Nmap (Network Mapper) is the single most important reconnaissance tool in a hacker’s or defender’s toolkit. Learning its core concepts pays off in almost every engagement. This cheat sheet covers the essentials for beginners.
What Nmap Does
Nmap discovers hosts on a network, finds which ports are open, identifies the services and versions running on them, and can even detect operating systems. It is your first look at the attack surface of a target.
Core Scan Types
A handful of scan patterns cover most situations. Host discovery finds which machines are alive on a network. A port scan reveals which TCP or UDP ports are open. Service and version detection tells you what is running behind each port, which is the information you actually build attacks or defenses around.
Going Further With the Scripting Engine
The Nmap Scripting Engine (NSE) extends Nmap with scripts that can detect specific vulnerabilities, grab banners, and even attempt safe checks. It turns Nmap from a port scanner into a lightweight vulnerability scanner.
Use It Responsibly
Scanning networks you do not own or have permission to test can be illegal and is easily detected. Practice on your own lab, on intentionally vulnerable ranges, or on authorized platforms.
Common Mistakes
Beginners often run aggressive scans without permission, misread results, or forget that firewalls and filtering can hide services. Understand what each scan type actually does before relying on the output.
Best Practices
Start with light host discovery, scan deliberately rather than aggressively, document your findings, and always confirm exact command flags against the official Nmap documentation.
Frequently Asked Questions
Is Nmap legal to use?
Yes, on networks you own or are authorized to scan. Unauthorized scanning may be illegal in many jurisdictions.
Is Nmap a vulnerability scanner?
Primarily it is a network mapper, but with the Nmap Scripting Engine it can perform some vulnerability checks.
Conclusion
Nmap is foundational for both offense and defense. Learn the core scan types, explore the scripting engine, and always scan responsibly and with authorization.