Scanning with Nmap.
Remember the terminal on our homepage? Today you'll learn what that Nmap command actually does, how professionals use scanning to find weak spots, and the rules that keep scanning legal.
Scanning networks or websites you don't own or don't have written permission to test can be illegal and can get you into serious trouble. Practise only on your own devices, a home lab (next lesson), or sites built for practice such as scanme.nmap.org, which the Nmap project allows for light testing.
What Nmap does
Nmap ("Network Mapper") is a free, famous tool that discovers which devices are on a network and which ports (Lesson 3) are open, and often which software and version is running behind each door.
| Use by defenders | Use by attackers |
|---|---|
| Find forgotten servers and close unused ports | Find a way in |
| Check firewall rules actually work | Find old software with known vulnerabilities |
| Keep an inventory of devices | Plan the attack (reconnaissance) |
Same tool, different intention. That's why ethics matter so much in this field.
Reading Nmap output
$ nmap -sV scanme.nmap.org
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.6.1p1
80/tcp open http Apache httpd 2.4.7
9929/tcp open nping-echo
31337/tcp open tcpwrapped- PORT: the door number and protocol.
- STATE:
open(something is listening),closed(nobody there),filtered(a firewall is blocking, so Nmap can't tell). - SERVICE / VERSION: what's running. An analyst immediately asks: "Is this version old? Does it have known vulnerabilities?"
Common commands
| Command | What it does |
|---|---|
nmap 192.168.1.1 | Scan the 1,000 most common ports on one device |
nmap -sV 192.168.1.1 | Also detect service versions |
nmap -p 22,80,443 192.168.1.1 | Scan only specific ports |
nmap -sn 192.168.1.0/24 | Find which devices are alive on your home network, without port scanning |
nmap -A 192.168.1.1 | Aggressive: versions, OS guess, scripts (noisy, only on your own lab) |
Nmap shows 3389/tcp filtered. What does "filtered" most likely mean?
Filtered means something (usually a firewall) is dropping the probes, so the state is unknown.
From scan to action
A good analyst turns scan results into clear recommendations:
| Finding | Risk | Recommendation |
|---|---|---|
| Port 23 (Telnet) open | Old protocol, sends passwords in plain text | Disable Telnet, use SSH |
| Apache 2.4.7 on port 80 | Very old version, known vulnerabilities | Update Apache, redirect HTTP to HTTPS |
| Port 3306 (MySQL) open to the internet | Database exposed | Allow only from the app server via firewall |
That table is basically a mini vulnerability assessment report, a real deliverable in security jobs.
Which is the most responsible way to practise Nmap?
Only scan what you own or are explicitly allowed to scan.
Module 4 test
In a website, where should security checks be enforced?
Anything in the browser can be changed by the user.
A user changes ?id=1045 to ?id=1046 and sees another person's invoice. What is this?
The server didn't check the invoice belongs to the user.
What fixes SQL injection?
Separate data from commands.
In the cloud shared responsibility model, who secures your data and settings?
The provider secures the cloud; you secure what's in it.
What does nmap -sn 192.168.1.0/24 do?
-sn is a "ping scan" for host discovery.
Your task (20 min)
On a laptop, download Nmap (from the official site nmap.org; it includes the Zenmap interface on Windows). Scan your own computer with nmap 127.0.0.1 and then your home network with nmap -sn 192.168.1.0/24 (adjust to your network from Lesson 3). List the devices you find. Do you recognise all of them?
Lesson 16 complete!
You understand ports, scans and Nmap output, and how scanning fits into defence. You've completed Module 4! Next module: your first job.
Next: Build a home lab for free →