Nmap: A Deep Dive for Vulnerability Scanning and Penetration Testing

Every infrastructure pen test starts here.

Nmap — Network Mapper — was first released by Gordon Lyon in 1997. Nearly three decades later, it remains the single most important tool in the penetration tester's arsenal for network reconnaissance. Not because it's the flashiest, not because it does the exploitation, but because it answers the questions that every other tool depends on: what's on this network, what's it running, and where are the doors?

Every infrastructure engagement we conduct begins with Nmap. Before BloodHound maps Active Directory, before Responder poisons broadcast traffic, before Burp Suite intercepts web requests — Nmap maps the terrain. It discovers hosts, identifies open ports, fingerprints services and operating systems, and through its scripting engine, performs the first layer of vulnerability assessment. The output of an Nmap scan is the attack surface — and everything that follows is built on it.

Most administrators have run nmap -sS target and looked at the port list. That's roughly 10% of the tool's capability. This article covers the rest.

Finding what's alive before you scan it.

Before scanning ports, Nmap needs to know which hosts are alive on the network. By default, Nmap sends an ICMP echo request, a TCP SYN to port 443, a TCP ACK to port 80, and an ICMP timestamp request. If any of these elicit a response, the host is marked as "up" and port scanning begins. But this default behaviour doesn't always work — firewalls block ICMP, hosts are configured to ignore pings, and network segmentation may prevent certain probe types from reaching the target.

Choosing the right scan for the right situation.

Once live hosts are identified, Nmap probes their ports to determine which are open, closed, or filtered. The scan type determines how this probing is performed — and each type has different trade-offs in speed, stealth, accuracy, and privilege requirements.

For the majority of penetration testing engagements, the core scan is -sS (SYN scan) combined with -sV (version detection) and -sU (UDP scan on a targeted port list). This combination identifies which ports are open, what services and versions are running, and covers the UDP services that TCP-only scanning misses.

Scanning smart — not just scanning everything.

There are 65,535 TCP ports and 65,535 UDP ports. Scanning all of them on every host is thorough but impractical on large networks. Nmap's default scan covers the 1,000 most common ports — which accounts for approximately 93% of the TCP ports typically found open. But that remaining 7% is where interesting things hide.

Identifying what's running — not just what's open.

An open port is a fact. A service version is actionable intelligence. An operating system fingerprint is context that shapes the entire attack strategy. Nmap's detection capabilities transform a list of open ports into a detailed profile of each target.

Where Nmap becomes a vulnerability scanner.

The Nmap Scripting Engine (NSE) transforms Nmap from a port scanner into a vulnerability assessment platform. NSE scripts — written in Lua — can enumerate services, check for specific vulnerabilities, extract information, brute-force credentials, and even exploit certain weaknesses. Nmap ships with over 600 scripts, and custom scripts can be written for specific engagement needs.

Controlling speed, stealth, and network impact.

Nmap's timing controls determine how aggressively it scans — balancing speed against stealth, accuracy, and the risk of overwhelming the target network or triggering IDS alerts.

For professional engagements, -T4 is the standard for internal testing and -T3 for external testing. Beyond the templates, individual timing parameters can be fine-tuned: --min-rate and --max-rate set packets per second, --max-retries controls probe retransmission, and --host-timeout sets a per-host time limit to prevent a single unresponsive host from stalling the entire scan.

Getting past filters that try to hide the truth.

Firewalls, intrusion detection systems, and packet filters are designed to prevent or detect scanning. During a penetration test, part of the assessment is determining what the firewall reveals and what it conceals — and whether evasion techniques can bypass the filtering to discover the true attack surface.

Evasion techniques are part of the penetration tester's methodology — they test whether the organisation's defensive controls can be bypassed. A finding that says "the IDS detected the scan" is valuable. A finding that says "fragmenting the scan packets bypassed the IDS entirely" is more valuable.

Saving results for analysis and reporting.

Nmap's output is only useful if it's captured in a format that supports analysis, correlation with other tools, and inclusion in reports. Running a scan without saving the output is a mistake you make once.

How Nmap fits into a real engagement.

In practice, a penetration tester doesn't run a single Nmap scan. They run a structured series of scans, each building on the last — progressively refining the picture of the target environment from broad discovery to deep, targeted analysis.

Each phase narrows the focus: from the entire network down to live hosts, from live hosts down to interesting services, from interesting services down to confirmed vulnerabilities. The output of each phase feeds the next — and the XML output feeds directly into tools like Metasploit, Searchsploit, and custom reporting scripts that drive the rest of the engagement.

Mistakes that compromise your scan.

The scans you'll use 90% of the time.

The bottom line.

Nmap is the foundation of infrastructure penetration testing. It answers the questions that every subsequent tool and technique depends on: what hosts are alive, what ports are open, what services and versions are running, what operating systems are in use, and — through the Nmap Scripting Engine — which known vulnerabilities are present. No other single tool provides this breadth of capability.

The difference between a basic Nmap user and a professional pen tester isn't the tool — it's the methodology. Tiered scanning from broad discovery to deep analysis. UDP coverage that most people skip. NSE scripts that transform port data into vulnerability intelligence. Output formats that feed the rest of the engagement. And the discipline to save every scan, review every result, and follow every lead.

Nmap won't exploit a vulnerability, capture a credential, or write a report. But it will tell you exactly where to look — and in penetration testing, knowing where to look is half the battle.