1) Legal & Ethical Foundation

• Scope: scan only assets you own or have written authorization to test.
• Rules of engagement: time windows, IP ranges, traffic limits, reporting format.
• Evidence: enable logs, preserve outputs, avoid noisy options on production.

2) TCP/UDP Refresher for Scanners

• TCP: 3-way handshake; recognize SYN/ACK, RST; filtered vs closed.
• UDP: connectionless; “no response” ≠ open; ICMP unreachable hints.
• Common ports: 22/SSH, 80/HTTP, 443/HTTPS, 445/SMB, 3389/RDP, 3306/MySQL, 53/DNS, 161/SNMP.

3) Core Nmap Modes (with examples)

# Fast host discovery
nmap -sn 10.10.0.0/24

# Top 1000 TCP ports with service/version detection & OS guess
nmap -sS -sV -O -T4 10.10.0.5

# Full TCP sweep (be careful: noisy & long)
nmap -p- -sS 10.10.0.5

# UDP scan of common ports
nmap -sU --top-ports 200 10.10.0.5

# Targeted scripts (NSE)
nmap -sV --script vuln 10.10.0.5
      

4) Reading Results like a Pro

• State: open / closed / filtered / unfiltered / open|filtered.
• Service & version: banner grabs help identify patch levels.
• OS & device type: TCP/IP fingerprinting (confidence varies).

5) Evasion & OPSEC (for lab practice)

# Fragment packets (can break devices; lab only)
nmap -f 10.10.0.5

# Decoys to muddy attribution (ethically questionable; use only if permitted)
nmap -D RND:10 10.10.0.5

# Idle scan using zombie host (advanced, fragile)
nmap -sI 10.10.0.123 10.10.0.5

# Slower timing to reduce IDS alerts
nmap -T2 -sS 10.10.0.5
      

6) UDP Nuances & Tricks

Because UDP lacks handshakes, Nmap infers openness indirectly. Pair -sU with targeted scripts and app-layer checks. Expect high false negatives under packet loss or strict firewalls.

7) NSE Scripts that Matter

• vuln – quick vulnerability checks
• http-enum – web dirs, frameworks
• ssl-enum-ciphers – TLS posture
• smb-enum-shares – Windows shares

8) Safe Lab Setup

• Isolated VLAN/virtual network (e.g., VirtualBox Host-Only).
• Targets: Metasploitable, OWASP BWA, vulnerable-by-design images.
• Packet captures: tcpdump, Wireshark for ground truth.

9) From Recon to Reporting

# Output formats
nmap -oA scan01 10.10.0.5   # scan01.nmap|.gnmap|.xml

# Convert to HTML or ingest into vulns platform
xsltproc scan01.xml -o report.html
      

Reports should map open ports → services → risk → remediation (patch, config, network control).

“See the surface, then see through it.” — redesign.ir