Introduction to Nmap

February 3, 2025February 3, 2025

NMAP

Nmap is a command-line utility designed to scan networks and gather information about devices and services. Created by Gordon Lyon (also known as Fyodor), Nmap is renowned for its flexibility, speed, and broad range of capabilities. It is used by network administrators to map out networks, detect open ports, and identify potential security vulnerabilities.

What is Nmap?

Nmap is a tool used to scan and analyze networks. It helps you find out which devices are connected to a network, what services they are running, and if there are any security issues. Essentially, it’s like a digital mapmaker for network systems, showing you what’s out there and how it’s all connected.

Nmap is short for network mapper. It is an open-source Linux command-line tool that is used to scan IP addresses and ports in a network and to detect installed applications.

Nmap allows network admins to find which devices are running on their n network, discover open ports and services, and detect vulnerabilities.

Key Features of Nmap

Network Discovery: Identifies devices on a network and their IP addresses.
Port Scanning: Determines which ports are open on a device, helping to identify active services.
Service Detection: Identifies the services running on open ports and their versions.
Operating System Detection: Determines the operating system of a device based on network behavior and responses.
Scriptable Interaction: Utilizes the Nmap Scripting Engine (NSE) for more advanced scanning and automation tasks.
Output Formats: Provides results in multiple formats, including plain text, XML, and HTML.

Nmap Scan Types:

TCP Scan: It completes a three-way handshake between you and a closet target system. The TCPscan is very noisy and cannot be detected with almost any effort because services can log onto the sender IP address and trigger an intrusion detection system.

UDP Scan: A UDP scan is used to discover open UDP ports on a target system. Unlike TCP, UDP (User Datagram Protocol) is connectionless, meaning it does not establish a connection before sending data, which makes it more challenging to detect and scan.

ACK Scan: ACK scans are used to determine a particular port that has been filtered. It proves to be extremely helpful when trying to check for firewalls and their current regulations.

SYN Scan: It is another form of TCP scan. Nmap crafts a sync packet, the first packet sent to establish is a TCP connection.

Bang Scan: The bang scan is like SYN scans. It sends the TCP fin packet instead of RST packet (reset packet) if it receives the input so that false scans and negativity are seen in the scan. But it may be under the radar of some IDS programs and many countermeasures.

Full Scan: The null scan is very secretive, and as the name suggests what they do – they set all header fields to zero. It is not a valid packet, and targets will not know how to deal with packet.

Ping Scan: A ping scan in Nmap is used to determine which hosts are up and responding on a network. It’s a quick way to check if a target host is active without performing a full port scan. Here’s how you can use and understand ping scans with Nmap:

Nmap functions

Installing Nmap Before using Nmap, you need to install it on your system. Nmap is available for various operating systems, including Windows, macOS, and Linux.

Commands Let’s look at some Nmap commands. If you don’t have Nmap installed, you can get it from here.

Basic scans Scanning the list of active devices on a network is the first step in network mapping. There are two types of scans you can use for that:

Ping scan- Scan the list of devices up and running on a given subnet.

Ping target (ip)

Simple scan: To perform a basic scan of a single IP address.

Nmap (ip)

Scan Multiple Targets: You can scan multiple IP addresses or ranges by separating them with spaces or using CIDR notation

Scan a Range of Ports: By default, Nmap scans the 1,000 most common ports. To scan a specific range of ports:

nmap -p 1-1000 192.168.177.130

Scan All Ports: To scan all 65,535 ports:

nmap -p- 192.168.177.130

Service Version Detection: To detect the versions of services running on open ports:

nmap -sV 192.168.177.130

Operating System Detection: To identify the operating system of a target device:
nmap -O 192.168.177.130

Aggressive Scan: An aggressive scan performs service detection, OS detection, and other advanced features:

nmap -A 192.168.177.130

Advanced Nmap Features

Nmap Scripting Engine (NSE)

The Nmap Scripting Engine allows users to write and execute scripts to automate various scanning tasks. NSE scripts are stored in the scripts directory within Nmap’s installation folder.

Run All Default Scripts
nmap -sC 192.168.177.130

Run a Specific Script

nmap –script <script-name> 192.168.177.130

Timing and Performance Options

Nmap allows you to adjust the timing and performance of scans using timing templates. Timing templates range from 0 (paranoid) to 5 (insane).

Default Timing

nmap -T4 192.168.177.130

Paranoid Timing

nmap -T0 192.168.177.130

Stealth Scanning

Stealth scanning methods help avoid detection by network intrusion detection systems (IDS) and firewalls.

SYN Scan (half-open scan):

nmap –sS

FIN Scan:

nmap -sF 192.168.177.130

Null Scan:

nmap -sN

OS Fingerprinting

Nmap’s OS detection can be customized for more accurate results.

Aggressive OS Detection:

nmap -A –O target ip

NMAP