Nmap for Ethical Hacking

Install the latest eve-ng community edition (6.204) on VMware Workstation Pro by downloading the iso from eve-ng.net and configuring an ubuntu VM with adequate resources, then access via browser.

Upload and configure switch images in eve-ng using winSCP: download, extract with seven zip, verify license and naming, apply permissions, set icons, and start devices for lab use.

Upload and arrange the required images for an eve-ng lab, including Fortigate firewall, Kali Linux, Metasploitable, PHP auction, buggy web app, Ubuntu desktop, and Windows 11.

Build and explore a complete nmap lab topology using a Fortigate firewall, vulnerable web servers, and Metasploitable targets, with Kali, Ubuntu, and Windows machines scanned via nmap.

Export and import a ready-made nmap lab into ifeng or eve-ng, stop all nodes, save and download the lab, import from desktop, and adjust the management subnet before starting.

Configure static IP addresses for three lab servers (192.168.1.1, .2, .3) with gateway 192.168.1.254 and DNS 8.8.8.8 and 1.1.1.1; disable DHCP, reboot, and adjust keyboard on buggy web.

Configure external devices—Windows 11, Ubuntu, and Kali Linux—with static IPv4 addresses (10.0.1.1–10.0.1.3), gateway 10.0.1.254, and DNS 8.8.8.8 / 1.1.1.1, then verify connectivity.

Configure a Fortigate firewall in a lab: set up management, LAN, and WAN interfaces, DNS, static routes, and security policies to enable internet access and test connectivity.

Install Nmap and its graphical interface Zenmap across Windows, macOS, and Linux flavors, using apt, dnf, yum, pkg, or manual dmg methods, with platform-specific steps.

Install nmap on Windows by downloading the latest stable release from nmap.org, then install Npcap and Zenmap for a graphical user interface. Verify the installation with nmap -version.

install nmap on Ubuntu via apt update and apt install, verify with nmap version, and scan 192.168.1.3; then install Zenmap GUI by converting the rpm to deb with dpkg.

Install Zenmap on Kali Linux by updating apt, downloading the rpm, converting it to deb with dpkg, installing dependencies, and launching the Zenmap graphical interface for quick scans.

Learn zenmap, the official graphical interface for nmap, with predefined and custom scan profiles, easy target entry, and options to save scans and compare results.

Explore the nmap command structure, including the main command, scan types, options, and targets, with examples of verbose, version detection, operating system detection, port ranges, and saving results.

Perform a default Nmap scan to quickly discover alive hosts, scan the top 1000 tcp ports, and guess basic services, delivering a fast, safe reconnaissance report with open ports.

Explore the variety of nmap scan types, from tcp syn and connect to udp, ping, null, Xmas, window, idle, and ip protocol scans, and learn their purposes and stealth considerations.

Explore ping sweeps and host discovery scans to identify live hosts without port scanning, using icmp echo requests and tcp syn/ack checks.

Explore host discovery techniques in nmap, including ARP ping, ICMP echo and timestamp pings, TCP and UDP pings, and IP protocol pings, to determine which targets are up.

Perform a ping sweep with nmap -sn to identify live hosts via icmp echo; read ip lists from a file and exclude targets.

Use tcp syn ping for host discovery when icmp is blocked, using nmap with ports, ranges, excludes, and IP list files to identify up hosts and responsive ports.

Discover how to use Nmap tcp ack ping for host discovery when icmp is blocked, by sending tcp acknowledgement probes to ports and subnets.

Learn how to use UDP ping with nmap for host discovery when ICMP is blocked, using UDP probes on targets, subnets, and specific ports.

Use ARP ping in Nmap to reveal which devices on a local subnet are up, by sending ARP requests and optionally excluding IPs or reading from an IP list.

Use icmp echo request ping to discover devices by sending echo requests and noting replies to determine if a host is up; results depend on icmp allowed by the firewall.

Learn how to use nmap with icmp timestamp ping to discover hosts, test firewall rules, and scan subnets, including excluding specific IPs or an IP list file.

Explore address mask ping with icmp in nmap to determine if hosts are up, and scan single or multiple IPs, subnets, ranges, or read IP lists from a file.

Use the sctp ping method in nmap to discover live hosts by sending http init probes. Apply it to single addresses, ranges, or entire subnets, with icmp behavior and exclusions.

Learn to use nmap for host discovery with IP protocol ping, testing ICMP, TCP, IGMP, and other protocols to determine if devices are up, including subnet and file inputs.

Examine how TCP connect scan uses the TCP three-way handshake to determine open, closed, or filtered ports, with Nmap interpreting SYN, ACK, reset, and no response.

Perform a tcp connect scan with nmap on Kali Linux, Ubuntu, and Windows 11 to identify open, closed, and filtered ports on Metasploitable 2, using Wireshark to observe the handshake.

Explains how Nmap's TCP SYN (half-open) scan sends a SYN and uses reset to avoid completing the three-way handshake, producing a stealthy scan that reveals open, closed, or filtered ports.

Conduct a tcp syn scan lab in Kali Linux with nmap, observe open, closed, and filtered ports, and scan single IPs and subnets with options.

Use Nmap's tcp ack scan to map firewall rules and classify ports as filtered or unfiltered, not open or closed. Target stateless firewalls using acknowledgement traffic.

Run an nmap tcp ack scan (-sA) to reveal firewall behavior by distinguishing open, closed, and filtered ports. The lab covers single IP scans, subnet scans, and saving results.

Explore how tcp fin scans use the fin flag with Nmap to infer open, closed, or filtered ports, showing stealthy reconnaissance through no response, reset, or icmp unreachable signals.

Perform TCP fin scans with nmap in a kali lab to identify open, filter, and closed ports, interpret no response, and scan multiple IPs and subnets.

Explore how TCP null scan uses a TCP packet with no flags to probe ports, revealing open, closed, or filtered statuses.

Explore the tcp null scan, using no tcp flags to reveal open, closed, or filtered ports in a lab with Kali Linux and Nmap, verified with Wireshark against 192.168.1.3.

Explain how the xmas scan uses fin, push, and urg flags in tcp header. Describe how reset, no response, and icmp unreachable indicate open, closed, or filtered port status.

Demonstrates an nmap tcp Xmas scan in a lab across Windows, Ubuntu, and Kali Linux, highlighting fin, push, and urg flags and port state interpretations.

Learn how the tcp maimon scan sends an acknowledgement, uses a reset to mark a closed port, and notes that absence means open or filtered while icmp unreachable signals filtered.

Demonstrate tcp maimon scan with nmap -sM in a lab, observe tcp flags and port states in wireshark, and interpret open, filtered, and closed results across hosts.

Understand how TCP window scan works in Nmap to infer open, closed, or filtered ports via reset packets and non-zero or zero window sizes, or ICMP unreachable signals.

Explore tcp window scanning with nmap -sW, verifying open or closed ports by analyzing tcp window size in responses, and learn lab setup with Kali, Ubuntu, and Windows environments.

Learn UDP scanning with nmap, contrasting it with TCP's connection-oriented approach. See how UDP probes and ICMP replies indicate open, closed, or filtered ports, including DNS, SNMP, DHCP, and TFTP.

Perform a practical UDP scan with nmap on Kali Linux, observe UDP traffic in Wireshark, and classify ports as open, closed, or filtered using ICMP insights.

Explore how idle scan uses a zombie to probe a target without direct contact, exploiting IP id changes to infer open or closed ports.

Learn how to perform an idle scan using a zombie host with ip id sequence, using nmap in a three-machine lab to identify open top ports on the target.

Learn how Nmap performs OS detection and service detection by sending probes and analyzing responses against the OS fingerprint database to identify operating systems and running services with versions.

Perform OS and service detection in a lab with nmap across Windows and Linux devices, using -O, -sV, -A, and aggressive scans to reveal operating systems, services, versions, and vulnerabilities.

Explore Nmap port states and six categories—open, closed, filter, unfiltered, open filter, close filter—showing how ports respond to scans, influenced by scan type and firewall, IPS, and IDS.

Explore nmap port states through a hands-on lab, verifying open, closed, filtered, unfiltered, and open/close filter states using Windows 11 OpenSSH and Kali Linux with various scans.

Explore aggressive scanning in Nmap by enabling OS detection, version detection, service detection, script scanning, traceroute, and timing templates in one command—noisy, but suitable for authorized penetration testing.

Execute an aggressive scan with nmap in a lab to reveal open ports, service versions, and the target operating system. Learn to use verbose and time template and save results.

No-ping scanning bypasses host discovery, allowing Nmap to scan targets even when ICMP echo requests and TCP probes are blocked, useful for protected networks with ping disabled.

Demonstrate no ping scanning with Nmap to detect a host's status when ICMP is blocked, using TCP probes (port 443) and the -Pn option to reveal open ports.

Explore how nmap timing templates control scan speed, stealth, and accuracy, from paranoid to insane, including the default T3 and use cases for IDs, firewalls, and low-impact scans.

Explore Nmap timing templates from T0 to T5 in a hands-on lab across Kali, Ubuntu, and Windows targets. Learn to optimize scans, use verbose output, and tailor ports.

Explore the nmap scripting engine (NSC) and its 600+ built-in scripts that automate port scanning, security analysis, and vulnerability detection and exploitation.

Update the nmap script database, browse the /usr/share/nmap/script directory of about 610 scripts, search with grep, and run scripts by category or port.

Learn to run the nmap default script for safe, fast basic information gathering: OS version, service detection, application versions, http title, server header, and ftp/ssh details.

Use the Nmap scripting engine with the ftp anonymous script to detect anonymous ftp login on port 21 and reveal server vulnerability.

Use the nmap scripting engine http enumerate to scan port 80 and reveal potentially interesting directories such as phpmyadmin, phpinfo, and doc, exposing sensitive information.

Explore how to use the nmap scripting engine to enumerate http methods (get, head, post, options, trace) on target servers, revealing supported methods for security assessment.

Explore using the nmap scripting engine and the banner script to identify running services and their versions, such as FTP Vsftpd and OpenSSH, across ports.

Demonstrates using the nmap scripting engine to brute-force ssh against a metasploitable target and reveals the user user credentials enabling a successful ssh login.

Discover how nmap enables firewall evasion techniques to reveal system details, including tcp x scan, fragmentation, decoy scans, ip spoofing, idle scans, and timing templates.

Perform a tcp ack scan lab to study firewall evasion, using Nmap with an X scan; observe no response when on and unfiltered ports when off, verified by Wireshark.

Explore decoy scans with nmap to bypass firewalls by spoofing multiple decoy IPs, including random ones, capture traffic with Wireshark on Kali Linux, and compare send vs TCP connect scans.

Learn how to use nmap to spoof mac addresses and bypass a mac-based firewall policy, with hands-on lab demonstrations of testing various scans and spoofing options.

Demonstrates firewall evasion via source IP spoofing in a hands-on lab with Kali Linux and Ubuntu, showing how to block traffic and reach the target using a spoofed source.

Explore firewall evasion with source port spoofing in a lab using Ubuntu and Kali, leveraging nmap scans to bypass blocked ports by spoofing allowed ports like 22 and 1337.

Explore packet fragmentation as a firewall evasion technique in nmap ethical hacking, including a Kali Linux lab demonstrating fragmentation to confuse IDS/IPS.

Explore how nmap uses mtu size fragmentation to bypass basic firewall filters by sending fragmented 8–16 byte packets in a Kali Linux lab, observing fragmented IP protocol.

Explore Nmap timing templates, especially timing paranoid, to slow scans and evade firewalls, IPS, and IDS. The lab demonstrates using selective ports and verbose output on Kali Linux with Wireshark.

Learn to use Nmap's randomize targeting to scan multiple hosts in a subnet, evading firewalls and intrusion detection systems by delivering traffic in a non sequential randomized order.