Part 2 of the "Hacking from Zero" series

Nmap Deep Dive: The Hacker's Swiss Army Knife

Published June 6, 2026 · By 0xiMAK

"Give me six hours to chop down a tree and I will spend the first four sharpening the axe." — Abraham Lincoln

In hacking, Nmap is the axe. Before you exploit anything, you need to know what's there. Nmap — Network Mapper — is the industry-standard tool for reconnaissance. It tells you what machines are on a network, what ports are open, what services are running, and even what operating system the target is using.

In this post, we'll go from zero to confident with Nmap — covering real commands you'll use on TryHackMe and in real-world pentesting.

🔍 What Is Nmap?

Nmap is a free, open-source command-line tool used for:

• Host discovery — Is this machine alive?
• Port scanning — What doors are open?
• Service detection — What's running behind each door?
• OS fingerprinting — What operating system is the target using?
• Scripted scanning — Automated vulnerability checks via NSE scripts

It's the first tool run in virtually every penetration test.

🧠 Understanding Ports First

Before diving into commands, you need to understand what a port is.

Think of an IP address as a building's street address. Ports are the individual rooms inside that building. Each service — web server, SSH, FTP — listens on a specific port number.

Key ports to know:

There are 65,535 ports in total. Nmap helps you find which ones are open.

⚙️ Installing Nmap

Nmap comes pre-installed on Kali Linux and Parrot OS (the distros used on TryHackMe). On your own machine:

# Debian/Ubuntu
sudo apt install nmap

# macOS
brew install nmap

# Windows
# Download installer from nmap.org

Verify it's working:

nmap --version

🔬 The Core Scan Types

1. Basic Scan

The simplest scan is just pointing Nmap at a target:

nmap 10.10.10.10

This scans the 1,000 most common ports and tells you which are open. Fast but not thorough.

2. SYN Scan (Stealth Scan) — -sS

The most popular scan type. It sends a SYN packet (like starting a TCP handshake) but never completes the connection, making it faster and less likely to appear in logs.

sudo nmap -sS 10.10.10.10

Requires root/sudo because it crafts raw packets.

Why use it: Speed + stealth. The default when run as root.

3. TCP Connect Scan — -sT

Completes the full TCP handshake. Slower and more detectable but doesn't require root.

nmap -sT 10.10.10.10

Why use it: When you don't have root privileges.

4. UDP Scan — -sU

Scans UDP ports. Slower than TCP scans but important — services like DNS (53), SNMP (161), and DHCP run on UDP.

sudo nmap -sU 10.10.10.10

Why use it: You'd miss DNS, SNMP, and other UDP services without it.

5. Scan All 65,535 Ports — -p-

By default Nmap only scans 1,000 common ports. On CTFs and real engagements, interesting services often hide on unusual ports.

nmap -p- 10.10.10.10

Slower, but thorough. Use this when the basic scan finds nothing interesting.

6. Scan Specific Ports — -p

nmap -p 22,80,443 10.10.10.10     # Specific ports
nmap -p 1-1000 10.10.10.10        # Port range
nmap -p 80 10.10.10.10            # Single port

🔎 Service & Version Detection — -sV

Knowing port 80 is open is useful. Knowing it's running Apache 2.4.49 is a game-changer — you can look up known vulnerabilities for that exact version.

nmap -sV 10.10.10.10

Example output:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu
80/tcp open  http    Apache httpd 2.4.49

Now you know the exact software and version. Google "Apache 2.4.49 exploit" and you'll find CVE-2021-41773 — a path traversal vulnerability. That's how real hacking starts.

🖥️ OS Detection — -O

Nmap can guess the target's operating system by analysing how it responds to packets.

sudo nmap -O 10.10.10.10

Example output:

Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4
OS details: Linux 4.15 - 5.6

Useful for knowing whether you're dealing with Linux vs Windows, which shapes your attack approach.

🚀 The Power Combo: -A

The -A flag enables:

• OS detection (-O)
• Version detection (-sV)
• Script scanning (-sC)
• Traceroute

sudo nmap -A 10.10.10.10

This is the go-to scan on TryHackMe rooms. It gives you the most information in one shot.

📜 Nmap Scripting Engine (NSE)

NSE is where Nmap becomes extraordinary. It has 600+ scripts that can detect vulnerabilities, brute-force logins, enumerate services, and check for specific CVEs.

Run default scripts — -sC

nmap -sC 10.10.10.10

Run a specific script

nmap --script=http-title 10.10.10.10          # Grab webpage titles
nmap --script=ftp-anon 10.10.10.10            # Check for anonymous FTP login
nmap --script=smb-vuln-ms17-010 10.10.10.10   # Check for EternalBlue
nmap --script=ssh-brute 10.10.10.10           # Brute-force SSH (careful!)

Run all scripts in a category

nmap --script=vuln 10.10.10.10    # All vulnerability scripts
nmap --script=auth 10.10.10.10    # All auth-related scripts

Script categories: auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, vuln.

⚡ Timing & Performance — -T

Nmap has 6 timing templates (0–5):

On TryHackMe, always use -T4:

nmap -T4 10.10.10.10

📤 Saving Output — -o

Always save your scan results. You'll thank yourself later.

nmap -oN scan.txt 10.10.10.10      # Normal (human-readable)
nmap -oX scan.xml 10.10.10.10      # XML (for tools like Metasploit)
nmap -oG scan.gnmap 10.10.10.10    # Grepable
nmap -oA scan 10.10.10.10          # All three formats at once

🧩 My Go-To Nmap Workflow on TryHackMe

Here's exactly how I approach every new room:

Step 1: Fast initial scan — get results quickly

nmap -T4 -p- --min-rate=1000 10.10.10.10

Step 2: Deep scan on open ports — once you know which ports are open

sudo nmap -A -sV -sC -p 22,80,443 10.10.10.10

Step 3: Save everything

sudo nmap -A -p 22,80,443 -oA results 10.10.10.10

This two-step approach is fast and thorough — you don't waste time doing a slow -A scan on all 65,535 ports.

🎯 Practice: Try These on TryHackMe

💬 Common Mistakes Beginners Make

1. Not running as sudo. SYN scans and OS detection require raw packet access. Always use sudo for -sS and -O.

2. Forgetting UDP. Most beginners only scan TCP. Add -sU when you're not finding anything interesting.

3. Not scanning all ports. Default scans only cover 1,000 ports. On CTFs, the interesting service is often on port 8080, 8888, or something unusual. Use -p-.

4. Not saving output. You'll re-run the same scan three times if you don't save results with -oA.

🔑 Nmap Cheat Sheet

# Quick scan
nmap -T4 TARGET

# Full port scan
nmap -T4 -p- TARGET

# Service + OS + scripts
sudo nmap -A TARGET

# Stealth SYN scan
sudo nmap -sS TARGET

# UDP scan
sudo nmap -sU TARGET

# Specific ports with version
nmap -sV -p 22,80,443 TARGET

# Vulnerability scripts
nmap --script=vuln TARGET

# EternalBlue check
nmap --script=smb-vuln-ms17-010 -p 445 TARGET

# Save all formats
nmap -oA output TARGET

🚀 What's Next

Now that you can scan a target and enumerate its services, the next step is understanding why those services exist — and that means understanding networking fundamentals.

Tags: #Nmap #CyberSecurity #TryHackMe #EthicalHacking #Pentesting #CTF #NetworkScanning #InfoSec

← Back to Blog