Nmap Network Scanning Tutorial: Complete Practical Guide

Module 2 – Network Scanning & Enumeration

Complete Practical Tutorial (Core Module)

This is the heart of the entire course.

If Information Gathering tells you what exists, Network Scanning tells you what is open, what is running, and what is vulnerable.

Nmap is the single most important tool you will use in your cybersecurity career. Master it deeply.

Step 0: Prepare Your Workspace

bash
1mkdir -p ~/scans/target/{nmap,masscan,services,notes}
2cd ~/scans/target

Always save outputs properly using -oA or tee.

1. Host Discovery (Find Live Machines)

Before scanning ports, find which hosts are alive.

bash
1# Basic ping sweep
2nmap -sn 192.168.1.0/24 -oA nmap/host-discovery
3
4# More aggressive discovery (recommended)
5nmap -sn -PE -PP -PS80,443,22,21,25 -PU53,161 192.168.1.0/24 -oA nmap/alive-hosts

Practical Example:

bash
1nmap -sn 192.168.1.0/24 | grep "Nmap scan report" | tee nmap/live-hosts.txt

Pro Tip: On large networks, combine with Masscan for speed.

2. Mastering Nmap Port Scanning

Most Used Nmap Commands

bash
1# Stealth SYN scan + Version detection + Default scripts + OS detection (Best all-rounder)
2nmap -sS -sV -sC -O -p- -T4 target.com -oA nmap/fullscan
3
4# Fast top 1000 ports
5nmap -sS -sV -sC -T4 target.com -oA nmap/top1000
6
7# Scan specific ports
8nmap -sS -sV -p 21,22,80,443,3306,8080 target.com
9
10# UDP scan (slower but important)
11nmap -sU --top-ports 100 target.com -oA nmap/udp

Timing Templates (Very Important)

-T1 → Extremely slow (IDS evasion)
-T2 → Slow
-T3 → Normal (default)
-T4 → Aggressive (recommended for labs)
-T5 → Insane (very noisy)

3. Nmap Scripting Engine (NSE) – The Real Power

bash
1# Vulnerability scan
2nmap --script=vuln -sV target.com -oA nmap/vuln-scan
3
4# Safe default scripts
5nmap -sC -sV target.com
6
7# Specific useful scripts
8nmap --script=http-enum,http-title,http-headers -p 80,443 target.com
9nmap --script=ssl-enum-ciphers -p 443 target.com
10nmap --script=smb-enum-shares,smb-enum-users -p 445 target.com
11nmap --script=ftp-anon -p 21 target.com
12nmap --script=dns-zone-transfer -p 53 target.com

Useful Script Categories:

auth
brute
default
discovery
exploit
vuln

4. Speed Boosters (When Nmap is Too Slow)

Masscan (Extremely Fast)

bash
1# Scan all ports very fast
2masscan -p1-65535 192.168.1.0/24 --rate=10000 -oL masscan/all-ports.txt
3
4# Then feed open ports to Nmap for version detection
5nmap -sS -sV -sC -p $(cat masscan/all-ports.txt | grep open | cut -d " " -f3 | tr "\n" ",") target.com

RustScan (Modern & Very Fast)

bash
1rustscan -a target.com -- -sV -sC -oA nmap/rustscan

5. Service Enumeration (After Finding Open Ports)

SMB (Port 445)

bash
1enum4linux -a target.com | tee services/smb-enum4linux.txt
2smbmap -H target.com
3crackmapexec smb target.com --shares
4crackmapexec smb target.com -u '' -p '' --shares

SNMP (Port 161/UDP)

bash
1snmpwalk -c public -v2c target.com | tee services/snmp.txt
2onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt target.com

DNS (Port 53)

bash
1dnsenum target.com | tee services/dnsenum.txt
2dig axfr @ns1.target.com target.com

Other Useful Commands

bash
1# FTP
2nmap --script=ftp-anon,ftp-bounce -p 21 target.com
3
4# HTTP
5whatweb target.com
6nikto -h http://target.com

Powerful All-in-One Scanning Script

Save this as scan.sh:

bash
1#!/bin/bash
2
3target=$1
4mkdir -p scans/$target/{nmap,services}
5
6echo "[+] Starting full scan on $target"
7
8# Host discovery + Full TCP scan
9nmap -sS -sV -sC -O -p- -T4 $target -oA scans/$target/nmap/fullscan
10
11# Vulnerability scripts
12nmap --script=vuln -sV $target -oA scans/$target/nmap/vuln
13
14# Common web ports deep scan
15nmap -sV -sC -p 80,443,8080,8443 --script=http-enum,http-title,ssl-enum-ciphers $target -oA scans/$target/nmap/web
16
17echo "[+] Scan completed! Results saved in scans/$target/"

Usage:

bash
1chmod +x scan.sh
2./scan.sh 192.168.1.10

Recommended Scanning Workflow

Host discovery (nmap -sn)
Fast port discovery with Masscan or RustScan
Full Nmap scan with -sS -sV -sC -O -p-
Run vulnerability scripts (--script=vuln)
Deep service enumeration on interesting ports
Save everything and take notes

Practice Lab (Do This Now)

Scan your own localhost:
nmap -sV -sC 127.0.0.1
Perform a full port scan on a lab machine (Metasploitable or your own VM).
Run the vulnerability scripts.
Enumerate SMB if port 445 is open.
Create a clean report of open ports + services + possible vulnerabilities.

Pro Tips

Always use -oA so you get .nmap, .xml, and .gnmap files.
Convert XML to HTML for nice reports:
xsltproc fullscan.xml -o fullscan.html
Never scan targets without permission.
On real engagements, start slow (-T2 or -T3) to avoid detection.

Once you can comfortably perform full scans and understand the output, you are ready for Module 3 – Vulnerability Assessment.