Nmap For Penetration Testing: Beginner To Advanced

Explain what ports are, how they host services on a device identified by an IP address, and how Nmap scans ports to reveal open or closed states using common ports.

Explore the OSI model and its seven layers—from physical to application—and see how TCP, UDP, and IP packets flow through each layer to enable networked communication.

Explore the network layer's role in routing packets and examine ipv4 header fields such as source and destination addresses, ttl, and protocol, using Wireshark during an Nmap scan.

Explore the transport layer, comparing TCP and UDP, including end-to-end connections, TCP three-way handshake, and TCP header fields like source and destination ports, with practical Wireshark and Nmap examples.

Explore tcp header flags and the tcp three-way handshake, then observe how nmap and wireshark reveal syn, syn-ack, and ack exchanges to determine open ports, operating systems, and service versions.

Master host discovery with Nmap, performing ping sweeps and don't ping scans to map all devices in a network, while excluding or targeting specific IPs using input files.

Learn how tcp syn ping enables host discovery with Nmap, identifying open ports via syn-ack responses and resets, and why tcp ack and udp tests bypass icmp blocks.

Learn to perform tcp ack ping scans with nmap to discover online hosts by sending an ack packet, bypassing some firewalls and ids, without port scanning.

Perform a udp ping scan with nmap to detect online hosts when icmp or tcp probes are blocked, by sending an empty udp packet and reading icmp port unreachable responses.

Explore arp ping with nmap for host discovery on local networks, using arp requests to map ip addresses to mac addresses and identify live devices without firewall blocks.

Explore ICMP echo ping and ICMP timestamp ping in Nmap for host discovery and firewall bypass attempts, then proceed to port discovery using SYN and SYN-ACK responses.

Explore how the IP protocol ping performs host discovery by selecting ICMP, IGMP, or IP in IP; learn to run ICMP echo requests and interpret responses.

Trace the route to targets with traceroute to reveal each hop and potential firewall or proxy filters. Resolve IPs to domains with reverse DNS to map hosts during Nmap scans.

Set up a lab with Metasploitable 2 and Metasploitable 3 using VirtualBox, enabling bridged networking, then perform advanced port scanning and enumeration with Nmap scripts on Linux and Windows targets.

Explore how the default Nmap scan operates, including reverse DNS resolution and the 1000 most common ports. Interpret port states: open, closed, and filtered, and identify running services.

Explore scanning specific port ranges with Nmap by using the port option to target single ports, ranges, or all 65,535 ports, and read open or closed states.

Explore the TCP connect scan, which completes a three-way handshake to determine open or closed ports using syn, synack, and ack. It is slow but accurate and requires no privileges.

Explore the stealth syn scan in nmap, run with -sS, which sends a syn packet and does not complete the TCP three-way handshake, offering faster, stealthier scans.

Detect operating systems and service versions with Nmap, using stealth scans and operating system detection across all ports on Metasploitable targets to enable vulnerability analysis.

Discover how the aggressive scan, though noisy, combines OS detection, service version detection, and script scanning to reveal rich target details across FTP, HTTP, and more.

Perform a UDP scan with Nmap by sending UDP packets and interpreting no response as open, or ICMP port unreachable as closed, with optional OS and service version detection.

Learn how the reason option reveals why Nmap marks hosts up and ports open, using ARP responses and SYN/ACK results for diagnostic insight.

Perform the Nmap fast scan to quickly view the top 100 most common ports and their open statuses. Pair it with service version detection to identify running services and versions.

Learn how to use Nmap for output, logging, and verbosity, exporting results in text, XML, and grippable formats, and interpreting on-screen versus file-based details.

Explore inverse tcp flag scanning with fin, null, and Xma scan using Nmap, learning how non-handshake packets reveal open, closed, or online hosts while evading firewalls.

Discover Webmap, a web dashboard for nmap xml reports, to run scans, view saved results, and generate concise pdf reports for penetration tests. Learn docker setup and token-based access.

Detect firewalls with ACK probes using Nmap, compare results with Windows firewall on and off, and learn how probe responses reveal filtered versus unfiltered ports.

Learn how nmap fragmentation evades firewalls by splitting packets into eight-byte segments and reassembling at the target, shown with wireshark on a metasploitable 3 VM; the technique is aging.

Explore evading firewalls by setting a custom MTU in Nmap, testing fragmentation multiples of eight, and using Wireshark to observe results, run aggressive scans to reveal ports and service versions.

discover how to use nmap's decoy option to spoof IPs for firewall evasion, with random or user-specified decoys, demonstrated against a Windows box using syn scans.

Learn how to spoof your MAC address for pentesting local networks, using Nmap to run scans with a spoofed or vendor-specific MAC, including random options.

Explore Nmap timing templates from paranoid to insane, showing how to balance scan speed and stealth by choosing T0–T5, with examples of T1, T3, T4, and T5 for optimized scans.

Master host timeout in Nmap to skip unresponsive devices during large network scans, improving host discovery and scan speed while exploring port ranges and ping-agnostic options.

Use scan delay to space out probes, evading firewalls, intrusion detection systems, and network admins, demonstrated with a syn stealth scan on ports 1–100 and 10-second delays.

Explore the Nmap scripting engine and its Lua-based scripts to automate network discovery, service enumeration, and vulnerability analysis, including backdoor detection and exploitation, with hands-on guidance.

Learn to run Nmap scripts with the scripting engine, update script databases, and perform targeted service enumeration (FTP, Vsftpd backdoor, anonymous login) using single, multiple, and wildcard scripts.

Explore how Nmap script categories organize enumeration, from the default category to the aggressive scan. Learn to run specific categories, like auth or intrusive, for targeted service discovery.

Use banner grabbing with nmap to identify service versions and operating system banners on open ports, leveraging the banner script for vulnerability analysis in a Metasploitable 2 setup.

Explore passive information gathering with nmap by running whois domain and whois ip scripts, and trace routes with geolocation to reveal domain details and hop paths.

Enumerate FTP services with the Nmap scripting engine, testing anonymous login, service versions, and backdoors such as pro ftp and vsftpd on Windows and Linux targets, Metasploitable two and three.

Master smtp enumeration with nmap to reveal user accounts and identify open relays on port 25. Use smtp commands and smtp enum users with verify and expn methods.

Learn to perform DNS enumeration with Nmap using zone transfer and DNS brute scripts, exploring zone transfer permissions, word lists from sick lists, and script arguments for domain specific queries.

Enumerate web servers with Nmap using the http methods script to identify active methods and capabilities, such as get, post, head, and options, and assess potential impact without exploitation.

Utilize the Nmap scripting engine's http enum to uncover hidden files and directories on a web server, with service version detection on a Metasploitable 2 target.

Master web application firewall detection and fingerprinting with Nmap scripts, using http waf detect and http fingerprint to identify filters like Cloudflare.

Learn to enumerate SMB with the Nmap scripting engine to discover operating systems, shares, and potential vulnerabilities such as EternalBlue and DoublePulsar across Windows hosts.

Enumerate a MySQL server with Nmap scripts, inspect MySQL info and enum results, test for empty passwords, and perform a brute-force attack on Metasploitable 2 target, using phpMyAdmin as needed.

Conduct vulnerability scanning with Nmap using Vollmer's script to enumerate vulnerabilities by banner and service version, view CVEs and severities, and filter results by a minimum CVSS rating.