Scan DMZ servers daily at 1am
Introduction to Nmap
Nmap, short for Network Mapper, is the de facto standard tool for network discovery, port scanning, and security auditing. Whether you‘re a network admin, ethical hacker, or cyber security professional, having Nmap in your toolkit is essential.
At its core, Nmap allows you to discover live hosts, open ports, running services, and potential vulnerabilities on your networks. It achieves this by sending carefully crafted packets to target systems and analyzing the responses. Nmap is remarkably flexible, with a huge range of scanning techniques to handle different scenarios.
In this guide, we‘ll take a deep dive into the most important and useful Nmap commands. From basic installation to advanced scanning and automation, you‘ll learn how to unleash the full power of this incredible open-source tool. Let‘s get started!
Installing Nmap
The first step is to install Nmap on your system if you haven‘t already. The process is straightforward but varies slightly based on your operating system.
For Windows, you can download the official Nmap installer from the Nmap download page. Run the executable and follow the installation wizard.
On macOS, the easiest method is to use the Homebrew package manager. If you have Homebrew installed, simply open Terminal and run:
brew install nmap
For Linux, Nmap is included in the default repositories of most distributions. On Debian/Ubuntu, use apt:
sudo apt update
sudo apt install nmap
Once installed, open a command prompt/terminal and run nmap -V to check the version and confirm it‘s working.
Basic Nmap Scans
Let‘s start with the most essential Nmap scans that you‘ll use regularly.
TCP Connect Scan
A TCP connect scan is the default scan mode when run as an unprivileged user. It‘s a reliable scan that completes the full three-way handshake with each open port. Here‘s an example:
nmap scanme.nmap.org
This will scan 1000 common ports on scanme.nmap.org. You can also specify a custom port range with the -p option:
nmap -p 1-100 scanme.nmap.org
TCP SYN Scan
Also known as a "stealth" scan, a SYN scan sends SYN packets but doesn‘t complete the handshake. This often evades firewall logging. However, it requires root/admin privileges:
sudo nmap -sS scanme.nmap.org
UDP Scan
UDP scans probe common UDP ports for responses. They‘re slower than TCP scans but important for a comprehensive audit:
sudo nmap -sU scanme.nmap.org
Ping Sweep
Nmap can perform a ping sweep to find live hosts on a network. Use the -sn option:
nmap -sn 192.168.1.0/24
This will ping all 256 IP addresses in the 192.168.1.0/24 subnet without port scanning them.
OS Fingerprinting
Nmap has an advanced OS detection engine that can identify the operating system on live hosts. Use -O to enable it:
nmap -O scanme.nmap.org
Nmap will compare responses to its database of over 2600 OS fingerprints.
Advanced Nmap Scans
Now let‘s explore some more advanced and lesser-known scanning techniques.
TCP NULL, FIN and Xmas Scans
These scans exploit a loophole in the TCP RFC to differentiate between open and closed ports. They send packets with unusual flags set:
sudo nmap -sN scanme.nmap.org (TCP NULL scan)
sudo nmap -sF scanme.nmap.org (TCP FIN scan)
sudo nmap -sX scanme.nmap.org (TCP Xmas scan)
These scans can bypass some firewalls and IDS systems.
TCP ACK and Window Scans
ACK and Window scans don‘t determine open ports but can find out if ports are filtered or unfiltered. They‘re useful for firewall reconnaissance:
sudo nmap -sA scanme.nmap.org (TCP ACK scan)
sudo nmap -sW scanme.nmap.org (TCP Window scan)
IP Protocol Scan
This esoteric scan determines which IP protocols are supported on a host:
nmap -sO scanme.nmap.org
Useful protocols are ICMP, IGMP, and various routing protocols.
Custom TCP/UDP Scans
Nmap allows you to craft custom packets with the –scanflags option. For example, to set the FIN, PSH and URG flags:
sudo nmap --scanflags FINPSHURG scanme.nmap.org
This is useful for testing how target systems respond to abnormal packets.
Useful Nmap Options
In addition to different scan types, Nmap has dozens of command line options to customize its behavior. Here are some to know:
Verbose Output
The -v option increases the verbosity level, making Nmap print more information about the scan in progress. You can use -vv for even more detail.
Version Detection
Nmap can optionally probe open ports to determine service/version info. This is useful for finding outdated and vulnerable software. Use -sV:
nmap -sV scanme.nmap.org
Output Formats
By default Nmap outputs scan results in a human-readable format. But you can generate XML, grepable, or normal output for further parsing:
nmap -oX scan.xml scanme.nmap.org (XML output)
nmap -oG scan.grep scanme.nmap.org (grepable output)
nmap -oN scan.nmap scanme.nmap.org (normal output)
Timing and Performance
Nmap offers timing templates from 0 (slowest, stealthier) to 5 (fastest, more aggressive):
nmap -T4 scanme.nmap.org
You can also fine-tune timeouts and packet rates for IDS evasion or improved performance on a fast network.
Nmap Scripting Engine
Nmap has a powerful scripting engine (NSE) that can automate networking tasks. Many default scripts come installed, and you can write your own in Lua. For example, to scan for the EternalBlue vulnerability:
nmap -sV --script vuln scanme.nmap.org
The vuln category has scripts for known vulnerabilities. Other categories include auth, broadcast, default and discovery.
Firewall Evasion
Several options help Nmap evade firewall restrictions. The -f option fragments packets into smaller chunks. And –mtu lets you specify your own offset size.
nmap -f scanme.nmap.org
nmap --mtu 24 scanme.nmap.org
The -D option lets you cloak a scan with decoys:
nmap -D decoy1,decoy2,ME scanme.nmap.org
This makes it appear like the scan is coming from multiple IP addresses.
Saving and Automating Scans
For routine scanning, Nmap lets you define scan profiles and automate commands.
Scan Profiles
You can save sets of options into named profiles in the nmap.config file:
[basic]
nmap -sV -T4 scanme.nmap.org
Then initiate them as:
nmap --profile basic
Automation With Scripts
Any command that can be run from the shell can be automated in scripts. A common use case is scheduling routine scans with Cron jobs on Linux/macOS or Task Scheduler on Windows.
Here‘s an example bash script:
#!/bin/bash
nmap -sV --script vuln 10.0.0.0/24 >> /logs/nmap-scan.log
With a little editing, a script like this could email scan results to an admin, process the XML output, or integrate with other tools.
Following Up On Scan Results
An Nmap scan is often just the first step in a security assessment or penetration test. It‘s crucial to review the output carefully and follow up on findings:
-
Review the open ports and try to determine if each one needs to be accessible. Close or filter unnecessary ports.
-
Look at the service versions and check if any are outdated or have known vulnerabilities. Work with application owners to update software.
-
For any custom services or unrecognized ports, connect to them with Netcat or a similar tool. Figure out what they are and if they‘re needed.
-
Feed scan output into other tools like Metasploit, Burp Suite, Wireshark, etc. for deeper analysis and exploitation.
Nmap is most powerful when combined with other aspects of network security assessment.
Conclusion
Nmap is an indispensable tool for understanding and securing networks. We‘ve covered the most important Nmap scans, options, and use cases, but this is still just the tip of the iceberg. The possibilities with Nmap are endless, especially when combined with the scripting engine and other tools.
Remember to only scan your own networks or those you have explicit permission for. Unauthorized scanning is unethical and often illegal.
To learn even more about Nmap, consider reading the official Nmap Network Scanning book by Gordon "Fyodor" Lyon, the creator of Nmap. It‘s an excellent resource.
There are also many great third-party sites and communities to explore, such as:
I hope you‘ve found this guide helpful for mastering Nmap. Stay curious, keep scanning, and happy hacking!
