touching a single network packet.
Frequently Asked Questions — Day 8 Nmap Tutorial for Beginners
Nmap was the first tool that made me feel like a real security professional. Not because it’s complicated — it isn’t — but because what it reveals is real. You pointed it at a machine and you know what’s there. That knowledge is the foundation of every engagement I’ve ever run. Use it responsibly. Use it well.
1 Comment