Mastering Network Reconnaissance with Nmap: A Comprehensive Guide

Follow me on X https://x.com/willfromswiss

Nmap (Network Mapper) is a powerful open-source tool for network discovery and security auditing. This guide will walk you through the process of using Nmap to discover open ports, identify services, and detect vulnerabilities.

Before we begin, ensure Nmap is installed on your system.

For Linux: sudo apt-get install nmapFor macOS: brew install nmapFor Windows: Download the installer from nmap.org

Let’s start with a simple port scan:

nmap <target_ip>

This command scans the 1000 most common ports. For a more comprehensive scan:

nmap -p- <target_ip>

This scans all 65535 ports, which takes longer but is more thorough.

To identify services running on open ports:

nmap -sV 192.168.1.100

This performs version scanning, attempting to determine the service/version info for open ports.

To guess the target’s operating system:

sudo nmap -O 192.168.1.100

Note: This requires root privileges on Unix-like systems.

For a comprehensive scan that includes OS detection, version scanning, and script scanning:

nmap -A 192.168.1.100

Save your results for later analysis:

nmap -oN output.txt 192.168.1.100

This saves the output in normal format. Use -oX for XML output or -oG for grepable output.

Nmap’s Scripting Engine (NSE) can detect vulnerabilities:

nmap --script vuln 192.168.1.100

This runs vulnerability-related scripts against the target.

For a more discreet approach, use SYN scanning:

sudo nmap -sS 192.168.1.100

This performs a SYN scan, which is less likely to be logged by the target.

Control the scan timing for speed or stealth:

nmap -T4 192.168.1.100

T0 is slowest and stealthiest, T5 is fastest and noisiest.

Nmap has a vast library of scripts for various purposes:

nmap --script=http-enum 192.168.1.100

This example enumerates HTTP services.

A comprehensive scan might look like this:

sudo nmap -sV -sC -O -p- -T4 --script vuln -oN full_scan.txt 192.168.1.100

This performs:

Service/version detection (-sV)Default script scan (-sC)OS detection (-O)All ports scan (-p-)Aggressive timing (-T4)Vulnerability scripts ( — script vuln)Saves output to full_scan.txt (-oN)

The idle scan is a stealthy way to scan a target using a zombie host:

sudo nmap -sI 192.168.1.101 192.168.1.100

Exploit vulnerable FTP servers to port scan other hosts:

nmap -b ftp:password@192.168.1.102 192.168.1.100

Create your own NSE (Nmap Scripting Engine) scripts for specialized tasks:

Write your script in Lua, e.g., custom-script.nse:description = [[
Custom script to check for a specific vulnerability.
]]

-- The rest of your Lua code here

action = function(host, port)
-- Your scan logic here
end

Place the script in the Nmap scripts directory (usually /usr/share/nmap/scripts/).Run your custom script:nmap --script custom-script 192.168.1.100

Generate network topology maps using Nmap’s output:

# Perform a scan with XML output:
nmap -sn -oX network_scan.xml 192.168.1.0/24

# Use xsltproc to visualize the network:
xsltproc network_scan.xml -o network_map.html

Optimize scanning speed and stealth:

nmap -T4 -min-parallelism 100 -max-parallelism 256 192.168.1.100

Split TCP headers over several packets:

nmap -f 192.168.1.100

Generate decoy scans to confuse IDS systems:

nmap -D RND:10 192.168.1.100

Scan IPv6 networks:

nmap -6 2001:db8::1

Create a script to automate complex scanning scenarios:

#!/bin/bash

target=$1
nmap -sV -sC -p- $target -oN initial_scan.txt
open_ports=$(grep "open" initial_scan.txt | cut -d'/' -f1 | tr '\n' ',')
nmap -sV -sC -p$open_ports --script vuln $target -oN vulnerability_scan.txt

Save this as advanced_scan.sh and run it with ./advanced_scan.sh 192.168.1.100.

Combine Nmap with other security tools:

# Identify web servers:
nmap -p 80,443 --open -oG web_servers.txt 192.168.1.0/24

# Feed results into Nikto:
cat web_servers.txt | grep Http | cut -d' ' -f2 | nikto -h -

Adapt Nmap for cloud environments:

# Scan AWS EC2 instances:
nmap -sV -p- $(aws ec2 describe-instances --query 'Reservations[*].Instances[*].PublicIpAddress' --output text)

Remember to always use these methods ethically and with proper authorization. The power of these tools comes with the responsibility to use them correctly and legally.