Nmap — The Network Mapper for Pentesters
Before you can attack or defend a system, you need to know what is running on it. Port scanning is the reconnaissance technique that answers that question, and Nmap is the tool that every professional penetration tester reaches for first.
What Nmap does
Nmap (Network Mapper) sends precisely crafted network packets to a target host and analyzes the responses. From those responses, it builds a picture of:
- Which hosts are online — ping sweeps identify live targets before you invest time scanning them.
- Which ports are open — TCP and UDP port scanning reveals which services are exposed to the network.
- What software is running — service version detection (
-sV) identifies the exact application and version listening on each port, which determines which CVEs apply. - What operating system is running — OS fingerprinting (
-O) infers the target OS from TCP/IP stack behavior. - Whether services are vulnerable — the Nmap Scripting Engine (
--script vuln) runs automated checks for hundreds of known CVEs directly from the scan output.
How port scanning works
When you run Nmap against a target, it sends network packets to each port you specify. If a service is listening on a TCP port, the target's operating system responds with a SYN-ACK packet as part of the TCP three-way handshake. Nmap records this as an open port. If nothing is listening, the OS responds with RST — closed. If a firewall drops the probe with no response, Nmap records the port as filtered.
The specific type of scan matters. A SYN scan (-sS) sends only the first handshake packet (SYN) and then immediately resets the connection with RST before it completes. Because the connection never fully establishes, many application-layer logging systems do not record the attempt. This is why SYN scans are considered "stealthier" than full TCP connect scans (-sT), which complete the handshake and are more likely to appear in service logs.
The Nmap Scripting Engine
The NSE is what transforms Nmap from a port scanner into a lightweight vulnerability scanner. NSE scripts are written in Lua and organized into categories: safe, discovery, auth, vuln, brute, exploit, and dos. The vuln category contains scripts that send probes mimicking known attack patterns and report CVE identifiers for any services they find vulnerable.
What you will accomplish in this lab
The panel on the right is a simulated Nmap terminal running against a target host at 192.168.1.100. You will:
- Run a basic port scan to see what ports are open.
- Run a service version scan (
-sV) to identify the software running on each port. - Run the NSE vuln script (
--script vuln) and locate a CVE identifier in the output for the Apache service. - Submit that CVE number to complete the lab's key challenge.
By the end, you will have hands-on familiarity with Nmap's most important flags, the structure of NSE vulnerability output, and the specific Apache vulnerability CVE-2021-41773 — a critical finding you would be required to report immediately in any real penetration test engagement.
Legal reminder: In this lab you are working against a simulated environment. In the real world, you must only run Nmap against systems you own or have explicit written authorization to test. Unauthorized port scanning is illegal in most jurisdictions.