Nmap - Network Scanner

The reference tool for network scanning and security auditing used by professionals

65535

Scannable ports

600+

NSE scripts

Open Source

Free and open

What is Nmap?

Nmap (Network Mapper) is an open source network scanner created by Gordon Lyon (Fyodor). It is the reference tool for network discovery and security auditing, used by millions of professionals worldwide.

📦 Installation

• Linux: apt/yum install nmap
• Windows: nmap.org/download
• macOS: brew install nmap

🎯 Main uses

• Port scanning
• OS detection
• Service enumeration

⚡ Characteristics

• Free and open source
• Cross-platform
• Extensible NSE scripts

Scan types

TCP SYN scan

The most popular and fastest stealth scan

nmap -sS <target>

Default scan; requires root privileges

• Fast and stealthy
• Detects open ports
• Never completes the connection

TCP Connect scan

Completes a full TCP connection

nmap -sT <target>

Does not require root privileges

• Slower than SYN
• Leaves traces in logs
• Reliable for detection

UDP scan

Scans UDP ports

nmap -sU <target>

Scans UDP services (DNS, SNMP, DHCP)

• Very slow
• Often blocked by firewalls
• Important for critical services

Version detection

Identifies service versions

nmap -sV <target>

Detects software versions

• More intrusive
• More information
• May trigger IDS alerts

Common commands

Basic scans

nmap <target>

Simple scan of the 1,000 most common ports

nmap -p- <target>

Scan all 65,535 ports

nmap -p 80,443 <target>

Scan specific ports

nmap -F <target>

Fast scan (100 most common ports)

Detection and enumeration

nmap -sV <target>

Service version detection

nmap -O <target>

Operating system detection

nmap -A <target>

Aggressive scan (OS, version, scripts, traceroute)

nmap -sC <target>

Run the default NSE scripts

Stealth scans

nmap -sS <target>

Stealth SYN scan

nmap -sN <target>

NULL scan (no flags)

nmap -sF <target>

FIN scan

nmap -sX <target>

Xmas scan (FIN, PSH, URG flags)

Timing options

nmap -T0 <target>

Paranoid (very slow, evades IDS)

nmap -T3 <target>

Normal (default)

nmap -T4 <target>

Aggressive (fast)

nmap -T5 <target>

Insane (very fast, may miss ports)

Scripts NSE (Nmap Scripting Engine)

NSE extends Nmap with Lua scripts. More than 600 scripts are available for vulnerability detection, enumeration and much more.

Vulnerability scripts

Detect known vulnerabilities

nmap --script vuln <target>

→ All vulnerability scripts

nmap --script=http-vuln-* <target>

→ HTTP vulnerabilities

nmap --script=ssl-heartbleed <target>

→ Heartbleed detection

Enumeration scripts

Detailed information gathering

nmap --script=dns-brute <target>

→ DNS brute force

nmap --script=smb-enum-shares <target>

→ SMB enumeration

nmap --script=http-enum <target>

→ HTTP enumeration

Authentication scripts

Authentication testing

nmap --script=ssh-brute <target>

→ SSH brute force

nmap --script=ftp-anon <target>

→ Anonymous FTP

nmap --script=mysql-empty-password <target>

→ MySQL with no password

Output formats

Normal

-oN file.txt

Human-readable text format

XML

-oX file.xml

XML format for automated analysis

Grepable

-oG file.gnmap

Format that is easy to parse with grep

Tous

-oA basename

Generates every format at once

Best practices

⚖️ Legality and authorization

•Only scan your own systems or with written authorization
•Respect local and international law
•Unauthorized scans are illegal in most countries
•Document all your authorizations

🛡️ Stealth and safety

•Use SYN scans (-sS) for more stealth
•Tune timing with -T to avoid detection
•Fragment packets with -f to bypass some firewalls
•Use proxies or a VPN if needed

📊 Analyzing results

•Export results with -oA for every format
•Use -oX for XML analysis
•Manually verify important results
•Correlate with other OSINT tools

⚡ Performance

•Limit the number of scanned ports when possible
•Use --min-rate to control speed
•Parallelize with --min-parallelism
•Avoid T5, which can produce false negatives

⚠️ Legal warning

Scanning systems without authorization is illegal in most jurisdictions. Only use Nmap on your own systems or with explicit written authorization. Unauthorized scans can be treated as computer intrusion and may lead to criminal prosecution.

Ready to put it into practice?

CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.

Discover CyberXTEL