 |
| Ethical Hacking |
🛡️ Ethical Hacking — Day 6
Nmap Fundamentals: Network Discovery & Port Scanning
⚠️ LEARNING PURPOSE ONLY: This tutorial is strictly for educational and defensive cybersecurity learning. Use Nmap only against systems, networks, virtual machines, applications, or labs that you own or have explicit permission to test. Never scan unauthorized systems.
Welcome to Day 6.
Today we begin using one of the most important tools in ethical hacking:
🔎 Nmap
Nmap (Network Mapper) is an open-source tool used for network discovery and security auditing. It can help identify hosts, ports, services, and—when requested—service versions and operating-system information. (Nmap)
🎯 Day 6 Learning Objectives
Today you'll learn:
What Nmap is
Why security professionals use it
Installing Nmap
Host discovery
Port scanning
TCP ports
Service detection
Version detection
Reading Nmap results
Basic scan options
Nmap on Linux
Nmap on Windows
Nmap on macOS
Safe scanning of your own computer
1. What Is Nmap?
Nmap stands for:
Network Mapper
It is commonly used for:
Network Discovery
↓
Host Discovery
↓
Port Scanning
↓
Service Detection
↓
Version Detection
↓
Security Assessment
Nmap can scan individual hosts as well as larger authorized networks. (Nmap)
For this course, however, we're going to start with your own computer.
2. Why Is Nmap Important?
Imagine you have a server.
You don't know which services are accessible.
You might discover something like:
Server
│
├── 22/tcp SSH
├── 80/tcp HTTP
├── 443/tcp HTTPS
└── 5432/tcp PostgreSQL
This gives a security professional a starting point for understanding the system's attack surface.
But remember:
An open port is not automatically a vulnerability.
It simply means that something is listening and accepting or responding to traffic.
3. What Is a Port Scan?
A port scan asks a basic question:
"Which ports on this authorized target appear to be accessible?"
For example:
Target: 192.168.1.20
Port 22 → ?
Port 80 → ?
Port 443 → ?
Port 3306 → ?
Nmap sends probes and analyzes the responses.
4. Understanding Nmap Port States
Nmap commonly reports states such as:
🟢 Open
An application is listening on the port.
80/tcp open
🔴 Closed
The port is reachable, but no application is listening there.
80/tcp closed
🟡 Filtered
A firewall or other network filtering prevents Nmap from determining whether the port is open or closed.
80/tcp filtered
Nmap's official documentation describes these states and their meanings in more detail. (Nmap)
5. Installing Nmap
Nmap officially provides packages/installers for Linux, Windows, and macOS. (Nmap)
Before installing anything, check whether it is already installed.
🐧 Linux
Open Terminal:
nmap --version
If Nmap is already installed, you'll see version information.
Debian / Ubuntu / Kali
If it isn't installed:
sudo apt update
sudo apt install nmap
Then:
nmap --version
Fedora/RHEL-based systems
Depending on your distribution:
sudo dnf install nmap
Then:
nmap --version
For official installation/download information, refer to Nmap's official installation guide.
🪟 Windows
Open PowerShell.
First:
nmap --version
If Nmap isn't installed, use the official Nmap Windows installer rather than downloading it from an unknown third-party website.
After installation, reopen PowerShell and run:
nmap --version
You should see Nmap version information.
🍎 macOS
Open Terminal:
nmap --version
If you use Homebrew, you can install Nmap with:
brew install nmap
Then:
nmap --version
You can also use the official macOS package from Nmap.
🧪 Practical 1 — Scan Your Own Computer
This is our first Nmap exercise.
We will scan:
127.0.0.1
Remember:
127.0.0.1 = Your own computer
🐧 Linux
nmap 127.0.0.1
🪟 Windows
nmap 127.0.0.1
🍎 macOS
nmap 127.0.0.1
You might see something similar to:
Starting Nmap
Nmap scan report for localhost
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp closed https
Nmap done
Your results will probably be different.
That's completely normal.
The result depends on what services are currently running on your machine.
6. Understanding the Output
Suppose Nmap reports:
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Break it down:
22
↓
Port number
tcp
↓
Transport protocol
open
↓
Something appears to be listening
ssh
↓
Nmap's service identification
7. Scan Specific Ports
Instead of checking Nmap's default port selection, you can specify particular ports.
For example:
nmap -p 22,80,443 127.0.0.1
This asks Nmap to check:
22
80
443
on your own computer.
Windows
nmap -p 22,80,443 127.0.0.1
macOS
nmap -p 22,80,443 127.0.0.1
8. Scan a Port Range
You can specify a range:
nmap -p 1-100 127.0.0.1
This checks ports 1 through 100 on your own machine.
Windows
nmap -p 1-100 127.0.0.1
macOS
nmap -p 1-100 127.0.0.1
9. Host Discovery
Nmap can perform host discovery without proceeding to a normal port scan.
The option is:
-sn
For example, against your own computer:
nmap -sn 127.0.0.1
This is useful for learning the concept of host discovery.
Nmap's documentation explains that -sn performs host discovery without a port scan. (Nmap)
Linux
nmap -sn 127.0.0.1
Windows
nmap -sn 127.0.0.1
macOS
nmap -sn 127.0.0.1
10. Service and Version Detection
Knowing that port 80 is open isn't always enough.
You may want to know:
"What software is actually running there?"
Nmap provides version detection with:
-sV
For your own computer:
nmap -sV 127.0.0.1
Windows
nmap -sV 127.0.0.1
macOS
nmap -sV 127.0.0.1
Nmap's official documentation explains that -sV probes detected services to identify their protocol, application, and version where possible. (Nmap)
11. Why Version Detection Matters
Imagine:
80/tcp open http
You know HTTP is available.
With version detection you might learn something like:
80/tcp open http Apache httpd
or another server implementation.
This information can help security professionals determine:
What software is deployed?
Is the software expected?
Is it properly maintained?
Does it need updating?
What configuration should be reviewed?
Don't jump directly from "version found" to "exploit it."
A responsible security assessment first verifies scope, software identity, configuration, and risk.
12. Scan Your Localhost With Version Detection
Run:
nmap -sV 127.0.0.1
Look carefully at:
PORT
STATE
SERVICE
VERSION
Create a note:
Port:
State:
Service:
Version:
13. Save Your Nmap Results
Security professionals need evidence and documentation.
You can save normal output using:
nmap 127.0.0.1 -oN day6-scan.txt
Then read it:
Linux/macOS
cat day6-scan.txt
Windows PowerShell
Get-Content day6-scan.txt
This is a useful habit:
Don't just scan—document.
14. Compare With Your Operating System
Remember the commands from Day 5?
You can compare Nmap with your operating system's own information.
Linux
ss -tuln
and:
nmap 127.0.0.1
Windows
netstat -ano
and:
nmap 127.0.0.1
macOS
lsof -nP -iTCP -sTCP:LISTEN
and:
nmap 127.0.0.1
The results may not look identical because these tools answer somewhat different questions and use different mechanisms.
🧪 Practical 2 — Cross-Platform Investigation
Perform the following on your own computer.
Step 1
Check listening services using your operating system.
Linux
ss -tuln
Windows
netstat -ano
macOS
lsof -nP -iTCP -sTCP:LISTEN
Step 2
Run Nmap:
nmap 127.0.0.1
Step 3
Compare:
Operating System
↓
What does the OS report?
↓
Nmap
↓
What does Nmap report?
15. Understanding -p
The -p option specifies ports.
Examples:
nmap -p 22 127.0.0.1
One port.
nmap -p 22,80,443 127.0.0.1
Several ports.
nmap -p 1-100 127.0.0.1
A range.
This is one of the most important Nmap options to understand.
16. Understanding -sV
-sV
means:
Enable service/version detection.
Example:
nmap -sV -p 22,80,443 127.0.0.1
Conceptually:
Find the port
↓
Determine the service
↓
Try to identify the version
17. Understanding -sn
-sn
means:
Host discovery without a port scan.
Example:
nmap -sn 127.0.0.1
Nmap normally performs a discovery stage before more extensive scanning; -sn tells it to stop after host discovery. (Nmap)
18. A Simple Nmap Workflow
For an authorized security assessment, the conceptual workflow can look like:
1. Define scope
↓
2. Discover authorized hosts
↓
3. Identify accessible ports
↓
4. Identify services
↓
5. Identify versions
↓
6. Review vulnerabilities/configuration
↓
7. Document findings
↓
8. Remediate
↓
9. Retest
Nmap is primarily helping with the discovery and enumeration portions.
🔐 19. Nmap Is Not a Magic Hacking Button
A beginner sometimes thinks:
Nmap
↓
Find vulnerability
↓
Hack server
That's not how professional security testing works.
A more accurate model is:
Nmap
↓
Information
↓
Analysis
↓
Verification
↓
Risk Assessment
↓
Remediation
Nmap is a reconnaissance and security-auditing tool, not an automatic exploitation tool. (Nmap)
🧪 Day 6 Main Lab
Perform these exercises on 127.0.0.1 only.
Linux
nmap --version
nmap -sn 127.0.0.1
nmap 127.0.0.1
nmap -p 22,80,443 127.0.0.1
nmap -sV 127.0.0.1
nmap 127.0.0.1 -oN day6-scan.txt
Windows PowerShell
nmap --version
nmap -sn 127.0.0.1
nmap 127.0.0.1
nmap -p 22,80,443 127.0.0.1
nmap -sV 127.0.0.1
nmap 127.0.0.1 -oN day6-scan.txt
macOS
nmap --version
nmap -sn 127.0.0.1
nmap 127.0.0.1
nmap -p 22,80,443 127.0.0.1
nmap -sV 127.0.0.1
nmap 127.0.0.1 -oN day6-scan.txt
📊 Day 6 Report
Create a small report:
| Port | State | Service | Version |
|---|---|---|---|
| ___ | ___ | ___ | ___ |
| ___ | ___ | ___ | ___ |
| ___ | ___ | ___ | ___ |
Then answer:
1.
Which ports were open?
2.
Which ports were closed?
3.
Did Nmap identify any services?
4.
Did -sV provide additional information?
5.
How did Nmap's results compare with your operating system's listening-service information?
🧠 Day 6 Assignment
Answer these questions:
1. What does Nmap stand for?
2. What is Nmap primarily used for?
3. What does an open port mean?
4. What does a closed port mean?
5. What does filtered mean?
6. What does -p do?
7. What does -sV do?
8. What does -sn do?
9. Why is an open port not automatically a vulnerability?
10. Why is authorization necessary before scanning another system?
🏆 Day 6 Challenge
Complete this workflow against your own computer:
nmap --version
↓
nmap -sn 127.0.0.1
↓
nmap 127.0.0.1
↓
nmap -p 1-100 127.0.0.1
↓
nmap -sV 127.0.0.1
↓
Save the results
↓
Compare with OS information
Then write a short conclusion:
"My computer exposes ______ accessible ports/services. I identified them using ______ and verified the information using ______."
⚠️ Ethical Hacking Reminder
LEARNING PURPOSE ONLY: Every Nmap command in this lesson is provided for educational and authorized security testing. For this Day 6 lab, use
127.0.0.1or another system you explicitly own/control. Do not replace it with a random public IP, website, school network, company network, Wi-Fi network, cloud server, or another person's device.
Never confuse "technically possible" with "authorized."
✅ Day 6 Summary
Today you learned:
What Nmap is
Why Nmap is important
Installing Nmap
Host discovery
Port scanning
Port states
Specific-port scanning
Port-range scanning
Service detection
Version detection
Saving scan results
Comparing Nmap with OS-level network information
Nmap commands on Linux
Nmap commands on Windows
Nmap commands on macOS
The most important lesson today:
Reconnaissance gives you information. A professional ethical hacker turns that information into understanding—not unauthorized access.
🔜 Day 7 — Nmap Deeper: Scan Types & Results
Tomorrow we'll go deeper into:
TCP Connect scanning
SYN scanning concepts
UDP scanning concepts
Host discovery
Port states
Service detection
Scan timing
Reading Nmap output
Comparing different scan approaches
Safe Nmap exercises on Linux, Windows and macOS
Building your first small authorized lab
We'll keep all practical scanning inside your own machine or an explicitly authorized lab environment.
🔐 LEARN → PRACTICE → UNDERSTAND → SECURE.
No comments:
Post a Comment