Before you can test a target, you have to know what is there. Which hosts are alive? Which ports are open? What software answers on each one? That first map of the attack surface is reconnaissance, and on the network layer the staple tool for it is Nmap (Network Mapper).
This lesson teaches you to drive Nmap against a web target: discover the host, scan its ports, fingerprint the service and version on each open port, and run the HTTP-focused scripts that turn a bare "port 3000 is open" into "port 3000 is a Node.js Express app serving NovaCart". Those findings feed almost everything that follows — the web port you find here becomes the target for Nikto, WPScan, sqlmap, and Metasploit.
Scope warning. Nmap is an active tool: it sends packets that the target sees and usually logs. Port scanning a host you do not own or hold explicit written authorisation to test is intrusive and, in many places, unlawful — a scan is the classic opening move an intrusion-detection system is tuned to catch. Point Nmap only at the bundled NovaCart, at systems you own, or at targets covered by a signed scope or an in-scope bug-bounty asset. This is the unchanging rule from the ethics and authorization lesson.
A quick anchor if networking is new to you: a port is a numbered channel (0–65535) that an operating system uses to route incoming traffic to the right service — web servers commonly listen on port 80 (HTTP) or 443 (HTTPS). A TCP handshake is the three-step exchange (SYN → SYN-ACK → ACK) that two machines perform before exchanging data; Nmap learns which ports are "open" by probing this handshake and watching how the host responds.
In this lesson you will:
- Separate the two phases Nmap works in — host discovery ("is it up?") and port scanning ("what is open?").
- Learn the common scan types (
-sS/-sT), port selection (-p,-F,--top-ports), and service/version detection with-sV. - Use the Nmap Scripting Engine and the **
http-*** scripts (http-title,http-headers,http-enum) to fingerprint a web service. - Read Nmap's output, save it (
-oA), and understand scan noise and timing (-T). - See how the web port and version banner (the version string a service advertises about itself, for example
nginx 1.25.3) you produce here feed the rest of the Kali toolchain.
Prerequisites: networking-fundamentals-part1 (TCP/IP model, ports, and the TCP three-way handshake) is the background assumed throughout this lesson — terms like "open port", "SYN scan", and "TCP connect" appear in the very next step. If any of those are unfamiliar, complete that lesson first. This is also the first lesson in the category labelled intermediate: it covers more flags and concepts in a single pass than the beginner proxy lesson. Each flag is explained as you meet it; you do not need to memorise them all at once.
Estimated time: ten to twelve minutes.
When you are ready, send the Continue signal.