Check:

3. Your First Nmap Scan

The simplest scan is:

Nmap will perform its default host/port discovery behavior and display interesting ports it identifies.

A typical result looks like:

The important columns are:

Nmap's service name is not necessarily proof of the actual application running on that port.

4. Understanding Port States

Nmap commonly reports several states.

Open

An application is listening and accepting connections.

Closed

The port is reachable, but no application is currently listening.

Filtered

A firewall or filtering mechanism prevents Nmap from determining whether the port is open.

Open|Filtered

Nmap cannot determine whether the port is open or filtered.

Closed|Filtered

Nmap cannot determine whether the port is closed or filtered.

These states are important because an open port does not automatically mean a vulnerability exists.

5. Scan a Single Host

Hostname:

Domain:

Only scan domains and systems you are authorized to test.

6. Scan Multiple Hosts

You can also specify a range:

This scans the hosts from:

through:

7. Scan a Network

For an authorized lab network:

This represents the network range rather than one individual host.

8. Host Discovery

Sometimes you want to discover which systems are online without performing a normal port scan.

Use:

The -sn option performs host discovery without a normal port scan.

Example:

This is useful as the first step in a lab reconnaissance workflow.

9. Skip Host Discovery

Sometimes a host does not respond to the discovery probes Nmap normally uses.

You can tell Nmap to treat the target as online:

This does not mean the target is definitely online. It means Nmap skips the normal host-discovery test and proceeds with scanning.

10. Scan Specific Ports

Scan one port:

Multiple ports:

Port range:

Nmap supports individual ports, ranges, and more advanced port specifications.

11. Scan All TCP Ports

Use:

This scans TCP ports from 1 through 65535.

A common beginner workflow is:

followed by more detailed enumeration of interesting ports.

12. Fast Scan

Nmap provides a fast scan option:

The fast scan uses a smaller set of common ports.

According to the Nmap documentation, the normal default scans the most common 1,000 ports, while -F reduces that set to the 100 most common ports.

13. Scan the Top Ports

You can choose how many common ports to scan.

Or:

This is useful when you want a faster initial assessment.

14. TCP SYN Scan

A common TCP scanning technique is SYN scanning:

This generally requires elevated privileges because Nmap needs to construct raw packets.

SYN scanning is one of Nmap's standard TCP scanning techniques.

15. TCP Connect Scan

Use:

This uses the operating system's normal TCP connection mechanism.

It can be useful when raw-packet privileges are unavailable.

16. UDP Scan

UDP services are important because not every service uses TCP.

Scan UDP:

Scan selected UDP ports:

Common UDP services include:

UDP scans can take longer than TCP scans.

17. TCP + UDP

In an authorized lab:

For a smaller test:

Nmap permits UDP scanning to be combined with a TCP scan technique.

18. Service Version Detection

Finding an open port is only the beginning.

Use:

Nmap attempts to determine the service and version.

Example:

Version detection helps you decide what service-specific investigation should happen next.

19. Default NSE Scripts

Nmap includes the Nmap Scripting Engine (NSE).

A useful general option is:

This runs the default script set.

You can combine it with version detection:

This is one of the most useful commands for an authorized lab.

20. Operating System Detection

Try OS detection:

Nmap analyzes network responses and attempts to identify operating-system characteristics.

OS detection is an estimate and should not automatically be treated as definitive.

21. Aggressive Detection

Nmap provides:

This enables several advanced detection features, including OS detection, version detection, scripts, and traceroute-related functionality.

Use this carefully because it generates more traffic than a basic scan.

22. The Most Useful General Scan

For an authorized Hackvora lab target:

This gives you:

• Open ports
• Service information
• Version information
• Default NSE script results

This is a good command to learn before moving into advanced scanning.

23. Nmap NSE

NSE stands for:

Nmap Scripting Engine

NSE extends Nmap beyond simple port scanning.

Scripts can assist with tasks such as:

• Service enumeration
• HTTP information gathering
• SSH information
• SMB information
• TLS inspection
• DNS-related enumeration

List installed scripts:

Get help about scripts:

Run a specific script:

24. HTTP Enumeration

For an authorized web server:

HTTP headers:

HTTP methods:

These commands can provide useful information about the HTTP service.

25. SSH Enumeration

First identify the SSH service:

Enumerate SSH algorithms:

This can help you understand the SSH cryptographic configuration.

26. SMB Enumeration

For an authorized Windows/Samba lab:

SMB security mode:

SMB enumeration can be particularly useful during internal-network security assessments.

27. DNS Enumeration

Check DNS:

DNS-related NSE scripts:

Only perform this against an authorized DNS server.

28. TLS Enumeration

For an authorized HTTPS service:

This can help identify supported TLS protocols and cipher suites.

29. Verbose Mode

Use:

More verbose:

Verbose output can help you understand what Nmap is doing.

30. Disable DNS Resolution

Reverse DNS lookups can sometimes add delay.

Use:

This tells Nmap not to perform DNS resolution for the scan.

31. Timing Templates

Nmap provides timing templates:

Example:

In general:

Don't automatically use -T5. Faster scanning can generate more traffic and may produce less reliable results in some situations.

32. Show Only Open Ports

Use:

This reduces output when you're primarily interested in ports that Nmap considers open or potentially open.

33. Explain Why Nmap Chose a State

Use:

This can make Nmap's classification easier to understand.

For example, instead of simply seeing:

you can get additional information about why Nmap classified the port that way.

34. IPv6 Scanning

Nmap supports IPv6.

Example:

Only use an address that belongs to your authorized test environment.

35. Scan in Numerical Port Order

Nmap normally randomizes port scan order.

To scan ports in numerical order:

This can be useful when studying scan behavior.

36. Save Normal Output

Save normal output:

This creates a readable report.

37. Save XML Output

XML is useful when another program needs to process the results.

38. Grepable Output

This format is designed for command-line processing.

For modern automation, XML is generally more structured and useful than the older grepable format.

39. Save All Major Output Formats

Use:

Nmap creates:

This is particularly useful when documenting a security assessment.

40. Resume an Interrupted Scan

If a scan is interrupted and you saved normal or grepable output, Nmap supports:

This can be useful for long-running authorized assessments.

41. Packet Tracing

To understand what Nmap is sending and receiving:

Limit the number of ports when learning packet behavior because packet tracing can generate a large amount of output.

The official documentation describes --packet-trace as a way to summarize packets sent and received.

42. Practical Nmap Workflow

Don't start by memorizing every flag.

Build a methodology.

Step 1 — Discover hosts

Step 2 — Find common ports

Step 3 — Find all TCP ports

Step 4 — Identify services

Step 5 — Run default scripts

Step 6 — Combine them

Step 7 — Investigate individual services

For example:

Step 8 — Save your evidence

43. Nmap for VAPT

Nmap is commonly used during the reconnaissance and enumeration stages of a security assessment.

A simplified workflow:

The important lesson is:

Nmap discovers information; the security professional interprets it.

An open port is not automatically a vulnerability.

44. Nmap for SOC Analysts

Nmap is also valuable from a defensive perspective.

Suppose a SOC analyst notices that a server suddenly exposes:

Nmap can help determine what service appears to be running.

Security teams can use authorized scanning to support:

• Asset inventory
• Service exposure reviews
• Network monitoring
• Change validation
• Security assessments

Nmap can therefore be useful for both offensive and defensive security work.

45. Nmap for GRC

Nmap results can support security documentation and assessment evidence.

Examples include:

• Network asset discovery
• Exposed-service inventories
• Security assessment evidence
• Vulnerability-management workflows
• Change verification

However:

Nmap output alone does not prove compliance.

Compliance requires appropriate controls, policies, evidence, risk assessment, and organizational processes.

46. Common Nmap Mistakes

Mistake 1 — Scanning without permission

Never scan random public systems.

Use:

• Hackvora labs
• Your own VM
• Your own network
• Authorized penetration-testing scope

Mistake 2 — Assuming an open port is vulnerable

This:

does not mean:

It only tells you that Nmap believes an HTTP service is available.

Mistake 3 — Trusting version detection blindly

Version detection is useful, but important findings should be verified.

Mistake 4 — Always using aggressive scans

You don't need:

for every situation.

Start with a focused scan and increase detail when needed.

Mistake 5 — Not saving evidence

Use:

when you need to retain results.

Mistake 6 — Ignoring UDP

TCP is not the entire network.

Important services can operate over UDP.

47. Nmap Command Cheat Sheet

48. Beginner Practice Challenge

Now practice what you learned.

Use an authorized Hackvora lab target.

Task 1

Discover the host:

Task 2

Find the common ports:

Task 3

Find all TCP ports:

Task 4

Identify services:

Task 5

Run default scripts:

Task 6

Combine service detection and scripts:

Task 7

Save your results:

49. Intermediate Challenge

After completing the beginner challenge, investigate:

• HTTP
• SSH
• SMB
• DNS
• TLS
• UDP
• NSE scripts
• scan output
• service versions

For example:

Then answer:

1. Which ports are open?
2. Which services are running?
3. Which versions were detected?
4. Which ports use TCP?
5. Which ports use UDP?
6. What additional information did NSE provide?
7. Which findings require manual verification?

50. Advanced Challenge

For advanced learners, focus less on memorizing commands and more on understanding how Nmap works.

Study:

• TCP/IP
• TCP flags
• SYN scanning
• UDP behavior
• firewalls
• packet filtering
• service fingerprinting
• OS detection
• NSE
• scan timing
• output parsing
• network segmentation
• defensive detection

The goal is to understand:

51. Most Important Commands to Remember

If you're new to Nmap, start with these:

Once you understand these commands, move into NSE, service-specific enumeration, packet behavior, and defensive analysis.

52. Nmap Learning Path

A good way to learn Nmap is:

On Hackvora, Nmap should be treated as a practical skill rather than a list of commands to memorize.

Conclusion

Nmap is one of the most important tools to learn when entering cybersecurity.

But becoming good at Nmap is not about remembering hundreds of flags.

It's about learning how to move from:

Start with simple scans, understand the results, practice in an authorized sandbox, and gradually move toward deeper service enumeration.

Once you're comfortable with Nmap, the next step is to combine it with your Linux, networking, HTTP, and VAPT knowledge to perform structured security assessments.

Practice responsibly. Scan only systems you are authorized to test.