Why Nmap is needed when scanning the network
Nmap (Network Mapper) determines which hosts are alive in the network, which ports on them are open, which services listen to these ports and under which OS the machine works. In terms of MITRE ATT&CK, it is Active Scanning (T1595, Reconnaissance) and Network Service Discovery (T1046, Discovery) – exactly what the attacker does during the exploration stage before any penetration. Read more in our guide to creating ctf tasks.
In CTF and in preparation for pwn-tasks Nmap solves three problems. The first is to detect entry points: each open port is a working service and a potential attack vector. Missed a non-standard port - missed the flag. The second is to define a technology stack: the Apache version, the type of SSH server, the presence of an SMB suggest which exploits are applicable. The third is to narrow the scope and move from blind selection to targeted work on specific services.
Russian-speaking guides from the search top list the teams and explain the flags. But none gives a working algorithm: what to run first, what is the second and what to do with the resulting conclusion. I built this article like this algorithm — from the installation to the finished attack plan on the CTF box.
Installing Nmap and First Start
On Kali Linux and Parrot OS Nmap pre-installed — check through nmap --version. On pure Debian/Ubuntu: sudo apt update && sudo apt install nmap. On Fedora: sudo dnf install nmap. On macOS via Homebrew: brew install nmap. On Windows is a .exe installer with nmap.org, after which the scanner is available from cmd or PowerShell.
The first rule that saves nerves: run Nmap with sudo. Without root privileges, Nmap cannot send raw packages and is forced to switch from SYN scan (-sS) on TCP Connect (-sT). Saw in the terminal "TCP connect scan requested..." - restart with sudo. SYN-scan is faster and quieter: it does not complete the TCP handshake, which means that there are fewer records in the logs of the target machine. According to the documentation nmap.org SYN-scan - default when launched with root rights.
The most basic challenge: sudo nmap 10.10.10.5. Without additional flags, Nmap will check the 1000 most common TCP ports (the list is sewn in the nmap-services file) and display the table with the state of each. For the first acquaintance enough for the eyes, but for the CTF - absolutely little. Why, I will explain further.
How to read Nmap output: open,, closed filtered
Before you understand the types of scans, you need to learn to read the result. This is a key skill for nmap intelligence – if you confuse filtered and closed, you will spend time on ports blocked by firewall.
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
139/tcp filtered netbios-ssn
445/tcp closed microsoft-ds
8080/tcp open http-proxy
open - the service listens to the port, he is ready to accept connections. That's your goal in the CTF. Each open port is a separate mini-investigation.
closed – the port is available (the machine is responsible for the RST package, in fact says “there is no one here”), but there is no active service for it. The CTF is usually not interesting, but on a real pentest, a closed port can open after certain actions.
filtered - the package is gone, there's no answer. The firewall or network filter has dropped the request silently. Nmap cannot determine whether the port is open or closed. See filtered on the port that logically should be opened — try -Pn or change the type of scan.
open|filtered is typical for UDP scanning. UDP does not send confirmations, and Nmap is not sure: the port is open or the firewall silently dropped the package.
According to the documentation nmap.org there is still a state unfiltered – the port responds to requests, but Nmap cannot determine whether it is open or closed. Found in ACK scanning (-sA), which is used to analyze the rules of the firewall. In practice, CTFs are rarely found.
Nmap Port Scanning: Scan Types and When to Apply
Nmap supports more than a dozen types of scanning: FIN, Xmas, NULL, Idle, Maimon and others. Most are sharpened by the circumvention of specific firewalls and IDS - situations that are extremely rare in CTF-tasks. There are three nmap bases for.
SYN-scan – the basis of network exploration for the pentest
Starts by default if there is root: sudo nmap -sS 10.10.10.5. Mechanics rests on a TCP handshake: Nmap sends a package with the flag SYN (the first step of the three-step handshake). The target is SYN/ACK – the port is open, and Nmap immediately throws the RST, breaking the connection before it is established. The RST is coming – the port is closed. Silence – filtered.
Why SYN is better than a complete connection: faster and fewer records in the logs of the target machine (technically, the connection is not established, although modern IDS still see it). According to MITRE ATT&CK, this is Scanning IP Blocks (T1595.001) – sending sensing packages to determine active services.
In practice, almost all of your CTF scans will be a SYN scan. Exceptions – situations without root or the need to check UDP.
TCP Connect – when there are no root privileges
nmap -sT 10.10.10.5 works without sudo. Nmap uses a system call connect() and establish a full TCP connection to each port. The result is similar (open/closed/filtered), but the method is slower and more noticeable – the target server logs every completed connection. In CTF, it is rarely used: there is usually root on the attacking machine.
UDP scan – ports that all forget
sudo nmap -sU --top-ports 50 10.10.10.5 checks the 50 most common UDP ports. UDP-scan is fundamentally slower than TCP: the protocol does not send confirmations, and Nmap is forced to wait for the ICMP error Port Unreachable (port closed) or silence (open|filtered).
Why it is necessary: DNS (53), SNMP (161), TFTP (69), IKE (500) - all these are UDP services that regularly pop up in CTFs and on pentests. SNMP with community string "public" can give the configuration of the equipment. DNS is vulnerable to zone transfer. TFTP allows you to download files without authentication. Skip UDP — skip a whole class of vulnerabilities.
Typical error: running a full UDP scan (-p-). It takes a watch. Use --top-ports 100 or expressly specify the ports: -p 53,69,123,161,500.
Summary table for quick orientation:
Scan type Flag Need a root Speed When to use
SYN -sS Yeah High Main scan in CTF and Pentest
TCP Connect -sT No Average No root privileges
UDP -sU Yeah Low Search DNS, SNMP, TFTP
Nmap Network Intelligence: Host Detection and Service Detection
Detection of live hosts in the network
For network-tasks CTF and internal pentests, you often need to find all the live machines in the subnet. Ping sweep: sudo nmap -sn 192.168.1.0/24. Flag -sn Disables port scanning — Nmap only checks the availability of hosts through the combination of ICMP echo, TCP SYN (port 443) and TCP ACK (port 80). According to MITRE ATT&CK this Remote System Discovery (T1018).
If the ICMP is blocked (frequent situation in CTF labs), add explicit TCP samples: sudo nmap -sn -PS22,80,443 192.168.1.0/24 – will send SYN-packs to the specified ports.
In CTF, where you are given a specific IP address, ping sweep is not necessary. But you need a flag -Pn: it skips the host discovery phase and counts the target alive. Without -Pn Nmap may decide that the host is dead (the firewall has sampled) and will not start scanning the ports at all. One of the most frequent mistakes in those who only master Nmap – I myself stepped on it in the first week.
Detection of service and operating system versions
Finding open ports is half the case. We need to understand what's behind them. Flag -sV includes the definition of versions: Nmap connects to each open port, sends a series of probes and compares the answers with the nmap-service-probes signature base.
The difference is tangible: without -sV in the SERVICE column, you can see simply "http", and with it - "Apache httpd 2.4.49 ((Ubuntu))". And this is already actionable information: Apache 2.4.49 contains known path traversal vulnerability (CVE-2021-41773). According to MITRE ATT&CK, the definition of versions is the collection of data on Software on target systems (T1592.002, Reconnaissance).
Parameter --version-intensity (from 0 to 9) manages the number of probes sent. 0 — only the most likely, 9 — all available. For CTFs, default (7 according to nmap.org) – the balance between speed and accuracy.
Flag -O determines the operating system by the features of TCP/IP-stack: TTL, the size of the TCP window, the TCP options, the behavior of the ICMP. Works better when there are both open and closed ports for a purpose – Nmap analyzes different types of answers for a more accurate fingerprint. Can be added --osscan-guess for less confident, but still useful assumptions.
Combination sudo nmap -sC -sV -O -p <порты> <цель> – working horse of the second stage. There is a short option: -A includes simultaneously -sV, -O, default NSE scripts and traceroute. But -A slower, so it is better to use in the CTF point-by-point - after a quick full scan has already found interesting ports.
Nmap teams for beginners: NSE scripts and enumeration
Nmap Scripting Engine (NSE) is a built-in script engine on Lua. Scripts lie in /usr/share/nmap/scripts/ and cover tasks from collecting banners to finding specific vulnerabilities. For beginners, three approaches are critical.
Default scripts are triggered through sudo nmap -sC <цель> (Equivalent --script=default). Set of secure scripts: receiving SSH host key, HTTP headers, listing SMB ball, basic information about DNS. In CTF, this is a mandatory step after the discovery of ports – default scripts often pull out details that are not visible when simply scanning.
Category vuln: sudo nmap --script vuln -p 80,443 <цель> checks the found services for known vulnerabilities. It does not replace a full-fledged vulnerability scanner, but in the CTF can instantly point to the vector to detect Heartbleed on port 443 or ms17-010 on SMB. According to MITRE ATT&CK, this is Vulnerability Scanning (T1595.002).
Specific script: sudo nmap --script http-enum -p 80 <цель> Searches the typical paths on the web server (/admin, /phpmyadmin, /wp-login.php). For SMB useful smb-enum-shares, for DNS — dns-zone-transfer, for SSL/TLS — ssl-enum-ciphers. Find the Right Script: ls /usr/share/nmap/scripts/ | grep <ключевое_слово>.
Nmap for CTF: step-by-step workflow solution network-task
A specific sequence that I run on every HackTheBox and TryHackMe box. Three stages - from black box to full service map. Suitable for network-tasks CTF, and for preparation for pwn-category.
Step 1 – Fast scan of all ports
sudo nmap -sS -p- --min-rate 5000 -Pn 10.10.10.5 -oA nmap/allports
I will analyze each element: -sS – SYN-scan; -p- – all 65535 ports (without this check only the top 1000, and in the CTF the flag often hangs on port 31337 or 49152); --min-rate 5000 – a minimum of 5000 packages per second (in CTF-lab safely, on a real pentest reduce); -Pn – consider the goal alive; -oA nmap/allports – save the result in all formats.
Time: 15-40 seconds. The result is a complete list of open ports.
Step 2 – detailed scan with version definition
Let’s say step 1 found ports 22, 80, 3306, 8443. Target detailing: sudo nmap -sC -sV -O -p 22,80,3306,8443 10.10.10.5 -oA nmap/detailed.
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
3306/tcp open mysql MySQL 5.7.38-0ubuntu0.18.04.1
8443/tcp open ssl/http Apache Tomcat 9.0.31
OS details: Linux 4.15 - 5.6
From the output, you can see the attack surface: Ubuntu, Apache with a specific version, MySQL (check default root:root), Tomcat 9.0.31 (check Tomcat Manager and a pair of tomcat:tomcat). The scan takes 1-3 minutes.
Step 3 – enumeration of specific services through the NSE
For every interesting service - a sighting script. For the web: sudo nmap --script http-enum,http-title,http-methods -p 80,8443 <IP>. For MySQL: sudo nmap --script mysql-info,mysql-enum -p 3306 <IP>. For SMB: sudo nmap --script smb-enum-shares,smb-os-discovery -p 445 <IP>.
After three steps - a full map: what ports, what services, which versions, what hidden paths on the web server. Then the operation begins, but it is already outside the frames of the scanner.
To speed up the first step, you can use Rustscan: rustscan -a 10.10.10.5 -- -sC -sV. Rustscan finds open ports in 3-5 seconds and automatically transmits them to Nmap for a detailed scan. On CTF-competitions, where minutes on the account, the ligament noticeably saves time.
Beginner errors when scanning the network
The rake on which everything comes in the first months. Gathered from his own experience and from observations of teammates on CTF.
Forgotten -Pn - host "not found." Nmap defaults to check host availability via ICMP and TCP samples. Firewall has sampled - Nmap considers the host dead and does not scan anything. In CTF and with pentests through VPN always add -Pn.
Only the top 1000 ports are scanned. Default scan without -p- passes more than 64000 ports. On CTF boxes, critical services are regularly sitting on high non-standard ports. A full scan is mandatory.
Confused filtered and closed. Closed — the car responded to the RST, the port is available, but empty. Filtered - silence, the package is crushed with firewall. When filtered, try ACK scan (-sA) for the analysis of firewall rules: it will not show open/closed, but will show which firewall ports filter and which passes.
Do not retain results. After an hour, the repeated scan can give other results (the service restarted, the timeout changed). Always use -oA <префикс> – save in three formats: text, XML and grepable. Create a folder mkdir nmap and put everything in there. The future you will say thank you.
Launch -A At once on all ports. Aggressive scan includes version detection, OS, scripts and traceroute. At 65535 ports, it could take 15-20 minutes. Two-step approach (fast -sS -p-, then point -sC -sV on found ports) works at times faster.
Ignore UDP. Most newcomers only scan TCP. SNMP on 161/udp can give the community string and equipment configuration. DNS on 53/udp is vulnerable to zone transfer. TFTP on 69/udp allows you to download files without authentication. Minimum --top-ports 50 for UDP is a mandatory part of the intelligence.
Do not read the output of scripts. NSE scripts give the result straight into the console, but beginners scroll through it, focusing only on the port table. Oh http-title can show "Tomcat Manager", smb-os-discovery – accurate version of Windows, ssh-hostkey – the type of key on which the OS is specified. Don’t be lazy to read, there is gold.
Nmap (Network Mapper) determines which hosts are alive in the network, which ports on them are open, which services listen to these ports and under which OS the machine works. In terms of MITRE ATT&CK, it is Active Scanning (T1595, Reconnaissance) and Network Service Discovery (T1046, Discovery) – exactly what the attacker does during the exploration stage before any penetration. Read more in our guide to creating ctf tasks.
In CTF and in preparation for pwn-tasks Nmap solves three problems. The first is to detect entry points: each open port is a working service and a potential attack vector. Missed a non-standard port - missed the flag. The second is to define a technology stack: the Apache version, the type of SSH server, the presence of an SMB suggest which exploits are applicable. The third is to narrow the scope and move from blind selection to targeted work on specific services.
Russian-speaking guides from the search top list the teams and explain the flags. But none gives a working algorithm: what to run first, what is the second and what to do with the resulting conclusion. I built this article like this algorithm — from the installation to the finished attack plan on the CTF box.
Installing Nmap and First Start
On Kali Linux and Parrot OS Nmap pre-installed — check through nmap --version. On pure Debian/Ubuntu: sudo apt update && sudo apt install nmap. On Fedora: sudo dnf install nmap. On macOS via Homebrew: brew install nmap. On Windows is a .exe installer with nmap.org, after which the scanner is available from cmd or PowerShell.
The first rule that saves nerves: run Nmap with sudo. Without root privileges, Nmap cannot send raw packages and is forced to switch from SYN scan (-sS) on TCP Connect (-sT). Saw in the terminal "TCP connect scan requested..." - restart with sudo. SYN-scan is faster and quieter: it does not complete the TCP handshake, which means that there are fewer records in the logs of the target machine. According to the documentation nmap.org SYN-scan - default when launched with root rights.
The most basic challenge: sudo nmap 10.10.10.5. Without additional flags, Nmap will check the 1000 most common TCP ports (the list is sewn in the nmap-services file) and display the table with the state of each. For the first acquaintance enough for the eyes, but for the CTF - absolutely little. Why, I will explain further.
How to read Nmap output: open,, closed filtered
Before you understand the types of scans, you need to learn to read the result. This is a key skill for nmap intelligence – if you confuse filtered and closed, you will spend time on ports blocked by firewall.
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
139/tcp filtered netbios-ssn
445/tcp closed microsoft-ds
8080/tcp open http-proxy
open - the service listens to the port, he is ready to accept connections. That's your goal in the CTF. Each open port is a separate mini-investigation.
closed – the port is available (the machine is responsible for the RST package, in fact says “there is no one here”), but there is no active service for it. The CTF is usually not interesting, but on a real pentest, a closed port can open after certain actions.
filtered - the package is gone, there's no answer. The firewall or network filter has dropped the request silently. Nmap cannot determine whether the port is open or closed. See filtered on the port that logically should be opened — try -Pn or change the type of scan.
open|filtered is typical for UDP scanning. UDP does not send confirmations, and Nmap is not sure: the port is open or the firewall silently dropped the package.
According to the documentation nmap.org there is still a state unfiltered – the port responds to requests, but Nmap cannot determine whether it is open or closed. Found in ACK scanning (-sA), which is used to analyze the rules of the firewall. In practice, CTFs are rarely found.
Nmap Port Scanning: Scan Types and When to Apply
Nmap supports more than a dozen types of scanning: FIN, Xmas, NULL, Idle, Maimon and others. Most are sharpened by the circumvention of specific firewalls and IDS - situations that are extremely rare in CTF-tasks. There are three nmap bases for.
SYN-scan – the basis of network exploration for the pentest
Starts by default if there is root: sudo nmap -sS 10.10.10.5. Mechanics rests on a TCP handshake: Nmap sends a package with the flag SYN (the first step of the three-step handshake). The target is SYN/ACK – the port is open, and Nmap immediately throws the RST, breaking the connection before it is established. The RST is coming – the port is closed. Silence – filtered.
Why SYN is better than a complete connection: faster and fewer records in the logs of the target machine (technically, the connection is not established, although modern IDS still see it). According to MITRE ATT&CK, this is Scanning IP Blocks (T1595.001) – sending sensing packages to determine active services.
In practice, almost all of your CTF scans will be a SYN scan. Exceptions – situations without root or the need to check UDP.
TCP Connect – when there are no root privileges
nmap -sT 10.10.10.5 works without sudo. Nmap uses a system call connect() and establish a full TCP connection to each port. The result is similar (open/closed/filtered), but the method is slower and more noticeable – the target server logs every completed connection. In CTF, it is rarely used: there is usually root on the attacking machine.
UDP scan – ports that all forget
sudo nmap -sU --top-ports 50 10.10.10.5 checks the 50 most common UDP ports. UDP-scan is fundamentally slower than TCP: the protocol does not send confirmations, and Nmap is forced to wait for the ICMP error Port Unreachable (port closed) or silence (open|filtered).
Why it is necessary: DNS (53), SNMP (161), TFTP (69), IKE (500) - all these are UDP services that regularly pop up in CTFs and on pentests. SNMP with community string "public" can give the configuration of the equipment. DNS is vulnerable to zone transfer. TFTP allows you to download files without authentication. Skip UDP — skip a whole class of vulnerabilities.
Typical error: running a full UDP scan (-p-). It takes a watch. Use --top-ports 100 or expressly specify the ports: -p 53,69,123,161,500.
Summary table for quick orientation:
Scan type Flag Need a root Speed When to use
SYN -sS Yeah High Main scan in CTF and Pentest
TCP Connect -sT No Average No root privileges
UDP -sU Yeah Low Search DNS, SNMP, TFTP
Nmap Network Intelligence: Host Detection and Service Detection
Detection of live hosts in the network
For network-tasks CTF and internal pentests, you often need to find all the live machines in the subnet. Ping sweep: sudo nmap -sn 192.168.1.0/24. Flag -sn Disables port scanning — Nmap only checks the availability of hosts through the combination of ICMP echo, TCP SYN (port 443) and TCP ACK (port 80). According to MITRE ATT&CK this Remote System Discovery (T1018).
If the ICMP is blocked (frequent situation in CTF labs), add explicit TCP samples: sudo nmap -sn -PS22,80,443 192.168.1.0/24 – will send SYN-packs to the specified ports.
In CTF, where you are given a specific IP address, ping sweep is not necessary. But you need a flag -Pn: it skips the host discovery phase and counts the target alive. Without -Pn Nmap may decide that the host is dead (the firewall has sampled) and will not start scanning the ports at all. One of the most frequent mistakes in those who only master Nmap – I myself stepped on it in the first week.
Detection of service and operating system versions
Finding open ports is half the case. We need to understand what's behind them. Flag -sV includes the definition of versions: Nmap connects to each open port, sends a series of probes and compares the answers with the nmap-service-probes signature base.
The difference is tangible: without -sV in the SERVICE column, you can see simply "http", and with it - "Apache httpd 2.4.49 ((Ubuntu))". And this is already actionable information: Apache 2.4.49 contains known path traversal vulnerability (CVE-2021-41773). According to MITRE ATT&CK, the definition of versions is the collection of data on Software on target systems (T1592.002, Reconnaissance).
Parameter --version-intensity (from 0 to 9) manages the number of probes sent. 0 — only the most likely, 9 — all available. For CTFs, default (7 according to nmap.org) – the balance between speed and accuracy.
Flag -O determines the operating system by the features of TCP/IP-stack: TTL, the size of the TCP window, the TCP options, the behavior of the ICMP. Works better when there are both open and closed ports for a purpose – Nmap analyzes different types of answers for a more accurate fingerprint. Can be added --osscan-guess for less confident, but still useful assumptions.
Combination sudo nmap -sC -sV -O -p <порты> <цель> – working horse of the second stage. There is a short option: -A includes simultaneously -sV, -O, default NSE scripts and traceroute. But -A slower, so it is better to use in the CTF point-by-point - after a quick full scan has already found interesting ports.
Nmap teams for beginners: NSE scripts and enumeration
Nmap Scripting Engine (NSE) is a built-in script engine on Lua. Scripts lie in /usr/share/nmap/scripts/ and cover tasks from collecting banners to finding specific vulnerabilities. For beginners, three approaches are critical.
Default scripts are triggered through sudo nmap -sC <цель> (Equivalent --script=default). Set of secure scripts: receiving SSH host key, HTTP headers, listing SMB ball, basic information about DNS. In CTF, this is a mandatory step after the discovery of ports – default scripts often pull out details that are not visible when simply scanning.
Category vuln: sudo nmap --script vuln -p 80,443 <цель> checks the found services for known vulnerabilities. It does not replace a full-fledged vulnerability scanner, but in the CTF can instantly point to the vector to detect Heartbleed on port 443 or ms17-010 on SMB. According to MITRE ATT&CK, this is Vulnerability Scanning (T1595.002).
Specific script: sudo nmap --script http-enum -p 80 <цель> Searches the typical paths on the web server (/admin, /phpmyadmin, /wp-login.php). For SMB useful smb-enum-shares, for DNS — dns-zone-transfer, for SSL/TLS — ssl-enum-ciphers. Find the Right Script: ls /usr/share/nmap/scripts/ | grep <ключевое_слово>.
Nmap for CTF: step-by-step workflow solution network-task
A specific sequence that I run on every HackTheBox and TryHackMe box. Three stages - from black box to full service map. Suitable for network-tasks CTF, and for preparation for pwn-category.
Step 1 – Fast scan of all ports
sudo nmap -sS -p- --min-rate 5000 -Pn 10.10.10.5 -oA nmap/allports
I will analyze each element: -sS – SYN-scan; -p- – all 65535 ports (without this check only the top 1000, and in the CTF the flag often hangs on port 31337 or 49152); --min-rate 5000 – a minimum of 5000 packages per second (in CTF-lab safely, on a real pentest reduce); -Pn – consider the goal alive; -oA nmap/allports – save the result in all formats.
Time: 15-40 seconds. The result is a complete list of open ports.
Step 2 – detailed scan with version definition
Let’s say step 1 found ports 22, 80, 3306, 8443. Target detailing: sudo nmap -sC -sV -O -p 22,80,3306,8443 10.10.10.5 -oA nmap/detailed.
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
3306/tcp open mysql MySQL 5.7.38-0ubuntu0.18.04.1
8443/tcp open ssl/http Apache Tomcat 9.0.31
OS details: Linux 4.15 - 5.6
From the output, you can see the attack surface: Ubuntu, Apache with a specific version, MySQL (check default root:root), Tomcat 9.0.31 (check Tomcat Manager and a pair of tomcat:tomcat). The scan takes 1-3 minutes.
Step 3 – enumeration of specific services through the NSE
For every interesting service - a sighting script. For the web: sudo nmap --script http-enum,http-title,http-methods -p 80,8443 <IP>. For MySQL: sudo nmap --script mysql-info,mysql-enum -p 3306 <IP>. For SMB: sudo nmap --script smb-enum-shares,smb-os-discovery -p 445 <IP>.
After three steps - a full map: what ports, what services, which versions, what hidden paths on the web server. Then the operation begins, but it is already outside the frames of the scanner.
To speed up the first step, you can use Rustscan: rustscan -a 10.10.10.5 -- -sC -sV. Rustscan finds open ports in 3-5 seconds and automatically transmits them to Nmap for a detailed scan. On CTF-competitions, where minutes on the account, the ligament noticeably saves time.
Beginner errors when scanning the network
The rake on which everything comes in the first months. Gathered from his own experience and from observations of teammates on CTF.
Forgotten -Pn - host "not found." Nmap defaults to check host availability via ICMP and TCP samples. Firewall has sampled - Nmap considers the host dead and does not scan anything. In CTF and with pentests through VPN always add -Pn.
Only the top 1000 ports are scanned. Default scan without -p- passes more than 64000 ports. On CTF boxes, critical services are regularly sitting on high non-standard ports. A full scan is mandatory.
Confused filtered and closed. Closed — the car responded to the RST, the port is available, but empty. Filtered - silence, the package is crushed with firewall. When filtered, try ACK scan (-sA) for the analysis of firewall rules: it will not show open/closed, but will show which firewall ports filter and which passes.
Do not retain results. After an hour, the repeated scan can give other results (the service restarted, the timeout changed). Always use -oA <префикс> – save in three formats: text, XML and grepable. Create a folder mkdir nmap and put everything in there. The future you will say thank you.
Launch -A At once on all ports. Aggressive scan includes version detection, OS, scripts and traceroute. At 65535 ports, it could take 15-20 minutes. Two-step approach (fast -sS -p-, then point -sC -sV on found ports) works at times faster.
Ignore UDP. Most newcomers only scan TCP. SNMP on 161/udp can give the community string and equipment configuration. DNS on 53/udp is vulnerable to zone transfer. TFTP on 69/udp allows you to download files without authentication. Minimum --top-ports 50 for UDP is a mandatory part of the intelligence.
Do not read the output of scripts. NSE scripts give the result straight into the console, but beginners scroll through it, focusing only on the port table. Oh http-title can show "Tomcat Manager", smb-os-discovery – accurate version of Windows, ssh-hostkey – the type of key on which the OS is specified. Don’t be lazy to read, there is gold.
