PWNMI

Guides

Nmap Fundamentals: Your First Recon Tool

Updated July 22, 2026 · Written by PWNMI — see About.

Nmap ("Network Mapper") is almost always the first tool you run against a target. It answers three questions: what's alive, what ports are open, and what's running on them. Everything else in a pentest builds on those answers.

Installation

Nmap ships pre-installed on Kali and Parrot OS. Elsewhere:

# Debian/Ubuntu
sudo apt install nmap

# macOS (Homebrew)
brew install nmap

Host discovery

Before scanning ports, find out what's actually up on a network:

nmap -sn 192.168.1.0/24

-sn (no port scan) pings the range and lists live hosts. Fast, low-noise, and the right first step against a subnet you don't know yet.

Basic port scan

nmap 192.168.1.10

By default, Nmap scans the 1,000 most common TCP ports. For a quick first look at a single host, that's usually enough to orient yourself.

Service and version detection

Open ports alone don't tell you much. -sV probes each open port to identify the service and version running on it:

nmap -sV 192.168.1.10

This is where the useful information actually shows up — an outdated service version is often the fastest path to a known CVE.

Common flags worth knowing

Flag What it does
-p- Scan all 65,535 ports (slower, but thorough — default scan misses ports outside the top 1,000)
-A Aggressive scan: OS detection, version detection, script scanning, traceroute
-sC Run Nmap's default script set (safe, common enumeration scripts)
-T4 Faster timing template — reasonable default for most home labs
-oA <name> Save output in all formats (normal, XML, grepable) — always do this

A solid default for a lab target:

nmap -sV -sC -p- -T4 -oA scan_results 192.168.1.10

Reading the output

Focus on three things per open port: the port number, the service name, and the version string. A vsftpd 2.3.4 on port 21, for example, is a known-vulnerable version worth looking up immediately — that's a real, still-cited example of why version detection matters.

Common mistakes

  • Only scanning the default top 1,000 ports. A lot of interesting services (custom web ports, database ports) live outside that range. Run -p- when time allows.
  • Skipping -sV. An open port with no version info is much less actionable.
  • Scanning targets you don't have authorization to scan. Nmap against a network you don't own or don't have written permission to test is not a gray area — it's unauthorized access. Practice against your own home lab or an authorized platform (TryHackMe, HackTheBox, a lab VM).
  • Not saving output. -oA costs nothing and saves you from re-scanning later when you need to reference results.

Next step

Once you've got open ports and service versions, the next move for anything running a web service is usually Burp Suite. For a structured place to practice all of this against a real target, see Labs.