Nmap

Nmap is the primary tool for network scanning and service discovery. It identifies live hosts, open ports, running services, and operating systems across networks of any size. It is typically the first tool used after scope validation and the foundation for most of the enumeration that follows.

Strategic context

Nmap translates an IP range or hostname into actionable intelligence about what is running and reachable. The quality of an engagement's reconnaissance phase depends heavily on how Nmap is used. not just whether it is run, but how the scans are configured, what options are selected, and how the output is interpreted.

Nmap is also one of the noisiest tools in the offensive toolkit. A full port scan with version detection and scripts against an entire subnet generates significant traffic that is visible to network monitoring, intrusion detection systems, and firewall logs. Understanding the tradeoff between scan thoroughness and scan visibility is essential.

For security leaders, Nmap scans represent the earliest detectable phase of most external attacks. Monitoring for sequential port connections, SYN floods, and unusual service probing patterns can provide early warning. However, skilled operators adjust scan timing and technique to minimize detection signatures.

Execution examples

Scan types

The choice of scan type determines what information is gathered and how visible the scan is.

TCP connect scans (-sT) complete the full TCP handshake. They are reliable but logged by the target. SYN scans (-sS) send only the initial SYN packet and are the default when running as root. They are faster and slightly less visible because the connection is never completed. UDP scans (-sU) are slow but necessary for discovering services like DNS, SNMP, and TFTP that operate over UDP.

# SYN scan with version detection and default scripts
nmap -sC -sV -p- -oA full_scan target

# Quick top-ports scan for initial visibility
nmap -T4 --top-ports 1000 target

# UDP scan of common ports
nmap -sU --top-ports 20 target

Output formats

Nmap supports multiple output formats. Using -oA generates all three standard formats simultaneously. normal, greppable, and XML. This costs nothing and provides flexibility during analysis:

nmap -sC -sV -p- -oA scan_name target

Greppable output (-oG) is useful for quickly extracting specific data points:

grep "80/open" scan.gnmap
grep "Up" scan.gnmap | awk '{print $2}'

Nmap Scripting Engine (NSE)

NSE extends Nmap with scripts that perform targeted enumeration, vulnerability detection, and brute force attacks. Scripts are organized by category and located in /usr/share/nmap/scripts/.

# Run default scripts (included with -sC)
nmap -sC target

# Run specific scripts
nmap --script smb-enum-shares,smb-os-discovery -p 445 target

# Run all vulnerability detection scripts
nmap --script vuln target

# Get help on a specific script
nmap --script-help smb-enum-shares

Common NSE categories include default (general discovery), vuln (vulnerability detection), auth (authentication testing), brute (brute force), and discovery (service enumeration).

Timing and stealth considerations

Nmap timing templates range from T0 (paranoid) to T5 (insane). The default is T3. For engagements with stealth requirements, slower timing reduces the scan's network signature:

# Slower, less detectable
nmap -T2 -p- target

# Faster, noisier
nmap -T4 --min-rate 1000 target

Adjusting the minimum rate (--min-rate) and maximum retries (--max-retries) provides finer control than timing templates alone.

Where Nmap fits in the lifecycle

• External reconnaissance: identifying exposed services and mapping the attack surface

• Internal reconnaissance: host discovery and service enumeration after gaining a foothold

• Lateral movement: identifying services on internal hosts that may accept discovered credentials