📱 Mobile Security Tips
Sarah Chen — iOS Security Specialist
What is Nmap?
Nmap (Network Mapper) is an open-source tool designed for network exploration and security auditing. Widely used by security professionals and penetration testers, Nmap can discover hosts and services on a computer network, thus creating a ‘map’ of the network.
Installation
To install Nmap, use the following command depending on your operating system:
# On Debian/Ubuntu sudo apt install nmap # On CentOS/RHEL sudo yum install nmap # On macOS using Homebrew brew install nmap
Basic Syntax
The basic syntax for using Nmap is as follows:
nmap [Scan Type(s)] [Options] {target specification}
Discovery
Use these commands to discover hosts and services.
Basic Host Discovery
nmap -sn 192.168.1.0/24
-sn: Ping scan; disables port scanning. Only checks for active hosts.
Service Discovery
nmap -sV 192.168.1.5
-sV: Service version detection; provides more details about running services.
Scanning
These commands are useful for various types of scanning.
TCP Connect Scan
nmap -sT 192.168.1.5
-sT: TCP connect scan; performs a full TCP connection.
Stealth SYN Scan
nmap -sS 192.168.1.5
-sS: SYN scan; faster and stealthier than a TCP connect scan.
Exploitation
Nmap can also facilitate exploitation through scripting.
Using Nmap Scripting Engine (NSE)
nmap --script vulnerability -p 80 192.168.1.5
–script: Allows running a script; here, we detect vulnerabilities on port 80.
Analysis
After scanning, analyze the output effectively.
Output Formats
nmap -oA my_scan 192.168.1.5
-oA: Outputs the scan in all formats (normal, XML, and grepable).
Evasion
To evade detection, consider these options.
Fragmenting Packets
nmap -f 192.168.1.5
-f: Fragment packets to evade intrusion detection systems.
Reporting
To generate reports based on your scans.
Using XML for Reporting
nmap -oX report.xml 192.168.1.5
-oX: Outputs scan results in XML format.
Quick Reference Table
| Flag | Description |
|---|---|
| -sn | Ping scan; doesn’t perform port scanning. |
| -sV | Service/version detection. |
| -sT | TCP connect scan. |
| -sS | Stealth SYN scan. |
| –script | Run scripts during the scan. |
| -oA | Output in all formats. |
| -f | Fragment packets. |
| -oX | Output in XML format. |
Pro Tips
- Always combine -sS with -v for detailed output.
- Use -p to specify port ranges to speed up scans.
- Pipe output into tools like grep to filter results efficiently.
- Leverage the –top-ports option to scan the most common ports quickly.
Real-World Examples
Example 1: Comprehensive Scan
nmap -sS -sV -O -p 1-65535 -oA full_scan 192.168.1.5
This command performs a comprehensive scan including service version detection, OS detection, and saves the output in all formats.
Example 2: Targeted Vulnerability Scan
nmap --script http-vuln* -p 80 192.168.1.5
Targets HTTP vulnerabilities using specific Nmap scripts on port 80.