#4: Start Using Nmap

Learning Nmap can feel overwhelming at first. There are many commands, options, and scripts to explore. To make it easier, we’ll use a simple framework:

👉 Nmap 1‑2‑3: Scan, Script, Skill (3S)

This approach helps beginners learn step by step inside their WSL Ubuntu terminal.

1. Scan – Basic Options

The first step is learning how to scan. Options control how Nmap behaves.

These basic options control how Nmap scans. The most important categories:

Host Discovery

• -sn → Ping scan (find live hosts).

• -Pn → Treat all hosts as online (skip ping).

Port Selection

• -p → Specify ports (e.g. -p 22,80,443).

• -p-  → Scan all 65,535 ports.

Scan Techniques

• -sS → SYN scan (stealthy).

Service & OS Detection
• -sV → Detect service versions.

• -O → Detect operating system.
Aggressive Scan

• -A → Enables OS detection, version detection, script scanning, and traceroute.

2. Script – Nmap Scripting Engine (NSE)

Next, add intelligence with scripts. Nmap’s Scripting Engine (NSE) automates tasks like service discovery and vulnerability checks.

These add intelligence to scans. Categories include:

• Discovery → http-title, dns-brute

• Auth → ftp-anon, ssh-brute

• Vuln → ssl-heartbleed, smb-vuln-ms17-010

• Malware → irc-botnet-channels

3. Skill – Advanced Techniques

These are extra capabilities that go beyond basic scanning and scripting.

Examples:

• Timing & Performance →  -T0 to -T5

• Firewall Evasion → -f, --spoof-mac, -D

• Target Specification → ranges, CIDR, input files (-iL)

• Integration & Automation → feeding results into Metasploit, Python scripts, or reporting tools

Example of Nmap Usage

Scan - Basic Option
Example

open WSL Ubuntu terminal & type

no option, just regular scan
> nmap www.atc123.xyz

Result
> 1000 ports scanned , 998 filterd
> port numner 80; open; http
> port numner 443; open; secured http

since port number 80 & 443 is common port for http & https service, we can scan the port directly without scanning all 1000 ports

option : -Pn , -p
> nmap -Pn -p 80,443 www.atc123.xyz

Result
> port numner 80; open; http
> port numner 443; open; secured http
> scan result faster 0.13 second (compared with above result 55 sec)

happy scanning guys !!!!
try with Nmap - Zenmap GUI