Nmap Notes for Beginners (Simple + Practical)

Nmap Notes for Beginners (Simple + Practical)

 

What is Nmap?

Nmap (Network Mapper) is a tool used for:
• Finding live hosts (which systems are online)
• Finding open ports
• Detecting services and versions
• Running scripts for extra recon using NSE (Nmap Scripting Engine)

Used widely in VAPT (Vulnerability Assessment and Penetration Testing) for recon.

 

1) Basic Nmap Scan

Command:
nmap 10.10.10.10

Why used: Scans the top 1000 common TCP ports of the target.

 

2) Host Discovery (Find live systems)

-sn (Scan No ports)
Command:
nmap -sn 192.168.1.0/24

Why used: Only checks which devices are alive/up, does NOT scan ports.
Best use: First step in scanning a network.

 

3) Ping blocked? Force scan

-Pn (Skip host discovery, assume host is alive)
Command:
nmap -Pn 10.10.10.10

Why used: Many servers block ping, so Nmap may say “Host seems down”.
-Pn tells Nmap: don’t ping, just scan.

 

4) Port Scanning

Scan one port:
nmap -p 80 10.10.10.10

Scan multiple ports:
nmap -p 22,80,443 10.10.10.10

Scan all ports:
nmap -p- 10.10.10.10

Why used: scans all 65535 TCP ports.

 

5) Scan Types (How Nmap scans)

-sS (SYN Scan)
Command:
sudo nmap -sS 10.10.10.10
Why used: Fast, common, stealthy scan (half-open). Needs sudo.

-sT (TCP Connect Scan)
Command:
nmap -sT 10.10.10.10
Why used: Works without sudo, but is noisier (easier to detect).

-sU (UDP Scan)
Command:
sudo nmap -sU 10.10.10.10
Why used: Finds UDP services (DNS, SNMP etc.) but usually slow.

 

6) Service + Version Detection

-sV (Service Version Detection)
Command:
nmap -sV 10.10.10.10

Why used: Shows what service is running and its version.
Example output:
• 22/tcp open ssh OpenSSH 8.x
• 80/tcp open http Apache httpd 2.4.x

 

7) Scripts (NSE)

NSE (Nmap Scripting Engine) = scripts to get more details.

-sC (Default scripts)
Command:
nmap -sC 10.10.10.10
Why used: runs safe default scripts.

Best recon combo:
nmap -sC -sV 10.10.10.10
Why used: scripts + version info gives better recon.

Vulnerability scripts:
nmap --script vuln 10.10.10.10
Why used: checks known vulnerabilities.
Warning: can be noisy and trigger alerts.

 

8) Timing (Speed)

-T4 (Fast scan)
Command:
nmap -T4 10.10.10.10

Timing guide:
• -T3 = normal (default)
• -T4 = faster (recommended)
• -T5 = very aggressive (may miss results + noisy)

 

9) Save Output (Important)

-oN (Normal output file)
Command:
nmap -sV -oN result.txt 10.10.10.10

-oA (Output All formats)
Command:
nmap -sV -oA scan 10.10.10.10

Creates 3 files:
• scan.nmap
• scan.gnmap
• scan.xml

 

10) Scan multiple targets from a file

-iL (Input List)
Create targets.txt:
10.10.10.10
10.10.10.11
scanme.nmap.org

Command:
nmap -iL targets.txt

Why used: scans all targets inside the file automatically.

 

Best Practical Nmap Command (VAPT)

Command:
sudo nmap -Pn -sS -p- -sV -sC -T4 -oA fullscan 10.10.10.10

Meaning:
• -Pn → assume host alive
• -sS → SYN scan
• -p- → scan all TCP ports
• -sV → service/version detect
• -sC → default NSE scripts
• -T4 → fast timing
• -oA → save output files

 

Quick Cheat Sheet

• -sn (Scan No ports) → Finds live hosts only
• -Pn (Ping No / skip discovery) → Assume host alive
• -p- (All ports) → Scan all TCP ports
• -sS (SYN scan) → Fast stealth scan (needs sudo)
• -sT (TCP connect scan) → Works without sudo
• -sU (UDP scan) → Scans UDP ports
• -sV (Service Version) → Detect service versions
• -sC (Default scripts) → Run default NSE scripts
• -oA (Output All) → Saves nmap + gnmap + xml
• -iL (Input List) → Scan targets from file