Nmap: The Complete Guide to Mastering Network Scanning

Nmap (Network Mapper) is one of the most powerful and versatile tools for network security analysis. In this complete guide, we will explore its advanced features and learn how to use it like an expert.

Introduction to Nmap

Nmap is an open-source tool that lets you:

• Scan networks
• Detect live hosts
• Identify services and versions
• Analyze vulnerabilities
• Map networks

Basic Commands

Simple Scan

# Basic scan of an IP address
nmap 192.168.1.1

# Scan of an address range
nmap 192.168.1.0/24

# Scan of a domain
nmap example.com

Advanced Options

# Fast scan (-F)
nmap -F 192.168.1.1

# Full scan (-sV to detect versions)
nmap -sV 192.168.1.1

# Stealth scan (-sS)
nmap -sS 192.168.1.1

# Scan with OS detection (-O)
nmap -O 192.168.1.1

Advanced Scanning Techniques

1. Stealth Scanning

# SYN Scan (stealthier)
nmap -sS -T4 192.168.1.1

# Scan with fragmentation
nmap -f 192.168.1.1

# Scan with random delay
nmap --randomize-hosts --scan-delay 5s 192.168.1.0/24

2. Service Detection

# Detailed version detection
nmap -sV --version-intensity 5 192.168.1.1

# Scan of specific ports
nmap -p80,443,8080 192.168.1.1

# Scan of all ports
nmap -p- 192.168.1.1

3. NSE Scripts

# Using vulnerability scripts
nmap -sV --script vuln 192.168.1.1

# Safe scan
nmap -sV --script safe 192.168.1.1

# Custom scripts
nmap --script custom-script.nse 192.168.1.1

Practical Use Cases

1. Security Audit

# Full scan with OS and service detection
nmap -sS -sV -O -p- 192.168.1.1

# Export results to XML
nmap -sS -sV -O -p- -oX scan_results.xml 192.168.1.1

2. Network Monitoring

# Periodic scan
while true; do nmap -sn 192.168.1.0/24; sleep 300; done

# Change detection
nmap -sn 192.168.1.0/24 > hosts.txt

3. Malware Detection

# Scan of ports known for malware
nmap -sV --script malware 192.168.1.1

# Backdoor detection
nmap -sV --script backdoor 192.168.1.1

Best Practices

1. Authorization

   • Always get permission before scanning
   • Comply with security policies
   • Document the scans you perform

2. Performance

   • Use appropriate timing options
   • Limit bandwidth if necessary
   • Optimize scans for your network

3. Security

   • Avoid aggressive scans on production systems
   • Use dedicated accounts
   • Keep Nmap up to date

Custom NSE Scripts

-- Example of a custom NSE script
description = [[
Detects vulnerable web services
]]

author = "Votre Nom"
license = "Same as Nmap"

categories = {"vuln", "safe"}

portrule = function(host, port)
    return port.state == "open" and port.service == "http"
end

action = function(host, port)
    -- Script logic
    return "Service web détecté"
end

Complementary Tools

1. Zenmap

   • Graphical interface for Nmap
   • Results visualization
   • Scan profile creation

2. Ndiff

   • Scan result comparison
   • Change detection
   • Difference reports

Conclusion

Nmap is an essential tool for:

• Security auditing
• Network monitoring
• Vulnerability detection
• Network mapping

By mastering these techniques, you will be able to:

• Run effective scans
• Identify vulnerabilities
• Secure your infrastructure
• Automate your security tasks

Remember that the power of Nmap must be used ethically and responsibly.