Nmap Tutorial for Beginners

Port Specification

Specify which ports to scan for faster or more comprehensive results.

# Scan specific ports
nmap -p 80,443 192.168.1.1

# Scan a port range
nmap -p 1-1000 192.168.1.1

# Scan all 65535 ports
nmap -p- 192.168.1.1

# Scan top 100 common ports (fast)
nmap -F 192.168.1.1

# Scan top 1000 ports
nmap --top-ports 1000 192.168.1.1

Timing and Performance

Adjust scan speed based on network conditions and stealth requirements.

# Timing templates (T0-T5)
nmap -T0 192.168.1.1  # Paranoid (anti-detection)
nmap -T1 192.168.1.1  # Sneaky
nmap -T2 192.168.1.1  # Polite (slow, less bandwidth)
nmap -T3 192.168.1.1  # Normal (default)
nmap -T4 192.168.1.1  # Aggressive (faster)
nmap -T5 192.168.1.1  # Insane (very fast, may miss)

# Parallelism options
nmap --min-parallelism 10 192.168.1.1

# Max RTT timeout (milliseconds)
nmap --max-rtt-timeout 100ms 192.168.1.1

Network Reconnaissance Example

# Full host discovery on local network
nmap -sn -PR -oA host_discovery 192.168.1.0/24

# Explanation:
# -sn: No port scan after discovery
# -PR: ARP scan (for local networks)
# -oA: Output in all formats

# Discover hosts with custom options
nmap -sn -PS80,443,8080 -PE -T4 10.0.0.0/24

# Reverse DNS resolution during discovery
nmap -sn -R 192.168.1.0/24

Decoy and Zombie Scanning

# Scan with decoy IPs (hides your IP)
nmap -D decoy1,decoy2,ME 192.168.1.1

# Random decoys
nmap -D RND:5 192.168.1.1

# Idle scan (requires zombie host)
nmap -sI zombie_host target.com

# Spoof MAC address
nmap --spoof-mac 0 192.168.1.1  # Random MAC
nmap --spoof-mac Apple 192.168.1.1

IPv6 and IPv4 Options

# IPv6 scanning
nmap -6 fe80::1

# IPv6 discovery
nmap -6 -sn fe80::/64

# IPv6 version detection
nmap -6 -sV -sC target_ipv6

# Dual-stack scanning
nmap -4 target.com  # IPv4 only
nmap -6 target.com  # IPv6 only

Traceroute and Path Discovery

# Traceroute to target
nmap --traceroute 192.168.1.1

# With MTU discovery
nmap --traceroute --mtu 192.168.1.1

# Include in aggressive scan
nmap -A 192.168.1.1

# UDP traceroute
nmap --traceroute -PUN 192.168.1.1

Web Server Assessment

# Full web server enumeration
nmap -p 80,443,8080,8443 \
  -sV --script http-enum,http-title,http-headers \
  -T4 target.com

# Check for SSL/TLS issues
nmap -p 443 --script ssl-enum-ciphers,ssl-cert target.com

# Web vulnerability scan
nmap -p 80,443 \
  --script http-sql-injection,http-xssed,http-csrf \
  target.com

Database Discovery

# Database port scan
nmap -p 3306,5432,27017,6379,1433 \
  -sV --script redis-info,mongodb-info \
  192.168.1.0/24

# MySQL enumeration
nmap -p 3306 --script mysql-info,mysql-enum 192.168.1.1

# MongoDB discovery
nmap -p 27017 --script mongodb-info 192.168.1.1

Complete Network Audit

# Comprehensive network audit
nmap -sS -sU -sV -O -A \
  -p- \
  --script default,discovery,vuln \
  -T4 \
  -oA full_audit \
  192.168.1.0/24

# Weekly port check (for monitoring)
nmap --top-ports 100 -oA weekly_check -iL hosts.txt

# Compare scans
ndiff scan1.xml scan2.xml

What is Nmap and why should I learn it?

Nmap (Network Mapper) is the industry-standard network discovery and security auditing tool. Learning Nmap is essential for penetration testers, security professionals, and network administrators as it provides foundational skills for network reconnaissance and vulnerability assessment.

Is Nmap legal to use?

Nmap itself is legal, but scanning networks you do not have explicit permission to test is illegal. Always obtain written authorization before scanning any network. Use Nmap on your own networks, lab environments, or platforms like HackTheBox and TryHackMe for practice.

What is the difference between TCP and UDP scanning in Nmap?

TCP scanning establishes a full connection (SYN, SYN-ACK, ACK handshake), while UDP scanning sends packets without handshaking. TCP scans are more reliable but slower; UDP scans are faster but less accurate as they rely on ICMP responses or port-specific behaviors.

How do I scan specific ports with Nmap?

Use the -p flag to specify ports. Examples: -p 80 (single port), -p 1-1000 (port range), -p- (all 65535 ports), -p 22,80,443 (multiple specific ports), -p U:53,T:80 (UDP and TCP on same command).

What is Nmap Scripting Engine (NSE)?

NSE is a powerful feature that extends Nmap capabilities through Lua scripts. Scripts can perform vulnerability detection, advanced enumeration, backdoor detection, and even exploit execution. Access scripts with --script or -sC flag.

How can I detect the operating system with Nmap?

Use the -O flag to enable OS detection, or -A for comprehensive detection including OS, version, script scanning, and traceroute. OS detection works by analyzing TCP/IP stack fingerprints and may require at least one open and one closed port for accuracy.

Can Nmap scan through firewalls?

Nmap has multiple techniques to evade firewall detection: fragment packets (-f), use decoy IPs (-D), timing options (-T), source port manipulation (-g), and idle scanning (-sI) using zombies. No technique guarantees success.

What output formats does Nmap support?

Nmap offers multiple output formats: normal (-oN), grepable (-oG), XML (-oX), and all formats simultaneously (-oA). Use -v for verbose output. XML output can be imported into tools like Metasploit, Nessus, and custom security dashboards.