Stop 06 · Ethical Hacking & Penetration TestingTopics · 3/11

Scanning & Enumeration (Nmap)

In short

Scanning answers a simple question: what is running here, and on which doors? Testers use it on authorised targets, and defenders use the very same tools to audit their own networks.

Actively probing a target to discover open ports, running services, and versions — Nmap is the standard tool, and enumeration extends this into identifying specific system details useful for exploitation.

The blob caretaker walks a corridor checking which doors are locked or open.

Think of it like this

Checking which doors are unlocked

A caretaker walking their own building notes which doors are open, which are locked, and which lead where. Nmap does that for a network: it reports open ports and the services behind them, so you know your real exposure.

Watch it happen

Scanning your own lab host

Discover

Ports

Services

Harden

1/4Find which hosts in your own lab are alive and responding.

The big ideas

What you need to know

Ports are doors

Each open port is a service listening. Knowing which are open on your own systems is basic hygiene.

Enumeration adds detail

Beyond open or closed, enumeration finds the service name and version, which guides patching decisions.

Defenders scan too

Run Nmap against your own network to find forgotten services, then shut down what should not be exposed.

Only your own targets

Scanning networks you do not own can be illegal and is always rude. Stick to your lab or written scope.

See it in code

Walk through the code

bash

1# Scan a VM YOU own on your own lab network, by its IP2# -sV asks Nmap to identify service versions on open ports3nmap -sV 192.168.56.1014 5# Save the result to review which doors you can safely close6nmap -sV -oN my-lab-scan.txt 192.168.56.101

1/2Nmap lists open ports on your lab host and tries to name the service and version on each.

Run this only against machines you own or are authorised to test. The output is a to do list for hardening: close unused ports, patch old versions.

Save yourself the pain

Common mistakes

Oops

Running Nmap against any interesting IP on the internet.

Do this instead

Scan only hosts you own or have written permission to test. Unsolicited scanning can break the law.

Oops

Stopping at the list of open ports.

Do this instead

Enumerate the service and version too. That detail tells you what to patch, which is the defensive goal.

Your mission

Map your own lab

~40 min

Quick check

A defender runs Nmap against their own servers. What is the main benefit?

Go deeper

1Run Nmap against a practice lab target and interpret the scan results.
2Learn common Nmap scan types (SYN scan, service version detection) and when to use each.
3Practice enumerating a specific service (like an FTP or web server) for more detail after initial scanning.