Performs advanced network reconnaissance using Nmap's scripting engine, timing controls, evasion techniques, and output parsing to discover hosts, enumerate services, detect vulnerabilities, and fingerprint operating systems across authorized target networks.
Performs advanced network reconnaissance using Nmap's scripting engine, timing controls, evasion techniques, and output parsing to discover hosts, enumerate services, detect vulnerabilities, and fingerprint operating systems across authorized target networks.
Performing comprehensive asset discovery across large enterprise networks during authorized assessments
Enumerating service versions and configurations to identify outdated or vulnerable software
Bypassing firewall rules and IDS during authorized penetration tests using scan evasion techniques
Scripting automated vulnerability checks using the Nmap Scripting Engine (NSE)
Generating structured scan output for integration into vulnerability management pipelines
Do not use against networks without explicit written authorization, on production systems during peak hours without approval, or to perform denial-of-service through aggressive scan timing.
Most Often Missed & How to Confirm
UDP is the silent gap: a TCP-only scan misses SNMP (161), DNS (53), TFTP (69), IKE (500), NTP (123). Run nmap -sU --top-ports 200 (slow, but those services are often the foothold); skipping UDP is the most common under-report.
Full port range, not top-1000: services hide on high ports — use -p- before declaring a host "has only 3 ports." Default scans cover 1000 of 65535.
Probes blocked ≠ host down: if ICMP is filtered, -sn marks live hosts as down. Add TCP/UDP discovery probes (-PS21,22,80,443,445 -PU53,161) or scan with -Pn; never conclude "no hosts" from ICMP alone.
Firewall/IDS evasion variants: when a straight -sS is filtered, try fragmentation (-f/--mtu), decoys (-D RND:10), source-port spoofing (--source-port 53), and slow timing (-T1 --scan-delay) to evade rate-based IDS — a filtered result may be the IDS, not a closed port.
NSE depth:-sV -sC gives version + safe scripts, but vuln confirmation needs --script vuln and targeted scripts (smb-vuln-ms17-010, ssl-heartbleed). A clean default scan is not a clean vuln assessment.
How to confirm a hit: a real open port returns SYN-ACK (-sS) or a service banner under -sV; open|filtered (common on UDP) is unconfirmed — re-probe with --version-intensity or an app-specific NSE script before reporting it open or closed.
Don't conclude "host clean" until you've covered TCP -p-, top UDP, version+NSE vuln scripts, and retried filtered ports through an evasion technique.
Prerequisites
Nmap 7.90+ installed (nmap --version to verify)
Root/sudo privileges for SYN scans, OS detection, and raw packet techniques
Written authorization specifying in-scope IP ranges and any excluded hosts
Network access to target ranges (VPN, direct connection, or jump host)
Familiarity with TCP/IP protocols and common port assignments
Workflow
Step 1: Host Discovery with Multiple Probes
Use layered discovery to find live hosts even when ICMP is blocked:
# ARP discovery for local subnet (most reliable on LAN)
nmap -sn -PR 192.168.1.0/24 -oA discovery_arp
# Combined ICMP + TCP + UDP probes for remote networks
nmap -sn -PE -PP -PS21,22,25,80,443,445,3389,8080 -PU53,161,500 10.0.0.0/16 -oA discovery_combined
# List scan to resolve DNS names without sending packets to targets
nmap -sL 10.0.0.0/24 -oN dns_resolution.txt
# Fragment packets to evade simple packet inspection
nmap -sS -f --mtu 24 -p 80,443 <target> -oN fragmented_scan.txt
# Use decoy addresses to obscure scan origin
nmap -sS -D RND:10 -p 80,443 <target> -oN decoy_scan.txt
# Spoof source port as DNS (53) to bypass poorly configured firewalls
nmap -sS --source-port 53 -p 1-1024 <target> -oN spoofed_port_scan.txt
# Idle scan using a zombie host (completely stealthy)
nmap -sI <zombie_host> -p 80,443,445 <target> -oN idle_scan.txt
# Slow scan to evade IDS rate-based detection
nmap -sS -T1 --max-rate 10 -p 1-1024 <target> -oA stealth_scan
Step 6: Output Parsing and Reporting
# Convert XML output to HTML report
xsltproc full_tcp_scan.xml -o scan_report.html
# Extract open ports per host from grepable output
grep "Ports:" full_tcp_scan.gnmap | awk -F'Ports: ''{print $1 $2}' > open_ports_summary.txt
# Parse XML with nmap-parse-output for structured data
nmap-parse-output full_tcp_scan.xml hosts-to-port 445
# Import into Metasploit database
msfconsole -q -x "db_import full_tcp_scan.xml; hosts; services; exit"# Generate CSV for vulnerability management tools
nmap-parse-output full_tcp_scan.xml csv > scan_results.csv
Key Concepts
Term
Definition
SYN Scan (-sS)
Half-open TCP scan that sends SYN packets and analyzes responses without completing the three-way handshake, making it faster and stealthier than connect scans
NSE (Nmap Scripting Engine)
Lua-based scripting framework built into Nmap that enables vulnerability detection, brute forcing, service discovery, and custom automation
Timing Templates (-T0 to -T5)
Predefined scan speed profiles ranging from Paranoid (T0) to Insane (T5), controlling probe parallelism, timeout values, and inter-probe delays
Idle Scan (-sI)
Advanced scan technique that uses a zombie host's IP ID sequence to port scan a target without sending packets from the scanner's own IP address
Version Intensity
Controls how many probes Nmap sends to determine service versions, ranging from 0 (light) to 9 (all probes), trading speed for accuracy
Grepable Output (-oG)
Legacy Nmap output format designed for easy parsing with grep, awk, and sed for scripted analysis of scan results
Tools & Systems
Nmap 7.90+: Core scanning engine with NSE scripting, OS detection, version probing, and multiple output formats
nmap-parse-output: Community tool for parsing Nmap XML output into structured formats (CSV, JSON, host lists)
Ndiff: Nmap utility for comparing two scan results to identify changes in network state over time
Zenmap: Official Nmap GUI providing visual network topology mapping and scan profile management
Metasploit Framework: Imports Nmap XML output for direct correlation of scan results with exploit modules
Common Scenarios
Scenario: Enterprise Network Asset Discovery and Vulnerability Baseline
Context: A security team needs to establish a vulnerability baseline for a corporate network spanning 10.0.0.0/8 with approximately 5,000 active hosts. Scanning must complete within a weekend maintenance window with minimal network disruption.
Approach:
Run layered host discovery using ARP (local subnets), TCP SYN (ports 22,80,443,445,3389), and ICMP echo probes across all /24 subnets
Perform a full TCP SYN scan on discovered hosts using --min-rate 5000 and -T4 to complete within the window
Run service version detection and default NSE scripts on all open ports
