Lab 01 — Your First Scan
0 / 5 steps
Where you are allowed to point this. The target in this lab, scanme.nmap.org, is a machine the Nmap Project runs specifically so people can practise on it. Their own page says you are authorised to scan it, and adds one condition: “A few scans in a day is fine” — so work through this once, and do not sit re-running the commands. Somebody else pays for that bandwidth.
That permission covers that one hostname and nothing else. Scanning a network you do not own or have written permission to test is a criminal offence in most countries, and “I was learning” has never once worked as a defence. Everything else you want to scan, you build yourself — which is what Lab 00 was for.
The goal
By the end you will have scanned a live host, found which services it runs and what versions, saved the result to a file, and know why each flag earned its place. This is the opening move in almost every engagement, red team or blue.
Before you start. You need a machine with nmap on it. If you do not have one, Lab 00 — Set Up Your Lab starts from a laptop with nothing installed and finishes with a Kali VM, every click spelled out. Check nmap is there with nmap --version before going further. The target is public, so there is nothing to spin up for this one.
Steps
01See what is open
Start with the plainest scan there is. No flags — just nmap and a target.
$ nmap scanme.nmap.org
roughly what comes back — the exact ports drift over time PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 9929/tcp open nping-echo 31337/tcp open Elite
Read it: each row is a door that answered. open means something is listening behind it. You now know two ways in exist. You do not yet know what is behind them — the port number is only a convention, not a promise.
02Ask what is behind the doors
A port number is a guess at the service. -sV makes nmap interrogate each one and report the actual software and version.
$ nmap -sV scanme.nmap.org
the SERVICE column now carries a VERSION 22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu ... 80/tcp open http Apache httpd 2.4.7 ...
Why it matters: “there is a web server” is a shrug. “Apache 2.4.7” is a lead — now you can go and find out whether that version has known problems. Version detection is the hinge between mapping a host and assessing it.
03Look past the common ports
By default nmap checks the 1,000 most common ports. The interesting service is often the one sitting on an odd number nobody thought to look at.
$ nmap -p 1-2000 scanme.nmap.org
notice how much longer this takes than step 01 — that difference is the whole lesson
The flag you actually want is -p-, which checks all 65,535 ports instead of a range. I am deliberately not having you run it here. A full sweep hammers the target for several minutes, and scanme.nmap.org is a machine somebody donates to the community — “a few scans in a day” does not stretch to that. Run -p- against the VM you built in Lab 00, where the only person paying for it is you.
The tradeoff: completeness costs time and noise. On a real engagement you would weigh a full sweep against the odds of being spotted mid-scan. Feel how much slower 2,000 ports already is, then multiply by thirty. That instinct is the point of this step.
04Let nmap do the heavy lifting
-A is version detection, an OS guess, the default script set and a traceroute, all in one. Loud, thorough, and the fastest route to a full picture.
$ nmap -A scanme.nmap.org
a great deal more output ... service versions ... OS details: Linux 3.x ... TRACEROUTE ...
Blue team, read this backwards. Everything -A hands an attacker is what your own logging should be shouting about when somebody runs it at you. Run it against the VM from Lab 00, then go and find the alert it generated. If there was not one, that is the finding.
05Keep the evidence
A scan you did not save is a scan you have to run again — and on a shared practice host, re-running it is exactly what you were asked not to do. -oN writes clean human-readable output to a file.
$ nmap -sV -oN first-scan.txt scanme.nmap.org
then read it back $ cat first-scan.txt
A habit worth forming now: real work is documented as it happens, not reconstructed afterwards. -oX writes XML instead, which matters because other tools read it — searchsploit --nmap first-scan.xml will take that file and go looking for known exploits against everything you found. Tools chain together, and the output format is the joint.
You have run a full recon pass and you know why each flag earns its place. That is the foundation everything else builds on.
Before you leave — prove it
Pick one open port and answer three questions without scrolling back up. One: what service and version is running on it? Two: which flag told you the version? Three: if you had to keep that finding for a report, what is the exact command?
There is no submit box. This is for you. If all three come from memory, you are ready for a target that does not want to be scanned.
What you learned
- nmap <target> — find the open ports
- -sV — turn “a service” into “this exact software, this version”
- -p 1-2000 and -p- — widening the net, and what completeness costs you
- -A — the everything scan, and why it is loud enough to catch
- -oN and -oX — save your work, and how one tool's output becomes another's input
NextMore labs, and the ranges worth your weekend→
Go deeper
- The official nmap reference — every flag, from the people who wrote it
- Nmap Network Scanning — the book, free to read online
- More tools worth running and more places to point them
Original walkthrough. Every command here is standard documented nmap usage, run against a host whose owners publish permission to scan it. Flags were checked against nmap's own manual rather than remembered — but software changes, so if something here no longer matches what your terminal does, tell me and I will fix it.