Nmap Reconnaissance

Overview

Nmap (current release 7.99x) sends probes to targets and reports which hosts are up, which ports are open, which services and versions answer, and often the operating system. The Nmap Scripting Engine (NSE) adds checks for specific services and known vulnerabilities, and results can be written as text, grepable text or XML for other tools.

Only scan systems you own or have written permission to test. scanme.nmap.org is the one public host the Nmap project invites you to scan lightly. Everything below uses your own machine (127.0.0.1), a lab subnet (192.168.1.0/24) or that host.

Instructions

Install with a package manager: sudo apt install nmap, brew install nmap, or the Windows installer from nmap.org. nmap --version confirms it.

Step 1: Host discovery

nmap -sn 192.168.1.0/24          # ping scan: list live hosts, no port scan
nmap -sn -PR 192.168.1.0/24      # ARP discovery on the local LAN (most reliable there)
nmap -sL 192.168.1.0/24          # list targets only, sends nothing to them