Nmap Explained: From Basic to Powerful Scanning Commands (2025 Guide)

Mastering Nmap: From Basic Scans to Advanced NSE Scripts (2025)!

Nmap (Network Mapper) is a powerful open-source tool for network scanning and vulnerability assessment. It's widely used by ethical hackers, penetration testers, and network administrators for discovering live hosts, open ports, services, and potential vulnerabilities in a network.

What is Nmap?

Nmap is a command-line utility that allows network exploration and security auditing. It supports multiple scan types, OS detection, and a scripting engine called NSE (Nmap Scripting Engine) for automating various security tasks.

How to Install Nmap:

• Linux (Debian/Ubuntu): sudo apt install nmap
• Kali Linux: Pre-installed
• Windows: Download from nmap.org

Basic Nmap Scanning Commands:

# Ping Scan (Detect live hosts)
nmap -sn 192.168.1.0/24

# Basic Port Scan
nmap 192.168.1.10

# Scan IP Range
nmap 192.168.1.1-20

# Verbose Output
nmap -v 192.168.1.1

Intermediate Scans

# Scan Specific Ports
nmap -p 21,22,80,443 192.168.1.1

# Detect Service Versions
nmap -sV 192.168.1.1

# OS Detection
nmap -O 192.168.1.1

# Aggressive Scan (Version + OS + Scripts)
nmap -A 192.168.1.1

# Save Output to File
nmap -oN scan.txt 192.168.1.1

Advanced Scans

# Stealth (SYN) Scan
nmap -sS 192.168.1.1

# UDP Scan
nmap -sU 192.168.1.1

# Fast Scan Timing
nmap -T4 192.168.1.1

# Scan Subnet with Service Detection
nmap -sV 192.168.1.0/24

Using NSE (Nmap Scripting Engine):

The Nmap Scripting Engine (NSE) allows users to write and use scripts to automate scanning tasks like vulnerability detection, brute-forcing, and information gathering.

Run Default Scripts

nmap -sC 192.168.1.1

Run Specific Script

nmap --script ssh-brute 192.168.1.1

Run Scripts by Category

nmap --script vuln 192.168.1.1

NSE Script Locations (Linux):

Default Nmap NSE scripts are stored in:

/usr/share/nmap/scripts/

To list all available scripts:

ls /usr/share/nmap/scripts/

Top Useful NSE Scripts:

• http-enum – Enumerates directories on web servers
• ftp-anon – Checks for anonymous FTP login
• ssh-brute – Attempts SSH brute-force attack
• dns-brute – Performs DNS subdomain brute-forcing
• smb-os-discovery – Retrieves SMB info from Windows hosts

Nmap and Security

Nmap should only be used with proper authorization. Unauthorized scanning can be considered illegal under cyber laws.

Final Thoughts

Mastering Nmap and NSE scripts can greatly enhance your capabilities in penetration testing and threat detection. Always use it in lab environments or with authorized permissions.

Next, check out our upcoming post: Top 25 NSE Scripts Every Ethical Hacker Should Know in 2025.