VulnTech Nmap for Linux Targets

Nmap for Linux Targets

Nmap is the most essential tool for discovering, fingerprinting, and exploiting Linux systems during network enumeration. It identifies open ports, running services, OS information, vulnerabilities, firewall rules, host states, and network paths with precision. When targeting Linux machines specifically, Nmap becomes even more powerful because Linux services reveal predictable behaviors, consistent banners, and clear protocol signatures. This chapter provides a full-length, deeply practical guide to using Nmap effectively against Linux hosts.

Understanding How Nmap Interacts with Linux

Linux systems respond to network probes in unique ways:

OpenSSH provides clear version banners
Linux kernel TCP/IP stacks have identifiable signatures
Common services like Apache, Nginx, Postfix, OpenVPN, Samba, and MySQL expose predictable fingerprints
Firewall behavior (iptables, nftables, firewalld) influences port states
IPv6 support reveals additional attack surfaces

Analyzing these responses allows attackers and pentesters to classify the system accurately and determine viable exploit paths.

Basic Host Discovery for Linux Systems

Detect online Linux hosts:

nmap -sn <network>

Example:

nmap -sn 192.168.1.0/24

Interpretation:

Machines responding to ICMP or ARP likely run Linux or lightweight network devices
If ICMP is blocked, ARP still reveals hosts on the local network

Perform detailed host detection:

nmap -PR 192.168.1.0/24

ARP scanning works reliably on LAN segments.

Comprehensive Port Scanning for Linux

Linux servers usually expose predictable ports like 22 (SSH), 80/443 (HTTP/S), 3306 (MySQL), 25 (SMTP), and 445 (SMB).

Scan all TCP ports:

nmap -p- <target>

Fast scan:

nmap -F <target>

Stealth SYN scan:

nmap -sS <target>

TCP connect scan:

nmap -sT <target>

Full scan with service detection:

nmap -sV -sS -p- <target>

This reveals:

Running services
Version numbers
Linux-specific banners
Exposed admin ports

Service Detection for Linux Services

Identify services and versions:

nmap -sV <target>

Deep detection:

nmap -sV --version-all <target>

Linux servers usually reveal:

OpenSSH versions
Apache/Nginx versions
Samba versions
Database versions
FTP server versions
DNS server versions

Example output:

22/tcp open ssh     OpenSSH 7.6p1 Ubuntu
80/tcp open http    nginx 1.14.0

Each version maps directly to specific CVEs.

Vulnerability Scanning Using Nmap NSE

Nmap’s scripting engine performs automated vulnerability checks.

Scan all common vulnerabilities:

nmap --script vuln <target>

Scan authentication issues:

nmap --script auth <target>

Scan default credentials:

nmap --script brute <target>

Specific Linux-related scripts:

ssh2-enum-algos → SSH algorithm enumeration
http-vuln* → Apache/Nginx-related vulnerabilities
smb-vuln* → Samba vulnerabilities
mysql-vuln* → MySQL issues
ftp-proftpd-backdoor → ProFTPD backdoor detection

Example:

nmap --script ssh2-enum-algos -p22 <target>

Identifies weak SSH algorithms or outdated OpenSSH versions.

OS Fingerprinting for Linux Targets

Linux has distinct TCP/IP stack behavior, making OS detection reliable.

OS detection:

nmap -O <target>

Aggressive OS and version detection:

nmap -A <target>

Example output:

Running: Linux 4.X
OS details: Linux 4.4 - 5.4

Combine with banner grabbing for accuracy:

nmap -sV -O <target>

Linux-specific fingerprints include:

Kernel version clues
TCP window sizes
SSH banner correlation
HTTP server headers

Firewall and Filtering Behavior on Linux

Identify filtered ports:

nmap -sS -p- <target>

Identify firewall rules with ACK scan:

nmap -sA <target>

If all ports show unfiltered:

Host likely has no firewall
High chance of multiple exposed services

If ports show filtered:

iptables or firewalld is active

Detect firewalld:

nmap --script=firewalk <target>

Evade firewalls with fragmented packets:

nmap -f <target>

Use decoys:

nmap -D RND:10 <target>

Linux machines often log scans; using decoys reduces attribution.

UDP Enumeration on Linux Systems

Many Linux services run over UDP:

DNS
NTP
SNMP
DHCP
TFTP
Syslog

Scan top UDP ports:

nmap -sU --top-ports 50 <target>

Scan specific ones:

nmap -sU -p53,67,69,123,161 <target>

Example SNMP enumeration:

nmap -sU -p161 --script=snmp-info <target>

Linux systems misconfigured with public community string leak massive data.

Web Server Enumeration on Linux

Most Linux web servers run Apache or Nginx.

Enumerate web headers:

nmap --script=http-headers -p80,443 <target>

Check for vulnerable versions:

nmap --script=http-vuln* <target>

Enumerate directories:

nmap --script=http-enum -p80 <target>

Enumerate CMS platforms:

nmap --script=http-wordpress-enum <target>

Linux web stacks reveal:

PHP versions
Nginx directives
Apache modules
Frameworks such as Laravel, Django, Node.js

SMB/Samba Enumeration

Linux often uses Samba for file sharing.

Enumerate Samba:

nmap --script smb-enum-users,smb-enum-shares -p445 <target>

Check for vulnerabilities:

nmap --script smb-vuln* -p445 <target>

Common findings:

Guest access
Writable shares
Enumeratable users
Vulnerable SMBv1 configurations

SSH Enumeration

Linux servers almost always run OpenSSH.

Enumerate algorithms:

nmap --script ssh2-enum-algos -p22 <target>

Enumerate SSH host keys:

nmap --script ssh-hostkey -p22 <target>

SSH versions often reveal kernel/OS versions indirectly.

Database Enumeration

MySQL

nmap --script mysql-* -p3306 <target>

Postgres

nmap --script pgsql-* -p5432 <target>

Redis

nmap --script redis-info -p6379 <target>

Outdated database versions reveal high-impact CVEs.

Detecting Docker and Containers

Linux systems frequently run Docker, Kubernetes, or LXC.

Check Docker-related ports:

nmap -p2375,2376 <target>

Docker API detected:

Full container takeover
Possible host privilege escalation

Check Kubernetes:

nmap -p10250,10255 <target>

Nmap Scripting for Linux Exploits

Automated exploitation assistance:

Detect shellshock:

nmap --script=http-shellshock -p80 <target>

Check for Heartbleed:

nmap --script=ssl-heartbleed -p443 <target>

Detect Samba RCE:

nmap --script=smb-vuln-cve2009-3103 -p445 <target>

Check for weak SMB passwords:

nmap --script smb-brute -p445 <target>

These scripts directly identify exploit paths.

Practical Workflow for Linux Enumeration with Nmap

Host discovery:

nmap -sn <network>

Full port scan:

nmap -sS -p- <target>

Service detection:

nmap -sV -p<ports> <target>

OS detection:

nmap -O <target>

Vulnerability enumeration:

nmap --script vuln <target>

Target-specific enumeration:

SSH → ssh2-enum-algos
HTTP → http-enum
SMB → smb-enum-shares
MySQL → mysql-info

Manual confirmation with Netcat, Curl, or banner grabbing.

This layered workflow ensures no service or vulnerability is missed.

Practical Exploitation Scenarios

Scenario 1: Outdated OpenSSH

Nmap reveals:

OpenSSH 7.2p2 Ubuntu 4ubuntu2.8

Mapped to privilege escalation CVEs.

Scenario 2: Apache 2.4.29 vulnerable to path traversal

Use:

nmap --script=http-vuln-cve2017-15710 -p80 <target>

Scenario 3: Exposed Docker API

nmap -p2375 <target>

Full remote Docker control → root access.

Scenario 4: Samba share with guest access

nmap --script smb-enum-shares -p445 <target>

Leads to sensitive data exposure.

Scenario 5: SNMP with public community string

nmap --script=snmp-info -p161 <target>

Reveals users, processes, and network structure.

Intel Dump

Nmap is essential for scanning Linux targets
Use -sS, -p-, -sV, -O, and NSE scripts for complete coverage
Linux-specific fingerprints improve OS detection accuracy
HTTP, SSH, Samba, MySQL, Redis, and Docker require specialized enumeration
NSE scripts automate vulnerability detection
Full scans reveal internal-only services and hidden ports
Banner grabbing complements Nmap output
Docker, Kubernetes, SNMP, and Samba often expose major vulnerabilities
Use layered scanning workflow for thorough enumeration