01

Information Gathering Using Nmap

Session 10
What is Nmap?

Nmap is short for Network Mapper. It is an open-source Linux

command-line tool that is used to scan IP addresses and ports in a
network and to detect installed applications.
02

Nmap allows network admins to find which devices are running on

their network, discover open ports and services, and detect
vulnerabilities.
Features of Nmap

1) Ability to recognize what server, version, os

routers, other devices your target uses.
2) Nmap is also capable of detecting what version of 03
which application does your target running.
3) We can also use the nmap to actually scan for
vulnerabilities.
Overview of Nmap Tool

Let me show how does it looks.

04
Basic scans

● Ping Scan: Scan can list devices up or running.

> nmap -sp 192.168.1.1/24

05

● Scan a single host: Scans a single host for 1000

well-known ports. These ports are the ones used by
popular services like SQL, SNTP, apache, and
others

nmap scanme.nmap.org
Stealth scans

It is used to perform port scanning by sending some

packets to the server to specific ports and if the server
respond through that ports it shows you the number of the
port. 06

nmap -sS scanme.nmap.org

Version Scanning

Finding application versions is a crucial part in

penetration testing.
07

It makes your life easier since you can find an existing

vulnerability from the
Common Vulnerabilities and Exploits (CVE) database
for a particular version of the service. You can then use
it to attack a machine using an exploitation tool like
Metasploit.
nmap -sV scanme.nmap.org
OS Scanning

In addition to the services and their versions, Nmap

can provide information about the underlying operating
system using TCP/IP fingerprinting. Nmap will also try 08
to find the system uptime during an OS scan.

nmap -O scanme.nmap.org
Aggressive Scanning

Nmap has an aggressive mode that enables OS

detection, version detection, script scanning, and
traceroute. You can use the -A argument to perform an 09
aggressive scan.

nmap -A scanme.nmap.org
Enough Theory

Let’s dive into the practical where I will tell you more
about NMAP and it’s feature.
10
 You got this!
11

Relax and enjoy the process of

learning.

See you all in the next session on:

Information Gathering Using RECON-NG