Network Recon with Nmap

Recon decides everything that follows. You cannot attack a service you do not know exists. Nmap is the tool for this job, and learning to read its output is as important as learning its flags.

Only scan hosts in your lab or on platforms that explicitly authorize it. Scanning networks you do not own can be illegal and will get you banned from your ISP.

Step 1: Host discovery

Find out what is alive before you scan ports:

sudo nmap -sn 192.168.56.0/24 -oN hosts.txt

-sn disables port scanning. Nmap uses ARP on a local network, which is fast and reliable.

Step 2: A fast full port scan

Default Nmap only checks the top 1,000 ports. Services hide on high ports, so scan all 65,535:

sudo nmap -p- --min-rate 2000 -T4 192.168.56.101 -oN allports.txt

Flag	Meaning
-p-	every TCP port
--min-rate 2000	send at least 2,000 packets per second
-T4	aggressive timing, fine on a lab network
-oN	save normal output to a file

Step 3: Deep scan the open ports

Take the open ports from step 2 and run version detection plus default scripts on just those:

sudo nmap -p 21,22,80,139,445 -sC -sV 192.168.56.101 -oA target

• -sV probes each port to identify the software and version.
• -sC runs the default NSE scripts: banner grabs, anonymous login checks, HTTP titles, and more.
• -oA target writes .nmap, .gnmap, and .xml files at once.

Splitting the scan in two like this is much faster than running -sC -sV -p- in one go.

Step 4: Read the output

PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 2.3.4
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp  open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1
80/tcp  open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
|_http-title: Metasploitable2 - Linux
445/tcp open  netbios-ssn Samba smbd 3.0.20-Debian

Ask these questions of every line:

1. Is the version old? Apache 2.2.8 and OpenSSH 4.7 are ancient. Search the exact version in Exploit-DB or with searchsploit vsftpd 2.3.4.
2. Did a script hand you something? ftp-anon says anyone can log in to FTP. Try it before anything else.
3. What does it tell you about the OS? Debian 8ubuntu1 package strings narrow down the distribution and release.
4. Is it a web server? Every HTTP port gets its own enumeration pass. See Web Hacking 101.

Step 5: Don’t forget UDP

Some of the juiciest services, like SNMP, TFTP, and DNS, run over UDP. UDP scans are slow, so limit them to the top ports:

sudo nmap -sU --top-ports 25 192.168.56.101

If UDP 161 (SNMP) is open, try snmpwalk -v2c -c public 192.168.56.101. Default community strings leak a surprising amount of data.

Useful NSE scripts

nmap --script smb-os-discovery,smb-enum-shares -p 445 TARGET
nmap --script http-enum -p 80 TARGET
nmap --script vuln -p 80,443 TARGET
ls /usr/share/nmap/scripts | grep smb

The vuln category flags known issues but generates a lot of traffic. That’s fine in your lab and noisy anywhere else.

A repeatable workflow

export IP=192.168.56.101
sudo nmap -p- --min-rate 2000 $IP -oN allports.txt
ports=$(grep -oP '^\d+(?=/tcp\s+open)' allports.txt | paste -sd, -)
sudo nmap -p $ports -sC -sV $IP -oA deep

Run this against every new box and you will never miss a port again.

Practice

• Scan Metasploitable 2 and list every service with a known public exploit.
• On TryHackMe, complete the free Nmap room.
• Compare your results with -sV turned off. Notice how much less you know.