Introduction
In the world of cybersecurity, Nmap (Network Mapper) is one of the most powerful tools for network scanning, reconnaissance, and vulnerability testing. Whether you are a penetration tester, system administrator, or ethical hacker, understanding how to use Nmap efficiently is crucial.
In this guide, we will walk through the essential Nmap commands to check open ports, detect running services, and perform vulnerability assessments on remote servers.
1️) Installing Nmap
Before using Nmap, let’s ensure it is installed. Run the following command to check:
nmap --versionIf it’s not installed, you can install it with:
- Debian/Ubuntu:
sudo apt install nmap -y - RHEL/CentOS:
sudo yum install nmap -y - macOS:
brew install nmap - Windows: Download from Nmap.org
2) Basic Nmap Scans
🔹 Scan a Single Host
nmap <target-ip>Example:
nmap 192.168.1.1🔹 Scan Multiple Hosts
nmap 192.168.1.1-50🔹 Scan an Entire Subnet
nmap 192.168.1.0/243) Checking Open Ports
🔹 Scan Common Ports (Top 1,000 Most Used)
nmap -F <target-ip>🔹 Scan All 65,535 Ports
nmap -p- <target-ip>🔹 Scan Specific Ports
nmap -p 22,80,443 <target-ip>4) Service & Version Detection
🔹 Find Running Services & Versions
nmap -sV <target-ip>Example output:
PORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 8.280/tcp open http Apache httpd 2.4.41
🔹 Detect OS Information
nmap -O <target-ip>5) Scanning for Vulnerabilities
🔹 Check for Common Vulnerabilities
nmap --script=vuln <target-ip>Example:
nmap --script=vuln 192.168.1.10🔹 Check for SMB Vulnerabilities (e.g., EternalBlue)
nmap --script smb-vuln-ms17-010 -p445 <target-ip>🔹 Check for Heartbleed (OpenSSL Bug)
nmap --script ssl-heartbleed -p 443 <target-ip>🔹 Check for Web Server Vulnerabilities
nmap --script=http-vuln-cve2017-5638 -p 80 <target-ip>(Replace with other CVE-specific scripts as needed.)
6) Advanced Nmap Scans
🔹 Aggressive Scan (More Detailed Information)
nmap -A <target-ip>🔹 This includes OS detection, service detection, script scanning, and traceroute.
🔹 Scan a Website Without DNS Lookup
nmap -Pn example.com🔹 Find Hidden Files & Directories (Like Dirb or Gobuster)
nmap --script=http-enum -p80,443 <target-ip>7) Saving Scan Results
🔹 Save Output to a Text File
nmap -oN scan-results.txt <target-ip>🔹 Save in a Greppable Format
nmap -oG scan-results.txt <target-ip>🔹 Save in XML Format
nmap -oX scan-results.xml <target-ip>Best Alternative Tools for Vulnerability Scanning
While Nmap is great for initial scanning, there are other tools specialized for in-depth vulnerability assessment:
✅ Nikto → Web server vulnerabilities (nikto -h <target-ip>)
✅ OpenVAS → Full security assessment
✅ Metasploit → Exploitation and penetration testing
✅ Burp Suite → Web security testing
✅ ZAP (OWASP) → Web application security
Ethical and Legal Considerations
- 🚨 Scanning remote servers without permission is illegal. Always obtain explicit authorization before testing.
- 🛡️ Use Nmap in a controlled environment or on your own infrastructure.
- 🔐 Follow your organization’s security policies to avoid legal issues.
Conclusion
Nmap is a must-know tool for anyone in cybersecurity. Whether you’re scanning for open ports, detecting services, or searching for vulnerabilities, Nmap provides powerful features to strengthen network security.
By combining Nmap scans with other security tools, you can perform in-depth security assessments and harden your network against attacks.
Want an automated script for vulnerability scanning? Stay tuned for our upcoming post on writing a Bash script for automated Nmap scanning!