Unlocking Nmap: The Ultimate Guide to Network Scanning

Learn the OSI model from physical to application layers, focusing on data flow, IP and MAC addresses, ICMP, TCP, and UDP, and how packets traverse network layers.

Discover tcp at layer 4, focusing on headers and flags such as syn, ack, fin, and psh, plus source and destination ports, and how the three-way handshake establishes a connection.

Explore the TCP three-way handshake: a client sends a SYN, the server replies with a SYN-ACK, and the client sends an ACK to establish a connection, using Wireshark and Nmap.

Explore UDP, the User Datagram Protocol, a connectionless protocol that sends data without retransmission. It suits real-time needs like voice over IP, live streaming, and real-time chat, tolerating packet loss.

Obtain explicit written permission before scanning any system, ensure you own it or have the owner's authorization, and check the legality of nmap and port scans in your jurisdiction.

Build a hands-on hacking lab with VirtualBox, Kali Linux, and metasploitable, configure host-only networking for inter-VM communication, and begin reconnaissance with arp-scan and system updates.

open a terminal, locate the metasploitable host with arp-scan -l, then run nmap on its IP to scan the top 1000 ports and reveal open services.

Discover how the -sn ping scan enables host discovery in Nmap, why it precedes a port scan, and how to run a quick -sn scan to identify active hosts.

Disable the ping scan option and perform a port scan with nmap using -Pn. Treat all hosts as online and skip host discovery to scan the top thousand ports.

Explore how the Nmap -sS SYN scan sends a SYN and resets after a SYN-ACK, revealing open versus closed ports without completing the TCP three-way handshake.

Learn how the Nmap -sT flag performs the full TCP three-way handshake to identify open ports, with Wireshark visualization, noting its accuracy and logging.

Perform an nmap scan of all 65,535 ports with the -p- flag to enumerate open ports on a Metasploitable system, noting 13 open and the noisy output.

Learn how to use nmap to detect operating system versions (-O) and identify service versions (-sV) to enumerate target systems and spot vulnerable services.

Explore the Nmap -A aggressive scan to perform OS and service version detection, script scans, and trace routes in one command, yielding richer enumeration than individual flags.

Learn to run a UDP scan with Nmap using -sU against ports like 53 and 161 to identify open versus closed UDP services, and understand destination unreachable signals.

Explore Nmap timing templates from -T0 to -T5 and how slower scans increase stealth. Use -T4 or -T3 for fast, accurate results; avoid -T5 due to noise and missed ports.

Explore nmap flags to bypass security systems like ids, firewalls, and intrusion prevention systems. Begin with ip fragmentation as the first lesson.

Explore how the nmap -f flag fragments ip packets and reassembles them at the destination, illustrating ip fragmentation's role in bypassing some security measures during port scans.

Explore how to set the MTU in Nmap to fragment packets and bypass firewalls and intrusion detection systems, using --mtu to control fragmentation and compare with -f.

Learn to use decoys in Nmap to spoof the scan source with -D and -D RND, then combine with a SYN scan to confuse logs and hide the origin.

Learn how the Nmap Scripting Engine in Kali Linux uses pre installed scripts to detect vulnerabilities, enumerate services, test FTP anonymous logins, and identify issues from WordPress to SQL injections.

Explore the Kali Linux Nmap scripting engine categories such as authentication, brute force, intrusive, version, and vuln, and learn how -sC runs default scripts against a host.

Use the ftp-anon.nse script from the nmap scripting engine with nmap to test anonymous ftp login on a Metasploitable host, confirming port 21 is open and anonymous login is allowed.

Learn to detect an FTP backdoor on a remote host by using nmap scripts and grep for backdoor indicators, then review CVE-2011-2523 references and exploitation with Metasploit for ethical hacking.

Discover how to optimize nmap port scanning by ordering scans with -r, focusing on the top ports with -F or --top-ports, and quickly identifying open services on target hosts.

Explore nmap's tcp null (-sN), fin (-sF), and christmas (-sX) scans, observe tcp flags in Wireshark captures, and note open-filtered results and security bypass implications.

Learn to save nmap scan results in multiple formats using -oN, -oX, -oG, and -oA, producing normal (.nmap), XML, and grepable (.gnmap) outputs for quick grep and review.

Explore Zenmap, the GUI for Nmap, learn installation and the differences between Zenmap and Nmap, and run targeted scans against a metasploitable machine.

Explore WebMap, a web dashboard that stores Nmap outputs and lets you initiate scans from the browser, using Docker on port 8000 to scan scanme.nmap.org.