Skip to main content

Lab 5.1: Network Reconnaissance with Nmap

Learning Objectives​

By the end of this lab, you will be able to:

  • Install and configure Nmap on Windows and Linux
  • Perform different types of network scans
  • Identify active hosts on a network
  • Discover open ports and listening services
  • Detect remote operating systems
  • Identify known vulnerabilities with NSE scripts
  • Interpret scan results for security assessment
  • Understand detection evasion techniques

Estimated Duration​

40 minutes

Prerequisites​

  • 2 VMs: Windows and Kali Linux (or 2 Windows)
  • Configured VirtualBox internal network
  • Understanding of the TCP/IP model
  • Knowledge of ports and services

Professional Context​

Nmap (Network Mapper) is the world's most used network scanning tool by:

  • System administrators for network inventory
  • Security professionals for penetration testing
  • SOC analysts for anomaly detection
  • Auditors for compliance verification

Nmap allows you to:

  • Discover all devices on a network
  • Identify exposed services
  • Detect operating systems
  • Find known vulnerabilities
  • Validate firewall configurations
  • Map network infrastructure

Scanning a network without authorization is illegal in most jurisdictions.

AUTHORIZED:

  • On your own lab network (isolated VMs)
  • On systems you own
  • As part of penetration testing with a signed contract
  • On legal lab platforms (HackTheBox, TryHackMe)

STRICTLY PROHIBITED:

  • Scanning enterprise networks without written authorization
  • Scanning public or others' networks
  • Randomly scanning the Internet
  • Using to identify targets to attack

LEGAL CONSEQUENCES: Scanning without authorization = Illegal reconnaissance, prelude to cyber attack (Criminal Code art. 342.1). Easily detected via IDS/IPS. Likely criminal prosecution.

Required configuration for this lab:

  • VMs network in INTERNAL mode only
  • No Internet access
  • Isolated and controlled environment

Part 1: Installation and Configuration​

Step 1.1: Installation on Windows​

Download:

Installation:

  1. Run the downloaded .exe file
  2. Accept the license
  3. Recommended components:
    • Nmap Core Files (mandatory)
    • Npcap (mandatory - for packet capture)
    • Zenmap GUI (optional but useful for beginners)
    • Ndiff (optional)
  4. Complete installation

Verification:

nmap --version

Expected result:

Nmap version 7.94 ( https://nmap.org )
Platform: x86_64-w64-mingw32
Compiled with: ...

Step 1.2: Installation on Kali Linux​

Nmap is pre-installed on Kali Linux!

Verification:

nmap --version

Update if necessary:

sudo apt update
sudo apt install nmap -y

Step 1.3: Lab Network Configuration​

Lab architecture:

VM1 (Kali Linux - Scanner):
  IP: 192.168.100.10
  Role: Perform scans

VM2 (Windows - Target):
  IP: 192.168.100.20
  Role: System to scan
  Services: Multiple open ports

Network: Internal Network "LabNet"

On each VM, check connectivity:

ping 192.168.100.20  # From Kali
ping 192.168.100.10  # From Windows

Questions:

  1. What version of Nmap did you install?
  2. Can the two VMs communicate?

Part 2: Host Discovery​

Step 2.1: Basic Ping Scan​

The simplest scan:

nmap 192.168.100.20

Result:

Starting Nmap 7.94
Nmap scan report for 192.168.100.20
Host is up (0.00050s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server
5357/tcp open  wsdapi

Nmap done: 1 IP address (1 host up) scanned in 2.45 seconds

Analysis:

  • Host is up
  • 5 open ports detected
  • Services identified
  • Scan time: ~2 seconds

Step 2.2: Full Network Scan​

Scan an entire IP range:

nmap 192.168.100.0/24

Options:

  • /24 = 256 addresses (192.168.100.0 to 192.168.100.255)
  • /16 = 65,536 addresses
  • /8 = 16,777,216 addresses

Result:

Nmap scan report for 192.168.100.1
Host is up (0.00010s latency).

Nmap scan report for 192.168.100.10
Host is up (0.00012s latency).

Nmap scan report for 192.168.100.20
Host is up (0.00015s latency).

Nmap done: 256 IP addresses (3 hosts up) scanned in 4.21 seconds

3 active hosts discovered in 4 seconds on 256 IPs scanned!

Step 2.3: Host Discovery Without Port Scan​

Just discover which hosts are up (no port scan):

nmap -sn 192.168.100.0/24

Option -sn: Ping scan only (no port scan)

Faster: Complete scan in less than 2 seconds!

Questions: 3. How many active hosts did you discover on your lab network? 4. What is the time difference between scan with and without ports?

Part 3: Port Scanning​

Step 3.1: Types of Scans​

TCP Connect Scan (default for non-root):

nmap -sT 192.168.100.20
  • Full TCP connection (3-way handshake)
  • Reliable but detectable
  • Does not require root privileges

TCP SYN Scan (stealth, root required):

sudo nmap -sS 192.168.100.20
  • Incomplete TCP connection (SYN only)
  • More stealthy
  • Requires root/admin privileges

UDP Scan:

sudo nmap -sU 192.168.100.20
  • Scans UDP ports
  • Slower than TCP
  • Important for DNS, DHCP, SNMP

Step 3.2: Scan All Ports​

By default: Nmap scans only the 1000 most common ports

Scan ALL 65535 ports:

nmap -p- 192.168.100.20

Option -p-: All ports (1-65535)

WARNING: Can take 10-20 minutes!

Fast alternative:

nmap -p- --min-rate 5000 192.168.100.20

--min-rate 5000: Minimum 5000 packets/second = Scan in 30-60 seconds!

Step 3.3: Specific Port Scanning​

Specific ports:

nmap -p 80,443,3389,445 192.168.100.20

Port range:

nmap -p 1-1000 192.168.100.20

Combination:

nmap -p 22,80,443,1000-2000,3389,8080 192.168.100.20

Questions: 5. What are the open ports on your Windows VM? 6. How long does a full scan of all ports take?

Part 4: Service and Version Detection​

Step 4.1: Service Version Detection​

Scan with version detection:

nmap -sV 192.168.100.20

Option -sV: Version detection

Detailed result:

PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds  Microsoft Windows Server 2016 microsoft-ds
3389/tcp open  ms-wbt-server Microsoft Terminal Services
5357/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

Information obtained:

  • Exact service name
  • Software version
  • Additional information

Detection intensity:

nmap -sV --version-intensity 9 192.168.100.20
  • 0 = Light (fast)
  • 9 = Intensive (complete but slow)

Step 4.2: Operating System Detection​

OS Detection:

sudo nmap -O 192.168.100.20

Option -O: OS detection (requires root)

Result:

Running: Microsoft Windows 10|2016|2019
OS CPE: cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_server_2016
OS details: Microsoft Windows 10 1709 - 1909, or Windows Server 2016 - 2019
Network Distance: 1 hop

Typical accuracy: 85-95%

Step 4.3: Complete Aggressive Scan​

Combination of all options:

sudo nmap -A 192.168.100.20

Option -A: Aggressive scan (equivalent to -sV -O -sC --traceroute)

Includes:

  • Version detection
  • OS detection
  • Script scanning
  • Traceroute

Questions: 7. What operating system did Nmap detect? 8. What is the version of SMB (port 445) installed?

Part 5: NSE Scripts (Nmap Scripting Engine)​

Step 5.1: What is NSE?​

NSE: Lua scripts to automate advanced tasks:

  • Vulnerability detection
  • Brute-forcing
  • Advanced enumeration
  • Service exploitation

Script categories:

  • auth - Authentication
  • brute - Brute force
  • discovery - Discovery
  • exploit - Exploitation
  • vuln - Vulnerabilities

Step 5.2: Scan with Default Scripts​

nmap -sC 192.168.100.20

Option -sC: Script scan (default scripts)

Example result:

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Host script results:
| smb2-security-mode: 
|   2.02: 
|     Message signing enabled but not required
| smb2-time: 
|   date: 2024-11-08T15:30:45

Additional information obtained!

Step 5.3: Vulnerability Scripts​

Scan for known vulnerabilities:

nmap --script vuln 192.168.100.20

Result if vulnerable:

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Host script results:
| smb-vuln-ms17-010: 
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       EternalBlue / MS17-010

CRITICAL: EternalBlue vulnerability detected (the one from WannaCry!)

Step 5.4: SMB Enum Scripts​

Complete SMB enumeration:

nmap --script smb-enum-shares,smb-enum-users,smb-os-discovery 192.168.100.20

Information obtained:

Host script results:
| smb-enum-shares: 
|   account_used: guest
|   \\192.168.100.20\ADMIN$: 
|     Type: STYPE_DISKTREE_HIDDEN
|   \\192.168.100.20\C$: 
|     Type: STYPE_DISKTREE_HIDDEN
|   \\192.168.100.20\IPC$: 
|     Type: STYPE_IPC_HIDDEN
|     
| smb-os-discovery: 
|   OS: Windows 10 Pro (build 19041)
|   Computer name: DESKTOP-ABC123
|   Domain name: WORKGROUP

Complete enumeration of the target system!

Questions: 9. What SMB shares are available? 10. What vulnerabilities did Nmap detect?

Part 6: Advanced Scanning Techniques​

Step 6.1: Quick Scan (Top Ports)​

Scan only the most common ports:

nmap --top-ports 20 192.168.100.0/24

Scans the top 20 most common ports on the entire network

Even faster:

nmap --top-ports 100 --min-rate 10000 192.168.100.0/24
  • Top 100 ports
  • Minimum 10,000 packets/second
  • Complete network scan in seconds!

Step 6.2: Timing Templates​

Nmap offers 6 speed templates:

nmap -T0 target  # Paranoid (very slow, stealthy)
nmap -T1 target  # Sneaky (slow, stealthy)
nmap -T2 target  # Polite (slow, less load)
nmap -T3 target  # Normal (default)
nmap -T4 target  # Aggressive (fast)
nmap -T5 target  # Insane (very fast, may miss ports)

For this lab, use T4:

nmap -T4 -sV -O 192.168.100.20

Complete and fast scan!

Step 6.3: Output and Result Formats​

Save results to file:

Normal format (readable):

nmap 192.168.100.20 -oN scan_results.txt

XML format (for tools):

nmap 192.168.100.20 -oX scan_results.xml

Grepable format (for parsing):

nmap 192.168.100.20 -oG scan_results.gnmap

All formats at once:

nmap 192.168.100.20 -oA scan_complete

Generates: scan_complete.nmap, scan_complete.xml, scan_complete.gnmap

Questions: 11. Which output format is most useful for automated analysis? 12. How would you parse the results with PowerShell?

Part 7: Real-World Use Cases​

Step 7.1: Enterprise Network Scan (Simulation)​

Scenario: Security audit of an enterprise network

Phase 1 - Initial discovery:

nmap -sn 192.168.100.0/24 -oA discovery

Phase 2 - Quick scan of active hosts:

nmap -iL discovery.gnmap -sV --top-ports 1000 -T4 -oA quick_scan

Phase 3 - In-depth server scan:

nmap -iL servers.txt -sV -sC -O -p- -T4 -oA deep_scan

Phase 4 - Vulnerability scan:

nmap -iL servers.txt --script vuln -oA vuln_scan

Result: Complete network security report!

Step 7.2: Identifying Vulnerable Machines​

Script to find vulnerable systems:

# Look for Windows XP/7/8 (unsupported)
nmap -O 192.168.100.0/24 | grep -B 5 "Windows XP\|Windows 7\|Windows 8"

# Look for SMBv1 (vulnerable to EternalBlue)
nmap --script smb-protocols 192.168.100.0/24 | grep -B 10 "SMBv1"

# Look for services with old versions
nmap -sV 192.168.100.0/24 | grep -i "apache 2.2\|openssh 7.4"

Target prioritization:

  1. Unsupported OS
  2. Services with known CVEs
  3. Open sensitive ports (RDP, SMB, etc.)

Step 7.3: Complete Network Mapping​

Exhaustive scan for documentation:

nmap -sV -sC -O -p- --script discovery -T4 192.168.100.0/24 -oA network_map

Then analyze with Zenmap (GUI):

zenmap

File → Open → network_map.xml

Graphical network visualization!

Questions: 13. How long does a complete scan of your lab network take? 14. What critical information did you discover?

Part 8: Offensive Techniques​

Step 8.1: Service Brute Force​

SSH Brute Force:

nmap --script ssh-brute --script-args userdb=users.txt,passdb=passwords.txt -p 22 target

RDP Brute Force:

nmap --script rdp-brute -p 3389 target

SMB Brute Force:

nmap --script smb-brute -p 445 target

WARNING: Brute force generates a lot of logs! Easily detected.

Step 8.2: Exploitation with NSE Scripts​

Look for available exploits:

ls /usr/share/nmap/scripts/*exploit*

Example - MS08-067 (old but for demonstration):

nmap --script smb-vuln-ms08-067 192.168.100.20

If vulnerable, the script will indicate it!

List of vuln scripts:

nmap --script-help vuln

Step 8.3: Firewall Evasion​

Techniques to bypass detection:

Fragment packets:

nmap -f 192.168.100.20

Decoy scans (fake scans from other IPs):

nmap -D RND:10 192.168.100.20

Spoof source IP:

sudo nmap -S 192.168.100.50 -e eth0 192.168.100.20

Randomize scan order:

nmap --randomize-hosts 192.168.100.0/24

Questions: 15. Why use evasion techniques? 16. Can a firewall completely block Nmap?

Part 9: Automation and Reporting​

Step 9.1: Automated Scan Script​

Create auto_scan.sh:

#!/bin/bash

TARGET=$1
OUTPUT_DIR="nmap_scans_$(date +%Y%m%d_%H%M%S)"

mkdir -p $OUTPUT_DIR

echo "[*] Starting automated scan of $TARGET"
echo "[*] Output directory: $OUTPUT_DIR"

# Phase 1: Host Discovery
echo "[*] Phase 1: Host Discovery"
nmap -sn $TARGET -oA $OUTPUT_DIR/01_discovery

# Phase 2: Quick Scan
echo "[*] Phase 2: Quick Port Scan"
nmap -sV --top-ports 1000 -T4 $TARGET -oA $OUTPUT_DIR/02_quick_scan

# Phase 3: Full Port Scan
echo "[*] Phase 3: Full Port Scan"
nmap -p- --min-rate 5000 $TARGET -oA $OUTPUT_DIR/03_full_scan

# Phase 4: Vulnerability Scan
echo "[*] Phase 4: Vulnerability Scan"
nmap --script vuln $TARGET -oA $OUTPUT_DIR/04_vuln_scan

# Phase 5: OS Detection
echo "[*] Phase 5: OS Detection"
sudo nmap -O $TARGET -oA $OUTPUT_DIR/05_os_detection

echo "[*] Scan complete! Results in: $OUTPUT_DIR/"

Usage:

chmod +x auto_scan.sh
./auto_scan.sh 192.168.100.0/24

Complete automated network scan!

Step 9.2: Parsing and Analysis with PowerShell​

On Windows, analyze XML results:

[xml]$nmapResults = Get-Content scan_results.xml

# Extract all hosts and open ports
$nmapResults.nmaprun.host | ForEach-Object {
    $ip = $_.address.addr
    $hostname = $_.hostnames.hostname.name
    
    Write-Host "Host: $ip ($hostname)"
    
    $_.ports.port | Where-Object {$_.state.state -eq "open"} | ForEach-Object {
        Write-Host "  $($_.portid)/$($_.protocol) - $($_.service.name) $($_.service.version)"
    }
}

Step 9.3: HTML Report Generation​

Convert XML to HTML:

xsltproc scan_results.xml -o report.html

OR use a Python script:

import nmap
import datetime

nm = nmap.PortScanner()
nm.scan('192.168.100.0/24', arguments='-sV')

html = "<html><head><title>Nmap Scan Report</title></head><body>"
html += f"<h1>Network Scan Report</h1>"
html += f"<p>Date: {datetime.datetime.now()}</p>"

for host in nm.all_hosts():
    html += f"<h2>Host: {host}</h2>"
    html += "<table border='1'><tr><th>Port</th><th>Service</th><th>Version</th></tr>"
    
    for proto in nm[host].all_protocols():
        ports = nm[host][proto].keys()
        for port in ports:
            service = nm[host][proto][port]['name']
            version = nm[host][proto][port]['version']
            html += f"<tr><td>{port}</td><td>{service}</td><td>{version}</td></tr>"
    
    html += "</table>"

html += "</body></html>"

with open('nmap_report.html', 'w') as f:
    f.write(html)

print("Report generated: nmap_report.html")

Questions: 17. How would you present the results to a client? 18. What information is most critical to include?

Deliverables​

To submit:

  1. Network scan report (Word/PDF, 5-6 pages):

    • Answers to the 18 questions
    • Scan methodology used
    • Results of each scan phase
    • Analysis of vulnerabilities found
    • Network mapping (diagram)

  2. Screenshots (minimum 8):

    • Host discovery scan
    • Complete port scan
    • Version detection (-sV)
    • OS detection (-O)
    • Vuln script in action
    • NSE scripts results
    • Zenmap visualization
    • Generated report

  3. Nmap result files:

    • Formats .nmap, .xml, .gnmap
    • For at least 3 different scan types

  4. Automation script:

    • Bash or PowerShell script
    • Complete automated scan
    • Report generation

  5. Security analysis (2-3 pages):

    • Critical vulnerabilities identified
    • Associated risks
    • Prioritized remediation recommendations

Evaluation Criteria​

CriterionPoints
Mastery of different scan types25%
Correct use of Nmap options20%
Detection and analysis of vulnerabilities25%
Functional automation script15%
Quality of report and analysis15%

Quick Reference Commands​

Basic Scans​

nmap target                    # Simple scan
nmap -sn target                # Host discovery only
nmap -p- target                # All ports
nmap -p 80,443 target          # Specific ports
nmap 192.168.1.0/24            # Scan a network

Advanced Scans​

nmap -sV target                # Version detection
nmap -O target                 # OS detection
nmap -sC target                # Script scan
nmap -A target                 # Aggressive (all)
nmap -T4 target                # Timing template

NSE Scripts​

nmap --script vuln target                  # Vulnerabilities
nmap --script smb-enum-shares target       # SMB shares
nmap --script http-enum target             # HTTP enumeration
nmap --script ssl-heartbleed target        # Heartbleed

Output​

nmap target -oN file.nmap      # Normal output
nmap target -oX file.xml       # XML output
nmap target -oG file.gnmap     # Grepable output
nmap target -oA basename       # All formats

Optimization​

nmap --min-rate 5000 target              # Minimum speed
nmap --max-retries 1 target              # Fewer retries
nmap --host-timeout 5m target            # Timeout per host
nmap -n target                           # No DNS resolution

Troubleshooting​

Problem: "You requested a scan type which requires raw sockets"​

Solution: Run with sudo (Linux) or as administrator (Windows) for SYN scans (-sS) and OS detection (-O).

Problem: Very slow scan​

Solutions:

  • Use -T4 for speed
  • Limit to top ports: --top-ports 100
  • Increase min-rate: --min-rate 5000
  • Disable DNS resolution: -n

Problem: No ports detected but host is up​

Solutions:

  • Firewall likely blocking
  • Try UDP scan: -sU
  • Try different scan types: -sT, -sS
  • Check basic connectivity: ping

Going Further (Optional)​

Challenge 1: Nmap Scripting​

Create your own NSE script for:

  • Custom enumeration
  • Specific configuration detection
  • Custom information extraction

Challenge 2: Integration with Metasploit​

Use Nmap results in Metasploit:

db_nmap -sV 192.168.100.0/24
hosts
services
vulns

Challenge 3: Temporal Comparison​

Scan the same network at different times:

  • Identify new hosts
  • Detect configuration changes
  • Continuous security monitoring
ndiff scan1.xml scan2.xml

Additional Resources​

Conclusion​

This lab taught you:

  • Nmap installation and configuration
  • Different types of network scans
  • Service and OS detection
  • Using NSE scripts for vulnerabilities
  • Automation and reporting
  • Professional reconnaissance methodology

Key lessons:

  1. Nmap is the industry standard tool for network reconnaissance
  2. Different scan types for different objectives
  3. NSE scripts multiply Nmap's capabilities
  4. Automation is essential for large networks
  5. Documentation and reporting are critical for professional audits

In a real pentest:

  • Nmap is always the first step (reconnaissance)
  • Results guide the rest of the attack
  • Easy detection if no precautions (IDS/IPS)
  • Timing and discretion important in Red Team engagement

Next step: Lab 5.2 where you will learn advanced DNS enumeration to discover hidden subdomains and sensitive information!

Lab developed as part of the Operating Systems course - MODULE 5