Port Scanning with Nmap

#Discovering Open Doors with Nmap#link

Now that we have mapped the target's DNS infrastructure and identified live hosts, the next step in our active reconnaissance workflow is port scanning. Port scanning reveals which network ports are open on a target host — essentially showing us which doors and windows are unlocked. Nmap (Network Mapper) is the industry-standard tool for this task, and mastering it is non-negotiable for any aspiring penetration tester.

Understanding TCP and UDP Ports

Network services communicate over ports — numbered endpoints ranging from 0 to 65535. The first 1024 ports are well-known ports assigned to common services. Ports use two protocols: TCP (connection-oriented, reliable) and UDP (connectionless, fast). A port can be in one of three states:

• ▪Open — A service is actively listening and will accept connections.
• ▪Closed — The port is accessible but no service is listening.
• ▪Filtered — A firewall or network device is blocking the port, preventing determination of its state.

Nmap Scan Types

Nmap supports multiple scan types, each with different characteristics regarding speed, stealth, and reliability. Understanding when to use each type is crucial.

Your First Nmap Scan

Let us start with a basic SYN scan against a single target. This is the most common starting point in any penetration test.

This scan probed all 65535 TCP ports and found 7 open ports. The target is running FTP, SSH, two web services, Windows file sharing, and a MySQL database. Each of these is a potential attack surface.

Scanning Multiple Targets and Ranges

In real engagements, you will rarely scan a single host. Nmap supports various target specifications.

The --top-ports 100 flag tells Nmap to scan only the 100 most common ports, which dramatically reduces scan time while still catching the majority of services. This is ideal for initial sweeps of large networks.

Timing and Performance

Nmap offers six timing templates that control scan speed and stealth. Choosing the right template depends on your network conditions and detection avoidance requirements.

Saving Scan Results

Professional penetration testers always save their scan results in multiple formats for reporting and later analysis.

The -oA flag creates three files: scan_results.nmap (human-readable), scan_results.xml (machine-parseable), and scan_results.gnmap (grepable). The XML format is especially important because it can be imported into tools like Metasploit and reporting platforms.