Nmap Tutorial to find Network Vulnerabilities

Nmap turns network reconnaissance into a fast, repeatable workflow: a single scan can identify which hosts are alive, which ports are open, what services those ports likely correspond to, and even what operating system a target runs—information that directly drives vulnerability research and exploitation. Instead of manually pinging devices one by one, Nmap automates discovery across an entire subnet, then moves from “is it up?” to “what’s exposed?” in minutes.

The tutorial starts with the practical problem of scaling. A typical home network like 10.7.1.0/24 can contain up to 254 potential endpoints, making blanket pinging impractical. With Nmap, a command using a ping-scan option (the transcript shows “-sP” against the subnet) returns a list of live hosts—15 hosts up in the example—so the next steps focus only on reachable targets.

From there, the workflow shifts to port scanning, framed around a common attacker goal: finding web servers. The guide uses a TCP connect scan targeting ports 80 and 443 across the subnet (shown with “-sT” and “-p 80,443”). Results are presented per host: some addresses show those ports closed, while others show them open, quickly narrowing the candidate set for web-facing systems. The tutorial emphasizes that open ports are only the starting point, but they’re the fastest way to map the attack surface.

A key technical section explains why Nmap can infer port status so reliably: TCP’s three-way handshake. In a full TCP connect scan, Nmap sends a SYN packet to a port, receives a SYN-ACK if the service is listening, then completes the handshake with an ACK. That completed connection is what the “-sT” scan relies on, and the transcript notes it can be intrusive enough to trigger defenses like intrusion detection systems.

To reduce visibility, the tutorial contrasts the full connect scan with a stealthy “half-open” approach using “-sS” (SYN scan). Instead of completing the handshake, Nmap sends SYN and waits for a SYN-ACK; then it avoids finishing the connection, aiming to prevent firewalls and monitoring systems from seeing a full session. Wireshark packet captures are used to demonstrate the difference: the connect scan shows the full ACK and then a reset/termination, while the stealth scan shows the early exchange and then an abrupt stop.

Beyond discovery, Nmap’s value expands through higher-level enumeration. The guide demonstrates OS detection with “-O” and a combined scan with “-A,” which layers OS detection, version detection, script scanning, and traceroute. Examples include identifying a Linux target’s OS and services, and a Windows Server 2012 R2 domain controller with many open ports and detailed findings such as SSH host keys, Apache on port 80, SMB/file-sharing information, SSL certificate details, and routing paths.

The tutorial also adds operational tactics: using decoys (“-D”) to obfuscate the true source of scanning traffic, and leveraging Nmap’s scripting engine (NSE) to automate vulnerability checks. Running vulnerability scripts against a deliberately vulnerable target (“VulnHub” and a “Kioptrix” box) uses CVE-based logic to flag known weaknesses that could be exploited. The takeaway is clear: Nmap isn’t just a scanner—it’s an end-to-end reconnaissance and enumeration toolkit that turns network mapping into actionable vulnerability intelligence.