Nmap (Network Mapping Tool)

Nmap (Network Mapper)

Nmap is the industry-standard tool for network discovery and security auditing. It's used to discover hosts, services, open ports, and operating systems on a network — essential for any penetration test or security assessment.

Common Nmap Scan Types

Basic scans:

• nmap <target> — Quick TCP SYN scan of the top 1000 ports

• nmap -p- <target> — Scan all 65,535 TCP ports

• nmap -sV <target> — Service/version detection on open ports

• nmap -O <target> — OS fingerprinting

• nmap -sC <target> — Run default NSE scripts against discovered services

My go-to reconnaissance combo:

nmap -sC -sV -oA <output-name> <target>

This runs default scripts, probes service versions, and saves output in all three formats (normal, XML, greppable).

Stealth & firewall evasion:

• nmap -sS — TCP SYN scan (default, requires root)

• nmap -f — Fragment packets to evade firewalls

• nmap -D RND:10 <target> — Decoy scan with 10 random decoys

• nmap --data-length <size> — Append random data to packets

UDP scanning (slow but important):

• nmap -sU <target> — UDP port scan

• nmap -sU -sS <target> — Combined UDP + TCP

NSE Scripts:

• nmap --script vuln <target> — Run all vulnerability detection scripts

• nmap --script http-enum <target> — Enumerate web directories

• nmap --script smb-os-discovery <target> — SMB enumeration