Hack Forums
A Beginners Guide to Scanning with nmap - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: A Beginners Guide to Scanning with nmap (/showthread.php?tid=6247548)

Pages: Pages 1 2

A Beginners Guide to Scanning with nmap - VKNS - Jul 24, 2023

Polite Notice
Please do not try this on targets without the owner's permission. Even though you're technically not attacking anything, this can still get you dismissed from employment, sued or in hot water with your ISP.

[Image: 1*NqeovuV6RWG0-iK5yZYv6g.png]

Hey HF! 🖐️

Today, I want to share with you a beginner-friendly guide on how to use nmap - a powerful and versatile network scanning tool. Whether you're a cybersecurity enthusiast, a system administrator, or just someone curious about network security, nmap can be an invaluable asset in your toolkit.

What is nmap?
NMAP stands for Network Mapper. It is a free, open-source tool that lets you explore networks and do security audits. It figures out what hosts and services are running on a computer network, kind of like drawing a map of the network's layout.

[Image: aEPQypK.png]
Before we delve into nmap's features, let's get it up and running on your system. Here's how to install nmap on different platforms:

[Image: IKkB8sI.png]

Download the installer from the official nmap website and run it like any other Windows application.

Fairly self-explanatory, but if you need to be guided through the installer, I have included screenshots here: (Click to View)

[Image: 0ix9JKN.png]

You can use Homebrew or MacPorts package managers to install nmap easily. Open your Terminal and type:

Code
brew install nmap

Alternatively, you can follow the guide here: (Click to View)

[Image: 5WsRiy1.png]

Most Linux distributions have nmap in their default package repositories. Simply use your package manager (apt, yum, dnf, etc.) to install it:

Code
sudo apt install nmap

If you're running a distribution that doesn't have a package manager, you'll need to figure out how to install this yourself. This is an nmap tutorial, not a linux tutorial.

[Image: F8GAG3A.png]

Once you have nmap installed, using it is quite straightforward. Open your terminal or command prompt and type:

Code
nmap <target>

Replace <target> with the IP address or hostname of the device or network you want to scan. Nmap will start scanning and provide you with valuable information:

[Image: MRUezpT.jpg]

Breaking down the screenshot above:
  • PORT (<port>/<protocol>): This column shows the port and protocol that nmap has discovered.
  • STATE: This column shows (you guessed it!) the state of the port.
    • open - An application on your target is listening for/accepting TCP/UDP/SCTP connections on this port. This is what you're looking for.
    • closed - A closed port is accessible, which means it receives and responds to packets; but there is no application or service running on this port.
  • SERVICE - Shows the service or application accepting connections on this port.

Note: There are other states for ports, which you can read about here.

Common ways to scan
Nmap offers several scanning techniques to gather specific information about hosts and services. Some of the most commonly used options include:

Basic TCP Scan: This is the default scan and checks the top 1000 TCP ports on the target.
nmap target

UDP Scan: Use this if you suspect there are open UDP ports on the target system.
nmap -sU target

Operating System Detection: Nmap can try to determine the operating system of the target.
nmap -O target

Version Detection: This option allows nmap to attempt to determine the version of services running on open ports.
nmap -sV target

Saving Output
Nmap can generate extensive output, so it's often helpful to save it for later analysis. To save the results to a file, use the following:
nmap -oN scan_results.txt target

[Image: t08w3Ru.png]

Lucky for us, nmap now comes with the Nmap Scripting Engine (NSE), which lets us run LUA scripts alongside a regular nmap scan.

We're given a ton of scripts to play with, but the most popular one for finding vulnerabilities in services is ported with nmap and usually requires no extra installation steps:

vulners.nse

Once you've had a quick look at your target and verified that there are open ports to scan for vulns, run the following command, replacing <target> with your target hostname or IP Address:

Code
nmap -sV --script vulners <target>

If you're lucky, you'll get something back that looks like this:

[Image: 3ZHzoBg.jpg]

This is showing us that Port 80 is running a service called lighttpd, version 1.4.59. Under that, it shows a small list of CVEs with links to the vulners database; explaining the vulnerabilities in detail. The numbers you see (5.0, 4.3, 0.0) are the severity of the vulnerability; with a higher number meaning more severe.

Make note of the CVEs listed in this search. In my example, We have the following:
  • CVE-2022-41556
  • CVE-2022-22707
  • CVE-2022-41556

These CVEs are used across several vulnerability databases. Just googling the CVE will return thousands of results on most vulnerabilities. Using CVE-2022-41556 as an example, I searched google and found the following page on the Vulnerability:

[Image: jKR7pro.jpg]

The page shares various information on the vulnerability, including the following:
  • An Overview of the vulnerability.
  • Attack complexity.
  • Attack Vector.
  • Privileges Required.
  • How to fix/patch the vulnerability.


Thanks for reading. I hope you've learned something; I certainly learned a few things writing this post.

All the best.

RE: Beginners Guide to nmap - HunT3R09 - Jul 24, 2023

This will get the feet wet , Thanks for the great share keep the good work up.

RE: Beginners Guide to nmap - Bastille - Jul 25, 2023

Nice thread buddy, really easy to read with all images that separates the different parts, thanks for the share !

RE: Beginners Guide to nmap - Ezocain - Jul 25, 2023

Great introduction to nmap, an essential tool for any hacker and researcher.

It’s incredible what you’ll learn just from writing a beginners guide on something you already knew. At least when it’s as well written and properly done like this one.

Inspired me to do the same, but what intrigued me most is the NSE, a part of nmap I haven’t really taken a good look at.

Good work!

RE: Beginners Guide to nmap - shifumaster - Jul 25, 2023

thanks dude appreciate it

RE: A Beginners Guide to Scanning with nmap - Rezcal - Jul 27, 2023

Thanks my man, really appreciate this

RE: A Beginners Guide to Scanning with nmap - TheMiddleMan - Aug 8, 2023

This was a very helpful guide to using nmap thank you so much for posting this thread and taking the time to do so it’s helped me get a better understanding on how to use nmap at first it looked daunting and I didn’t really know why one uses it specifically but it’s definitely got me considering nmap as my main mapping tool for potential security assistance jobs

RE: A Beginners Guide to Scanning with nmap - plextrax123 - Aug 25, 2023

thank you so much I've been looking for nmap guide 😁

RE: A Beginners Guide to Scanning with nmap - lolipop32 - Aug 26, 2023

Pretty straight forward.

RE: A Beginners Guide to Scanning with nmap - zadig767 - Aug 26, 2023

thank you for this guide

RE: A Beginners Guide to Scanning with nmap - JamesChoe - Aug 27, 2023

Nice thread very detailed thanks buddy

RE: A Beginners Guide to Scanning with nmap - Alien8ed - Dec 14, 2024

Excellent thread my friend.
It is a very good summary of the first steps with this tool.

RE: A Beginners Guide to Scanning with nmap - member13415 - Dec 18, 2024

thanks so much very helpful

RE: A Beginners Guide to Scanning with nmap - man_its_a_hot_one - Dec 21, 2024

This is excellent for beginners, great job dude. For anyone interested in learning more you could always buy the nmap network scanning book from Amazon which I'm pretty sure is actually written by the person who invented/coded the nmap port scanner.

RE: A Beginners Guide to Scanning with nmap - sadmin - Jan 10, 2025

thanks man, i'm new to nmap so this helped alot