Before any penetration test begins, the first step is always the same: know your target. Nmap (Network Mapper) is the industry standard for this — a tool that identifies what devices exist on a system or network, which ports are open, and what service is running on each.
Important: every command in this tutorial should only be run against systems and networks you have explicit authorization to test — like your own personal lab or a formal penetration-testing engagement. Using these tools against any network or system without permission is a crime.
Installing Nmap
It's pre-installed on pentest-focused Linux distributions (like Kali); otherwise:
sudo apt install nmap
A Windows version is also available from the official nmap.org site.
Step 1: The simplest possible scan
nmap 192.168.1.10
This runs a quick scan across the 1000 most common ports, showing which are Open, Closed, or Filtered (meaning a firewall didn't respond).
Step 2: Scanning a specific port range
nmap -p 1-1000 192.168.1.10
nmap -p 22,80,443 192.168.1.10
With -p you can specify exactly which ports to check — either a range or a comma-separated list.
Step 3: Detecting service versions
nmap -sV 192.168.1.10
Just knowing port 80 is open isn't enough; -sV attempts to determine exactly what software and version is running on that port (e.g., Apache 2.4.41) — critical information for identifying known vulnerabilities for that specific version.
Step 4: OS detection
nmap -O 192.168.1.10
By analyzing the target's TCP/IP stack behavior, Nmap makes an educated guess about which operating system (Windows, Linux, and roughly which version) it's running.
Step 5: A stealthier scan (SYN Scan)
sudo nmap -sS 192.168.1.10
Unlike a regular scan that completes a full TCP connection, a SYN scan only sends the initial SYN packet and tears it down before the handshake completes — it's faster and doesn't get logged in some basic logs (though modern intrusion detection systems usually catch it too).
Step 6: A comprehensive scan (Aggressive Scan)
nmap -A 192.168.1.10
The -A option combines version detection, OS detection, traceroute, and running basic scripts all at once — good for quickly and thoroughly profiling a target early in a penetration test.
Step 7: Saving output for reporting
nmap -A 192.168.1.10 -oN scan-result.txt
In a real penetration test, documenting everything is essential — the -oN option saves output to a readable text file (-oX for XML and -oG for grepable formats are also available).
Why is Nmap the first tool you should learn?
Every later stage of a penetration test — from vulnerability identification to exploitation — depends on the map Nmap draws in this very first step. Mastering Nmap is exactly the starting point we focus on in my security and penetration testing courses, including the CEH track.
Blog