Mastering Nmap and Network Mapping Tools - Roadmap

This comprehensive roadmap will guide you through mastering Nmap and network mapping tools, covering everything from beginner to advanced topics.
by İbrahim Korucuoğlu ( @siberoloji) |
Tags:
Categories:

  5 minute read  

Here’s a comprehensive roadmap for mastering Nmap and network mapping tools, covering everything from beginner to advanced topics.

Phase 1: Introduction to Nmap and Network Scanning Basics

1. Understanding Nmap and Network Mapping

  1. What is Nmap?
  2. Why is network scanning important?
  3. Ethical considerations and legal aspects of network scanning.
  4. Installing Nmap on Windows, Linux, and macOS.
  5. Using Zenmap (Nmap’s GUI) for visualization.

2. Basic Nmap Commands and Syntax

  1. The Nmap command structure.
  2. Scanning a single target vs. multiple targets.
  3. Using hostnames vs. IP addresses.
  4. Excluding specific hosts from scans (--exclude).

3. Host Discovery Techniques

  1. ICMP Echo Request Scan (-PE) – Check if a host is online.
  2. ICMP Timestamp Scan (-PP) – Check system uptime.
  3. ICMP Address Mask Scan (-PM) – Detect network subnet mask.
  4. TCP SYN Ping (-PS) – Send SYN packets to specific ports.
  5. TCP ACK Ping (-PA) – Detect firewall rules.
  6. UDP Ping (-PU) – Send UDP packets to determine live hosts.
  7. ARP Discovery (-PR) – Used in local networks for host discovery.

Phase 2: Intermediate Scanning Techniques

4. Basic and Advanced Port Scanning

  1. What are ports? Understanding TCP/UDP.
  2. Default vs. custom port scans (-p option).
  3. Scanning multiple ports, port ranges, and excluding ports.
  4. Detecting open, closed, filtered, and unfiltered ports.

5. Common Scan Types and Their Purposes

  1. TCP Connect Scan (-sT) – Full TCP connection.
  2. SYN (Stealth) Scan (-sS) – Half-open scan to avoid detection.
  3. UDP Scan (-sU) – Identifying open UDP ports.
  4. NULL Scan (-sN) – Evading IDS detection by sending no TCP flags.
  5. FIN Scan (-sF) – Sends FIN packet to bypass firewalls.
  6. Xmas Tree Scan (-sX) – Highly evasive scan.
  7. ACK Scan (-sA) – Firewall rule testing.
  8. Window Scan (-sW) – Identifies open ports using TCP window sizes.
  9. Maimon Scan (-sM) – Similar to FIN scan but less common.

6. Service and Version Detection

  1. Basic version detection (-sV).
  2. Intense version scanning (--version-intensity).
  3. Customizing version detection with probes.

7. OS Detection and Fingerprinting

  1. Basic OS detection (-O).
  2. Aggressive OS scanning (-A).
  3. Bypassing OS detection limitations.

Phase 3: Advanced Nmap Scanning Techniques

8. Firewall, IDS, and Evasion Techniques

  1. Fragmentation Scans (-f, --mtu) – Sending smaller fragmented packets.
  2. Coconut – Hiding the real attacker’s IP.
  3. Spoofing Source Address (-S) – Impersonating another machine.
  4. Using Randomized IPs (-iR) – Scanning random IPs to hide activity.
  5. Using the --badsum option – Sending packets with incorrect checksums.
  6. Packet Timing Adjustments (--scan-delay) – Slowing scans to avoid detection.

9. Advanced Host Enumeration

  1. Identifying running services and their configurations.
  2. Detecting default or misconfigured services.
  3. Finding hidden services behind firewalls.

10. Timing and Performance Optimization

  1. Understanding timing templates (-T0 to -T5).
  2. Adjusting parallelism (--min-parallelism, --max-parallelism).
  3. Limiting packet transmission rates (--min-rate, --max-rate).

11. Advanced Output and Reporting

  1. Normal output (-oN).
  2. Grepable output (-oG).
  3. XML output (-oX).
  4. JSON output (-oJ).
  5. [Saving results for later analysis.](/url: saving-results-for-later-analysis-with-nmap/)

Phase 4: Nmap Scripting Engine (NSE)

12. Understanding NSE and Its Capabilities

  1. What is NSE?
  2. Where to find NSE scripts.
  3. How to execute scripts (--script option).

13. Using NSE Scripts for Security Testing

  1. Discovery Scripts (discovery) – Finding hidden hosts and services.
  2. Vulnerability Detection Scripts (vuln) – Identifying known exploits.
  3. Exploitation Scripts (exploit) – Testing common security flaws.
  4. Brute Force Scripts (brute) – Testing weak authentication.
  5. Malware Detection Scripts (malware) – Checking for malicious services.

14. Writing Custom NSE Scripts

  1. Basics of Lua programming.
  2. Writing a simple NSE script.
  3. Debugging and optimizing scripts.

Phase 5: Real-World Applications of Nmap

15. Reconnaissance for Penetration Testing

  1. Using Nmap for footprinting.
  2. Mapping an organization’s attack surface.
  3. Identifying security weaknesses before an attack.

16. Vulnerability Scanning with Nmap

  1. Finding open ports that expose vulnerabilities.
  2. Checking for outdated services and exploits.
  3. Automating vulnerability scanning.

17. Integrating Nmap with Other Security Tools

  1. Using Nmap with Metasploit.
  2. Importing Nmap results into Nessus.
  3. Combining Nmap with Wireshark for deeper analysis.

18. Automating Nmap Scans

  1. Writing Bash scripts for automation.
  2. Scheduling scans with cron.
  3. Setting up email alerts for scan results.

Phase 6: Expert-Level Nmap Techniques

19. Large-Scale Network Scanning

  1. Scanning entire subnets efficiently.
  2. Best practices for scanning large networks.
  3. Handling massive amounts of scan data.

20. IPv6 Scanning with Nmap

  1. Scanning IPv6 addresses (-6 option).
  2. Differences between IPv4 and IPv6 scanning.
  3. Identifying IPv6-only hosts.

21. Bypassing Intrusion Detection Systems (IDS)

  1. Detecting IDS in a network.
  2. Using custom packet manipulation.
  3. Evading detection with slow scans.

22. Advanced Packet Crafting with Nmap

  1. Manually modifying scan packets.
  2. Analyzing responses for deeper insights.
  3. Using external packet crafting tools (Scapy, Hping3).

Final Steps: Mastering Nmap

23. Continuous Learning and Staying Updated

24. Practice Scenarios and Real-World Challenges

Books

  • “Nmap Network Scanning” (Official Guide by Gordon Lyon, AKA Fyodor)
  • “Mastering Nmap” by Nicholas Marsh

Online Courses

Labs & Practice

Cheat Sheets

Final Project Ideas

  1. Automated Network Scanner: Write a Python script that runs Nmap scans and generates reports.
  2. Vulnerability Assessment: Perform a full scan of a lab network and document findings.
  3. Custom NSE Script: Develop a script to detect a specific vulnerability (e.g., Log4j).

Conclusion

This roadmap takes you from basic scanning to advanced penetration testing techniques with Nmap. The key is hands-on practice—set up a lab (VirtualBox/Kali Linux) and experiment safely.

Would you like recommendations for specific lab setups or detailed explanations on any topic? 🚀


Nmap The Network Mapper >