HackBlue

Tools · Workbench

Nmap and network discovery

Tutorials on scanning your own lab with Nmap: scan types, timing, NSE categories, reading output, and how a defender sees a scan.

  • 25 lessons
  • 4.5 h of reading
  • 5 topics
Start with lesson 1All workbenches

Nmap answers two questions: which addresses respond, and which ports accept a conversation. These tutorials explain each scan type in terms of the packets it sends, how to read the port states it prints, and how to turn the output into an asset list someone can act on.

Run every command here against a host-only lab, your own home network, or a range named in a written scope. Scanning someone else’s network without permission can break services and the law.

Getting started

4 lessons

  1. 01How to install Nmap and run your first scan on a home labInstall Nmap on Linux, macOS, or Windows, confirm the version, and run a first scan against a lab VM so you know what normal output looks like.11 min
  2. 02Nmap port states explained: open, closed, filtered, and unfilteredWhat each of Nmap’s six port states means in terms of the packets that came back, and how to tell a firewall drop from a closed port.12 min
  3. 03How Nmap host discovery works: ping scans, ARP, and -PnLearn which probes nmap -sn sends on a local subnet versus a routed one, why ARP wins on a LAN, and when -Pn is the right switch.12 min
  4. 04How to specify Nmap targets: CIDR, ranges, input lists, and exclusionsWrite target lists Nmap understands, preview them with -sL before sending a packet, and keep out-of-scope hosts out with --excludefile.9 min

Scan types

8 lessons

  1. 01Nmap SYN scan vs TCP connect scan (-sS vs -sT) explainedThe packet-level difference between a half-open SYN scan and a full TCP connect scan, what each leaves in logs, and which one to use in your lab.11 min
  2. 02How to scan UDP ports with Nmap and why UDP scans are slowRun nmap -sU on a lab host, understand open|filtered, speed it up with --top-ports and -sV, and know which UDP services matter for defense.12 min
  3. 03Nmap -sV service and version detection: how it works and how to read itSee how Nmap matches banners and probe responses against nmap-service-probes, tune --version-intensity, and verify versions before you file a finding.11 min
  4. 04How Nmap OS detection works and why the guess can be wrongUnderstand the TCP/IP fingerprint tests behind nmap -O, what “aggressive OS guesses” means, and how to read a guess you can trust.10 min
  5. 05Choosing ports in Nmap: -p, --top-ports, -F, and scanning all 65535Pick the right port list for the question: a fast inventory, a full sweep for forgotten services, or a targeted check after a fix.9 min
  6. 06Nmap timing templates -T0 to -T5: speed, accuracy, and safetyWhat each timing template changes, how retries and timeouts affect accuracy, and how to scan a lab fast without missing ports.10 min
  7. 07Scanning IPv6 with Nmap: link-local discovery and why sweeps failUse nmap -6 against IPv6 lab hosts, discover neighbors with multicast scripts instead of sweeps, and check that IPv6 firewall rules match IPv4.10 min
  8. 08Using an Nmap ACK scan to check your firewall rulesRun nmap -sA against your own firewall to see which ports a stateless or stateful filter lets through, and how to read unfiltered versus filtered.9 min

Nmap Scripting Engine

4 lessons

  1. 01Nmap NSE script categories explained: default, safe, intrusive, and vulnWhat each NSE category means, what -sC actually runs, and how to build a boolean script expression that stays inside an audit’s rules.11 min
  2. 02Safe Nmap scripts for a configuration audit: SMB signing, HTTP headers, and SSH algorithmsUse smb2-security-mode, http-title, http-security-headers, and ssh2-enum-algos to answer common hardening questions on hosts you manage.12 min
  3. 03How to check TLS versions and ciphers with nmap ssl-enum-ciphersRun ssl-enum-ciphers against your own HTTPS, SMTP, and LDAPS services, read the letter grades, and disable TLS 1.0 and 1.1 with confidence.10 min
  4. 04How to read an NSE script before you run it: --script-help, arguments, and sourceFind scripts on disk, read their categories and arguments, pass --script-args safely, and use --script-trace to see what a script sent.9 min

Reading output

5 lessons

  1. 01Nmap output formats explained: -oN, -oX, -oG, and -oASave every scan in the right format, know which one tools can parse, and resume an interrupted scan from its saved file.9 min
  2. 02Turn Nmap XML into a CSV asset inventory with PythonParse Nmap XML with the Python standard library to build a host, port, and service spreadsheet that owners can review.11 min
  3. 03How to compare two Nmap scans with ndiff to spot new servicesRun the same scan on a schedule, diff the XML with ndiff, and alert on hosts or ports that appeared since the last baseline.9 min
  4. 04Why Nmap says a port is filtered: using --reason, -v, and --packet-traceAsk Nmap to explain each result, see the exact packets sent, and debug confusing scans on your own network.9 min
  5. 05Nmap vs Masscan vs RustScan: which port scanner to use and whenCompare how the three scanners work, where each is accurate, and how to combine a fast sweep with Nmap’s service detection on networks you own.9 min

Defender side

4 lessons

  1. 01How to detect a port scan in firewall and Zeek logsRecognize scan patterns in iptables logs and Zeek conn.log, count distinct ports per source, and decide whether a scan is noise or a lead.11 min
  2. 02Detecting Nmap scans with Suricata: rules, thresholds, and testingWrite a threshold-based Suricata rule for SYN sweeps, recognize built-in scan signatures, and test detection against your own lab scan.10 min
  3. 03How to plan an authorized internal network scanWrite a one-page scan plan with scope, windows, rates, contacts, and stop conditions so your internal Nmap scans are safe and approved.10 min
  4. 04Found RDP or SMB open in a scan? How to verify and close itTurn an Nmap finding of exposed 3389 or 445 into a confirmed, fixed, and retested change on hosts you manage.11 min