📱 Mobile Security Tips
Sarah Chen — iOS Security Specialist
What is Nmap?
Nmap (Network Mapper) is a powerful open-source tool for network discovery and security auditing. It is used to discover hosts and services on a computer network by sending packets and analyzing the responses. Nmap is widely used by security professionals for penetration testing and network inventory.
Installation
Nmap can be installed on various platforms, including Linux, Windows, and macOS. Below are the installation commands for each platform:
- Linux: Use your package manager, for example, on Ubuntu:
sudo apt install nmap
- Windows: Download the installer from the official Nmap website.
- macOS: Use Homebrew:
brew install nmap
Basic Syntax
The basic syntax for running Nmap is:
nmap [options] [target]
Where [target] can be an IP address, range, or hostname.
Discovery
Host Discovery
Use Nmap to discover live hosts on a network:
nmap -sn 192.168.1.0/24
This command sends ICMP echo requests to the entire subnet. Replace 192.168.1.0/24 with your target range.
Service Version Detection
To discover services running on open ports and their versions:
nmap -sV 192.168.1.1
Scanning
TCP Connect Scan
This is a simple scan that establishes a full TCP connection:
nmap -sT 192.168.1.1
SYN Scan
Often referred to as “stealth” scan:
nmap -sS 192.168.1.1
Exploitation
Service Specific Exploitation
You can use Nmap scripts to exploit known vulnerabilities:
nmap --script=vuln 192.168.1.1
Analysis
Nmap Scripting Engine (NSE)
Use NSE for advanced scripting capabilities:
nmap --script http-enum -p80 192.168.1.1
Evasion
Reduce Detection
Change scan timing to make it less noticeable:
nmap -T2 192.168.1.1
Reporting
Output Formats
Nmap can output results in various formats:
nmap -oN output.txt 192.168.1.1
Quick Reference Table
| Flag | Description |
|---|---|
| -sS | SYN scan |
| -sT | TCP connect scan |
| -sn | Ping scan (no port scan) |
| -sV | Service version detection |
| –script | Run a script against the target |
Pro Tips
- Always run sandboxed Nmap scans on unknown hosts to avoid detection.
- Use the `-Pn` flag to skip host discovery if you know the target is live.
- The `–top-ports` flag can greatly reduce scan time by scanning only the most common ports.
Real-World Examples
Full Network Scan
nmap -sP 192.168.1.0/24 -oN report.txt
This scans the entire subnet and outputs results to report.txt.
Vulnerability Scan
nmap --script=vuln 192.168.1.1
This scans for vulnerabilities on a specified IP address.