CHAPTER 01 · RECONNAISSANCE

Nmap

Nmap helps you inventory hosts, ports, and services on systems you own or are explicitly authorised to assess.

What it does

Nmap is a network discovery and security-auditing tool. Its output is evidence to investigate—not automatic proof of a vulnerability.

Scope first. Scan only lab machines, your own assets, or targets covered by written permission.

A clear workflow

Confirm target and scope.
Discover live hosts.
Identify open ports.
Detect services.
Save and review results.

Core commands

Host discovery

nmap -sn 192.168.1.0/24

Scan all TCP ports

nmap -p- 192.168.1.10

Identify services and versions

nmap -sV -p 22,80,443 192.168.1.10

Save a record

nmap -sV -oA inventory 192.168.1.10

Port states

open: a service accepted the probe.
closed: the host replied, but no service is listening there.
filtered: filtering prevented Nmap from deciding the state.

Practice safely

Start light: host discovery → ports → service detection → relevant follow-up. Version strings can be hidden or patched, so validate findings responsibly.

Tip: Use -oA to save normal, XML, and grepable output for reporting.