Home > Network Pentesting

Nmap

Nmap is the foundational network scanning tool used in reconnaissance, vulnerability discovery, and service enumeration. It maps hosts, ports, services, operating systems, and firewall behavior across networks. Mastering Nmap is essential for pentesters because it provides accurate visibility into network structure before exploitation or lateral movement begins. This chapter explains Nmap’s core functions, scanning modes, service detection, OS fingerprinting, firewall evasion, and practical workflows.

Understanding Nmap’s Role

Nmap helps pentesters:

  • Discover live hosts

  • Identify open ports

  • Detect running services

  • Enumerate service versions

  • Identify OS details

  • Test firewall and IDS responses

  • Perform fast or stealthy scans

  • Identify vulnerable configurations

All testing begins with awareness, and Nmap provides that awareness.

Basic Host Discovery

Host discovery identifies systems responding on a network.

Ping Sweep (Simple Discovery)

nmap -sn 10.10.10.0/24

This shows live hosts without performing a full port scan.

ARP Discovery (Local Networks)

nmap -PR -sn 10.10.10.0/24

ARP scanning is reliable inside LANs because it does not require ICMP or port access.

Disable Ping (If ICMP Is Blocked)

nmap -Pn 10.10.10.5

This forces Nmap to treat targets as alive even without ICMP responses.

Port Scanning Modes

Port scanning identifies open TCP/UDP ports used by internal services.

TCP SYN Scan (Default Stealth Scan)

nmap -sS 10.10.10.5

Fast and stealthy, used most often.

TCP Full Connect Scan

nmap -sT 10.10.10.5

Used when SYN scanning is not permitted (e.g., proxychains).

UDP Scan

nmap -sU 10.10.10.5

Useful for DNS, SNMP, DHCP, and custom UDP services.

Fast Scan

nmap -F 10.10.10.5

Scans the top common ports for quick results.

Full TCP Port Scan

nmap -p- 10.10.10.5

Scans all 65,535 TCP ports for maximum visibility.

Service & Version Detection

Identifying what services are running, and which versions they use, is critical for vulnerability discovery.

Enable Version Detection

nmap -sV 10.10.10.5

Aggressive Version Detection

nmap -sV --version-intensity 9 10.10.10.5

This reveals banner details, product versions, and potential misconfigurations.

Operating System Fingerprinting

Nmap can guess the OS based on network behavior.

Enable OS Detection

nmap -O 10.10.10.5

Combine OS and Version Detection

nmap -A 10.10.10.5

This includes:

  • OS detection

  • Version detection

  • Traceroute

  • Default scripts

Useful for deep enumeration.

NSE Scripting (Nmap Scripting Engine)

Nmap includes hundreds of scripts for extended scanning.

Run Default Scripts

nmap -sC 10.10.10.5

Run Specific Script Categories

  • Discovery

  • Safe

  • Malware

  • Auth

  • Vuln

  • Intrusive

Example: SMB Enumeration

nmap --script smb-enum-shares,smb-enum-users -p445 10.10.10.5

Example: Vulnerability Scanning

nmap --script vuln 10.10.10.5

NSE makes Nmap a lightweight exploitation framework.

Firewall & IDS Evasion Techniques

Avoid detection or bypass firewalls during scanning.

Fragmented Packets

nmap -f 10.10.10.5

Decoy Scan

nmap -D RND:10 10.10.10.5

Slow Scan for Stealth

nmap -T1 10.10.10.5

Custom Source Port

nmap --source-port 53 10.10.10.5

Firewall rules trusting DNS or other known services can be exploited this way.

Scanning Through Proxychains / SOCKS Tunnels

When pivoting inside internal networks, Nmap must work through tunnels.

Full TCP Scan Through Proxychains

proxychains nmap -sT 10.10.20.0/24

Single Host Enumeration

proxychains nmap -sT -sV 10.10.20.10

SYN scans do not work through SOCKS proxies, so -sT is required.

Practical Scan Workflows

Fast Recon on Entire Subnet

nmap -sn 10.10.10.0/24

Detailed Scan of Important Hosts

nmap -sS -sV -O -p- 10.10.10.5

Aggressive Information Gathering

nmap -A 10.10.10.5

Vulnerability Focus

nmap --script vuln -sV 10.10.10.5

Internal Pentesting Pipeline

  1. Discover live hosts

  2. Identify open services

  3. Enumerate versions

  4. Run NSE scripts

  5. Map OS and topology

  6. Build exploitation routes

Nmap creates the foundation for all further operations.

Why Nmap Mastery Matters

Mastering Nmap enables attackers and pentesters to:

  • Map entire networks

  • Identify hidden or filtered services

  • Discover attack paths

  • Bypass firewalls

  • Detect vulnerable software

  • Build pivoting strategies

  • Validate segmentation

  • Identify weak configurations

Nmap is the primary tool that transforms unknown environments into structured attack maps.

Intel Dump

  • Host discovery uses ping, ARP, and disabled-ping modes

  • TCP/UDP scanning reveals open services

  • Version detection identifies vulnerabilities

  • OS fingerprinting maps system types

  • NSE scripts extend Nmap into application-level enumeration

  • Firewall evasion uses fragmentation, decoys, source ports, slow scans

  • Proxychains enables internal scanning through tunnels

  • Nmap is essential for complete reconnaissance and exploitation

HOME LEARN COMMUNITY DASHBOARD