By Jackson Godwin | TechTrain Academy | Cybersecurity Governance & VAPT Specialist📧 info@jacksontechnology.com
If Kali Linux is the ethical hacker's workshop, then Nmap is the first tool you pick up every single time.
Before you can test anything — before you can find vulnerabilities, attempt exploits, or assess a target's security posture — you need to know what you are dealing with. What hosts are alive? What ports are open? What services are running? What operating systems are in use? What version of software is running on each service?
Nmap — Network Mapper — answers all of these questions. It is the world's most widely used network discovery and security auditing tool, and it is used in virtually every professional penetration testing engagement on the planet — including every VAPT assessment I have conducted across Nigerian financial institutions and government agencies.
In this guide — Part 2 of the TechTrain Academy Practical Penetration Testing Series — I will teach you Nmap from absolute zero to professional proficiency. By the end of this article you will know every essential scan type, understand what the output means, and be able to use Nmap the way professional penetration testers use it in real engagements.
| ⚠️ LEGAL DISCLAIMER: Only use Nmap on networks and systems you own or have explicit written permission to scan. Unauthorized scanning is illegal under Nigerian law and internationally. All practical exercises in this guide should be performed on your own home network, a virtual lab environment, or authorized practice platforms like TryHackMe. If in doubt — do NOT scan. Contact Jackson Godwin at info@jacksontechnology.com if you have questions about authorized testing. |
What is Nmap and Why Does Every Penetration Tester Use It?
Nmap (Network Mapper) is a free, open-source tool for network discovery and security auditing. Created by Gordon Lyon (known as Fyodor) in 1997, it has become the industry standard for network reconnaissance — the first phase of almost every penetration testing engagement.
Here is what makes Nmap indispensable:
- Host Discovery — Identify which IP addresses in a range have active systems
- Port Scanning — Discover which ports are open, closed, or filtered on a target
- Service Detection — Identify exactly which service and version is running on each open port
- OS Detection — Fingerprint the operating system running on a target
- Script Scanning — Run built-in scripts to identify vulnerabilities and gather detailed information
- Output Formats — Export results in multiple formats for reporting
| Nmap in Real Penetration Testing In every VAPT engagement I conduct for Nigerian organizations, Nmap is always the first tool I run. Before I can test anything else, I need to know what is on the network, what is running, and where the potential entry points are. A thorough Nmap scan of a target network can take 30 minutes — but it gives me the complete picture I need to plan the rest of the engagement strategically. |
Installing and Verifying Nmap
Nmap comes pre-installed on Kali Linux. But let us verify it is installed and up to date:
| COMMAND: Check Nmap version |
| nmap --version # Expected output: # Nmap version 7.94 ( https://nmap.org ) # Platform: x86_64-pc-linux-gnu |
If Nmap is not installed or you need to update it:
| COMMAND: Install or update Nmap |
| sudo apt update sudo apt install nmap -y # Verify installation nmap --version |
Understanding Nmap Syntax
Before diving into scan types, understand the basic Nmap syntax:
| COMMAND: Basic Nmap syntax structure |
| nmap [Scan Type] [Options] [Target] # Examples of valid targets: nmap 192.168.1.1 # Single IP address nmap 192.168.1.1-254 # IP range nmap 192.168.1.0/24 # CIDR notation (entire subnet) nmap example .com # Domain name nmap 192.168.1.1,5,10 # Multiple specific IPs |
The 10 Most Important Nmap Scans — With Full Explanations
These are the scans you will use in real penetration testing engagements. Learn each one thoroughly:
| SCAN 1 — Ping Sweep (Host Discovery) |
| Command: nmap -sn 192.168.1.0/24 What it does: Sends ICMP echo requests and TCP packets to identify which hosts in a network range are alive. Does NOT scan ports — only discovers live hosts. Fast and stealthy. Always run this first to map out which systems are active before deeper scanning. Output explained: Each result shows: Host (IP address) is up — followed by latency. Hosts that don't respond are considered down. The summary shows how many hosts are up out of the total scanned. Best used for: First step of any penetration test — map the live hosts on a target network before deciding which ones to scan more deeply. |
| SCAN 2 — SYN Scan (Default Stealth Scan) |
| Command: sudo nmap -sS 192.168.1.1 What it does: The most popular and default Nmap scan. Sends a SYN packet (first part of TCP handshake) to each port. If the port is open it responds with SYN-ACK. Nmap then sends RST (reset) instead of completing the handshake — making it faster and harder to detect in logs than a full TCP connect scan. Output explained: Each port shows: PORT (number/protocol), STATE (open/closed/filtered), SERVICE (what service typically runs there). Open = receiving connections. Closed = accessible but no service. Filtered = firewall blocking. Best used for: Default choice for port scanning. Use on targets where you have permission. Requires root/sudo privileges. |
| SCAN 3 — Service Version Detection |
| Command: sudo nmap -sV 192.168.1.1 What it does: Goes beyond identifying open ports to determine the exact service and version running on each port. Sends specially crafted probes to elicit version banners from services. This is critical for finding vulnerabilities — you need to know not just that SSH is running, but which version of SSH, as different versions have different vulnerabilities. Output explained: Adds VERSION column to output. Example: 22/tcp open ssh OpenSSH 8.2p1 Ubuntu. The version information tells you exactly what software to check for known CVEs (Common Vulnerabilities and Exposures). Best used for: After initial port discovery — use version detection to identify exploitable software versions. Critical for vulnerability research. |
| SCAN 4 — OS Detection |
| Command: sudo nmap -O 192.168.1.1 What it does: Analyzes TCP/IP stack fingerprints to determine the target operating system. Examines responses to carefully crafted packets and compares them against a database of known OS fingerprints. Accuracy is high when at least one open and one closed port are found. Output explained: Shows OS details section with the detected operating system and confidence percentage. Example: OS: Linux 4.15 - 5.6 (97%). Also shows network distance (hops) and uptime guess where available. Best used for: Understanding the target OS helps you select the right exploits and post-exploitation techniques. Essential for planning the attack strategy. |
| SCAN 5 — Aggressive Scan (All-in-One) |
| Command: sudo nmap -A 192.168.1.1 What it does: Combines OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute) into a single powerful scan. Gives you the most comprehensive information about a target in one command. Takes longer and is more noisy — easier to detect — but gives maximum intelligence. Output explained: Produces very detailed output including: open ports with versions, OS detection results, script scan results showing additional vulnerability information, and traceroute data showing the network path to the target. Best used for: When you want the most complete picture of a single host and stealth is not a priority. Ideal for internal network assessments. |
| SCAN 6 — Script Scan (NSE) |
| Command: sudo nmap -sC 192.168.1.1 What it does: Runs Nmap's default scripts from the Nmap Scripting Engine (NSE). NSE scripts can check for specific vulnerabilities, gather additional service information, detect misconfigurations, and perform authentication checks. There are over 600 NSE scripts covering almost every common service and vulnerability type. Output explained: Script results appear below each service's port entry, prefixed with the script name. Example: http-title script shows the title of any web page on port 80. smtp-commands shows available SMTP commands. Each script output provides additional intelligence for the penetration tester. Best used for: After basic port and service scanning — NSE scripts provide deeper intelligence about specific services and potential vulnerabilities. |
| SCAN 7 — Specific Port Scanning |
| Command: sudo nmap -p 22,80,443,3306 192.168.1.1 What it does: Scans only specific ports rather than all 65,535. Much faster when you know which ports you are interested in. You can specify individual ports, ranges, or combine them. Common ports for web servers: 80, 443. Database: 3306 (MySQL), 5432 (PostgreSQL). Remote access: 22 (SSH), 3389 (RDP). Output explained: Output is limited to the specified ports only. Much faster than full port scans. Useful when targeting specific services or when time is limited during an engagement. Best used for: When you want to quickly check specific services across many hosts, or when targeting particular services in a time-limited engagement. |
| SCAN 8 — Full Port Scan |
| Command: sudo nmap -p- 192.168.1.1 What it does: Scans all 65,535 TCP ports on the target. By default, Nmap only scans the top 1,000 most common ports. Using -p- ensures you do not miss services running on non-standard ports — a common technique used by administrators to hide services and by attackers to run malware on unusual ports. Output explained: Takes significantly longer than a default scan. Can take 10–30 minutes on a single host over a typical network. Results show all open ports including any running on unusual port numbers that would be missed by default scans. Best used for: When thoroughness is more important than speed — particularly for comprehensive penetration testing engagements where missing a service could mean missing a critical vulnerability. |
| SCAN 9 — UDP Scan |
| Command: sudo nmap -sU 192.168.1.1 What it does: Scans UDP ports — often overlooked but critically important. Many vulnerable services run on UDP: DNS (53), SNMP (161), DHCP (67/68), NTP (123), TFTP (69). UDP scans are slower than TCP scans because UDP is connectionless — Nmap must wait for timeouts to determine if ports are closed. Output explained: UDP port states: open (service responding), open|filtered (no response — could be open or filtered), closed (ICMP port unreachable received). Many false positives with UDP — results require manual verification. Best used for: Comprehensive penetration tests where missing a UDP service could leave critical attack surface unexamined. SNMP in particular is often misconfigured and reveals enormous amounts of information. |
| SCAN 10 — Vulnerability Scanning with NSE Scripts |
| Command: sudo nmap --script vuln 192.168.1.1 What it does: Runs all NSE scripts in the 'vuln' category — checking for known vulnerabilities in detected services. This goes beyond reconnaissance into actual vulnerability identification. Scripts check for issues like EternalBlue (MS17-010), Heartbleed, SSL vulnerabilities, default credentials, and many more. Output explained: Each identified vulnerability is listed under the relevant port with a description of the vulnerability, its CVE number where applicable, and sometimes a CVSS score indicating severity. Provides a starting point for exploitation in the next phases of a penetration test. Best used for: After service detection — to quickly identify potentially exploitable vulnerabilities. Results should be verified manually as false positives are possible. |
Saving Nmap Output — Essential for Professional Reports
In professional penetration testing, you must document everything. Nmap provides several output formats:
| COMMAND: Save output in different formats |
| # Normal output (human readable) sudo nmap -sV 192.168.1.1 -oN scan_results.txt # XML output (for tools like Metasploit) sudo nmap -sV 192.168.1.1 -oX scan_results.xml # Grepable output (for processing with grep/awk) sudo nmap -sV 192.168.1.1 -oG scan_results.gnmap # All formats at once (recommended) sudo nmap -sV 192.168.1.1 -oA scan_results # Creates scan_results.nmap, .xml and .gnmap |
Nmap Timing Templates — Speed vs Stealth
Nmap has 6 timing templates that control how fast scans run. Faster scans are louder and more likely to trigger IDS/IPS alerts. Slower scans are quieter but take longer:
| FLAG | NAME | SPEED / STEALTH | USE WHEN |
| -T0 | Paranoid | Extremely slow — very stealthy | Evading IDS on sensitive targets |
| -T1 | Sneaky | Very slow — stealthy | Avoiding detection during long engagements |
| -T2 | Polite | Slow — reduces bandwidth usage | Avoiding network disruption |
| -T3 | Normal | Default speed | Standard penetration testing |
| -T4 | Aggressive | Fast — may trigger alerts | CTF challenges or fast internal scans |
| -T5 | Insane | Very fast — loud, unreliable | Only on extremely fast networks |
Practical Exercise — Full Target Reconnaissance
Now let us put everything together. In your Kali Linux virtual machine, run this complete reconnaissance sequence against your home network or a TryHackMe machine:
| Before You Begin Ensure you are scanning your OWN home network or a machine on TryHackMe/Hack The Box that you have authorization to scan. Replace 192.168.1.0/24 with your actual network range. To find your network range, run: ifconfig and look at your IP address. |
| COMMAND: Step 1 — Host Discovery |
| sudo nmap -sn 192.168.1.0/24 # Identify all live hosts on your network # Note down the IP addresses of live hosts |
| COMMAND: Step 2 — Quick Port Scan of a Target |
| sudo nmap -sS -T4 192.168.1.1 # Replace 192.168.1.1 with a live host from Step 1 # Identify open ports quickly |
| COMMAND: Step 3 — Service and Version Detection |
| sudo nmap -sV -sC 192.168.1.1 # Identify services, versions, and run default scripts # Note all service versions for vulnerability research |
| COMMAND: Step 4 — OS Detection + Aggressive Scan |
| sudo nmap -A -T4 192.168.1.1 # Get OS detection, versions, scripts and traceroute # Most complete picture of the target |
| COMMAND: Step 5 — Full Port Scan |
| sudo nmap -p- -sV -T4 192.168.1.1 -oA full_scan # Scan ALL 65535 ports and save all output formats # Check for services on non-standard ports |
| COMMAND: Step 6 — Vulnerability Check |
| sudo nmap --script vuln 192.168.1.1 # Run vulnerability scripts against the target # Review and document any identified vulnerabilities |
Nmap Quick Reference Cheat Sheet
Save this as your go-to reference during penetration testing engagements:
| COMMAND | WHAT IT DOES |
| nmap -sn [target] | Ping sweep — find live hosts |
| nmap -sS [target] | SYN stealth scan (default) |
| nmap -sV [target] | Service version detection |
| nmap -O [target] | OS detection |
| nmap -A [target] | Aggressive scan (all-in-one) |
| nmap -sC [target] | Default NSE script scan |
| nmap -p- [target] | Scan all 65535 ports |
| nmap -sU [target] | UDP port scan |
| nmap --script vuln [target] | Vulnerability scripts |
| nmap -T4 [target] | Aggressive timing |
| nmap -oA [filename] [target] | Save all output formats |
| nmap -p 22,80,443 [target] | Scan specific ports |
| nmap -iL hosts.txt | Scan targets from file |
| nmap --open [target] | Show only open ports |
| nmap -v [target] | Verbose output |
Conclusion — You Now Think Like a Penetration Tester
Nmap is not just a tool — it is a way of thinking. When a professional penetration tester looks at a target network, the first question is always: what is there and what is running? Nmap is how you answer that question systematically, thoroughly, and professionally.
Master the 10 scan types in this guide. Practice them in your home lab and on TryHackMe until running the right scan for each situation becomes instinct. Save the cheat sheet and refer to it during your practice sessions.
In Part 3 of this series, we go deeper into reconnaissance — covering passive information gathering, OSINT techniques, and tools like Maltego and theHarvester that let you build a comprehensive picture of a target before touching a single system.
If you have questions about anything in this guide, email Jackson Godwin directly at jacksontechnology05@gmail.com — he personally responds to student questions.
| Want to Learn Nmap at a Professional Level? TechTrain Academy's Ethical Hacking & VAPT program covers Nmap and all penetration testing tools in a fully practical, hands-on lab environment. Train with real scenarios used in professional VAPT engagements across Nigerian banks, fintechs, and government agencies. Enroll Now | Email: jacksontechnology05@gmail.com | Visit TechTrain Academy |
| Have a question about this tutorial? Reach Jackson Godwin directly: 📧 jacksontechnology05@gmail.com Or enroll in TechTrain Academy for full hands-on training with live instructor support. |
| ⬅ PREVIOUS Part 1: Kali Linux Setup & Basics | NEXT ➡ Part 3: Reconnaissance & OSINT |
| About the Author Jackson Godwin is a Cybersecurity Governance & VAPT Specialist and founder of TechTrain Academy. With over 40 web and mobile application security assessments conducted across Nigerian financial institutions, government agencies, and enterprises, Jackson brings real-world penetration testing experience to every tutorial in this series. Questions? Email: info@jacksontechnology.com |
TAGS: Nmap tutorial Nigeria, Nmap network scanning Nigeria, Nmap commands guide, Nmap penetration testing Nigeria, ethical hacking network scanning Nigeria, TechTrain Academy, Jackson Godwin VAPT, info@jacksontechnology.com