# 🚀 Nmap: The Basics — A Beginner-Friendly Guide (TryHackMe Walkthrough)

# 🚀 Nmap: The Basics — A Beginner-Friendly Guide (TryHackMe Walkthrough)

If you’re stepping into cybersecurity or penetration testing, one tool you *must* master is **Nmap**. In this blog, I’ll walk you through the fundamentals of Nmap in a simple, Google-friendly format — covering host discovery, port scanning, service detection, timing control, output handling, and more.

Let’s dive in. 👇

---

## 🔎 What is Nmap?

![https://upload.wikimedia.org/wikipedia/commons/7/73/Logo_nmap.png](https://upload.wikimedia.org/wikipedia/commons/7/73/Logo_nmap.png align="left")

![https://www.cyberciti.biz/media/new/cms/2012/11/welcome-nmap.png](https://www.cyberciti.biz/media/new/cms/2012/11/welcome-nmap.png align="left")

![https://www.techtarget.com/rms/onlineimages/nmap-image6-h_half_column_mobile.jpg](https://www.techtarget.com/rms/onlineimages/nmap-image6-h_half_column_mobile.jpg align="left")

4

Nmap (Network Mapper) is an open-source network scanning tool used for:

* Discovering live hosts
    
* Finding open ports
    
* Detecting running services
    
* Identifying service versions
    
* Guessing operating systems
    
* Saving detailed scan reports
    

It was first released in 1997 and is now one of the most powerful tools in cybersecurity.

---

# 🖥️ 1. Host Discovery — Who Is Online?

Before scanning ports, we need to know which systems are alive.

### 📌 Command:

```plaintext
nmap -sn 192.168.1.0/24
```

### What `-sn` Does:

* Performs a **ping scan**
    
* Discovers live hosts
    
* Does NOT scan ports
    

### Target Formats You Can Use:

* IP Range → `192.168.1.1-10`
    
* Subnet → `192.168.1.0/24`
    
* Hostname → [`example.com`](http://example.com)
    

### 🔹 Local Network Scanning

If you're directly connected (WiFi/Ethernet), Nmap uses **ARP requests**.

### 🔹 Remote Network Scanning

If routers are involved, Nmap uses:

* ICMP Echo
    
* TCP SYN probes
    
* TCP ACK probes
    

---

# 🔓 2. Port Scanning — Who Is Listening?

Every device has 65,535 TCP and 65,535 UDP ports.

Let’s explore the main scan types.

---

## 🔹 TCP Connect Scan (`-sT`)

```plaintext
nmap -sT target_ip
```

* Completes full TCP 3-way handshake
    
* Easy to detect
    
* Default when running without sudo
    

---

## 🔹 TCP SYN Scan (`-sS`) — Stealth Scan

```plaintext
sudo nmap -sS target_ip
```

* Sends SYN packet only
    
* Does not complete handshake
    
* Faster and stealthier
    
* Requires sudo/root
    

---

## 🔹 UDP Scan (`-sU`)

```plaintext
sudo nmap -sU target_ip
```

Used to detect:

* DNS (53)
    
* DHCP
    
* SNMP
    
* NTP
    

---

## 🔹 Limiting Ports

| Option | Meaning |
| --- | --- |
| `-F` | Scan top 100 ports |
| `-p10-100` | Scan port range |
| `-p-` | Scan all 65,535 ports |

---

# 🧠 3. Version & OS Detection

![https://miro.medium.com/0%2AsakZmwSHlIQmw7O0.jpg](https://miro.medium.com/0%2AsakZmwSHlIQmw7O0.jpg align="left")

![https://www.linux.org/attachments/figure-02-jpg.700/](https://www.linux.org/attachments/figure-02-jpg.700/ align="left")

![https://us1.discourse-cdn.com/flex015/uploads/ine/original/1X/c18170c30a8c69a20a5c8f7d6304b490a82e744b.png](https://us1.discourse-cdn.com/flex015/uploads/ine/original/1X/c18170c30a8c69a20a5c8f7d6304b490a82e744b.png align="left")

4

---

## 🔹 Service Version Detection (`-sV`)

```plaintext
sudo nmap -sV target_ip
```

Shows:

* Service name
    
* Version number
    

Example:

```plaintext
lighttpd 1.4.74
```

---

## 🔹 OS Detection (`-O`)

```plaintext
sudo nmap -O target_ip
```

Makes an educated guess about the OS.

---

## 🔹 Aggressive Scan (`-A`)

```plaintext
sudo nmap -A target_ip
```

Enables:

* OS detection
    
* Version detection
    
* Traceroute
    
* Script scanning
    

---

## 🔹 Force Scan Even If Host Appears Down

```plaintext
nmap -Pn target_ip
```

Treats all hosts as online.

---

# ⚡ 4. Timing Control — How Fast Should You Scan?

![https://cdn.vectorstock.com/i/1000v/62/51/cybersecurity-rocket-shield-analysis-vector-59846251.jpg](https://cdn.vectorstock.com/i/1000v/62/51/cybersecurity-rocket-shield-analysis-vector-59846251.jpg align="left")

![https://cdn.vectorstock.com/i/1000v/34/20/5g-network-internet-speed-with-speedometer-concept-vector-38213420.jpg](https://cdn.vectorstock.com/i/1000v/34/20/5g-network-internet-speed-with-speedometer-concept-vector-38213420.jpg align="left")

![https://forum.hackersploit.org/uploads/default/original/2X/f/f2e165154e5724bba744a951f3a267087526468a.gif](https://forum.hackersploit.org/uploads/default/original/2X/f/f2e165154e5724bba744a951f3a267087526468a.gif align="left")

4

Nmap provides 6 timing templates:

| Option | Name |
| --- | --- |
| `-T0` | paranoid |
| `-T1` | sneaky |
| `-T2` | polite |
| `-T3` | normal |
| `-T4` | aggressive |
| `-T5` | insane |

Example:

```plaintext
nmap -T4 target_ip
```

### Advanced Controls:

* `--min-rate 100`
    
* `--max-rate 500`
    
* `--host-timeout 30s`
    
* `--min-parallelism`
    
* `--max-parallelism`
    

---

# 📊 5. Output & Reporting

## 🔹 Verbosity

| Option | Meaning |
| --- | --- |
| `-v` | Verbose |
| `-vv` | More verbose |
| `-d` | Debug mode |
| `-d9` | Maximum debug |

---

## 🔹 Saving Reports

| Option | Format |
| --- | --- |
| `-oN file.txt` | Normal |
| `-oX file.xml` | XML |
| `-oG file.gnmap` | Grepable |
| `-oA scan` | All formats |

Example:

```plaintext
nmap -sS target_ip -oA report
```

Creates:

* report.nmap
    
* report.xml
    
* report.gnmap
    

---

# 📝 All Answers (From This Room)

Here are all the answers gathered together:

1. Last IP in `192.168.0.1/27` →  
    **192.168.0.31**
    
2. Number of open TCP ports on `10.49.183.215` →  
    **6**
    
3. Flag from web server →  
    **THM{SECRET\_PAGE\_38B9P6}**
    
4. Web server name and version →  
    **lighttpd 1.4.74**
    
5. Non-numeric equivalent of `-T4` →  
    **\-T aggressive**
    
6. Debugging option →  
    **\-d**
    
7. Scan used when running without sudo →  
    **Connect Scan (**`-sT`)
    

---

# 🎯 Conclusion

In this room, we learned:

* Host discovery (`-sn`)
    
* TCP & UDP scanning (`-sS`, `-sT`, `-sU`)
    
* Port range control (`-p`, `-F`)
    
* Version detection (`-sV`)
    
* OS detection (`-O`)
    
* Aggressive scanning (`-A`)
    
* Timing control (`-T0` to `-T5`)
    
* Debugging (`-d`)
    
* Saving reports (`-oN`, `-oX`, `-oA`)
    

💡 Important Tip:  
Always run Nmap with `sudo` to unlock its full power.