TD Cyber Labs

TrainersTool Trainers / Nmap Trainer 0 / 95 pts

nmap

Nmap

Red Team · Easy · 8 lessons

Nmap maps a network: which hosts are up, which ports are open, and what software is listening. Almost every pentest and CTF begins with an Nmap scan, so its flags are the first syntax worth burning into muscle memory. Work through each command below against the practice box at 10.10.10.10 (target.lab).

1
Run your first scan
With no flags, Nmap scans the top 1000 TCP ports and prints a table of open ones with a best-guess service name. This is your first look at a target's attack surface — start here.
nmap 10.10.10.10
2
Check whether a host is alive with -sn
Sometimes you only need to know which hosts exist, not their ports. -sn does a host-discovery (ping) scan only: no port scan, just 'Host is up'. On a /24 it becomes a sweep that lists every live host.
nmap -sn 10.10.10.10
3
Scan specific ports with -p
Use -p to target exact ports (comma-separated or a range like 1-1000). It is faster and quieter than a full scan when you already know what you are looking for.
nmap -p 22,80,3306 10.10.10.10
4
Scan every port with -p-
The default top-1000 misses services on unusual ports. -p- scans all 65,535 TCP ports so nothing hides on, say, 8080 or 55555. It is slower — worth it once early recon looks thin.
nmap -p- 10.10.10.10
5
Detect service versions with -sV
A plain scan only guesses the service from the port number. -sV interrogates each open port and reports the real product and version — the single most useful flag for finding known-vulnerable software.
nmap -sV 10.10.10.10
6
Run the default scripts with -sC
-sC runs Nmap's default NSE scripts — safe, useful checks like page titles, SSH host keys and anonymous FTP. Pair it with -sV (the classic 'nmap -sC -sV') for a rich first scan.
nmap -sC -sV 10.10.10.10
7
Do it all with -A
-A bundles version detection, the default scripts, OS detection and traceroute into one aggressive scan. Loud, but a fast way to learn everything about a single box.
nmap -A 10.10.10.10
8
Speed it up with -T4
Timing templates run from -T0 (paranoid, evades detection) to -T5 (insane, very fast). -T4 is the common choice on a lab network you own: quick without dropping results.
nmap -sV -T4 10.10.10.10

Applications

practice 10.10.10.10--:--

learner@kali: ~ — Terminal