Nmap Tutorials

Use Nmap from two real network positions, identify unexpected access and unavailable required services, and deliver a complete review.

Find the current workshop service with a scoped Nmap scan, distinguish it from an archive, and reconnect a real roster client.

Meet Kali Linux, discover its origins and purpose, compare it with general-purpose Linux distributions, and experience a security tool against a prepared local training service.

Compare a real Nmap baseline with current services, distinguish approved changes from faults, and deliver a business-aware review.

In this lab, you will use Nmap as an active vulnerability scanner. By leveraging the specific 'vuln' and 'exploit' script categories within the NSE, you will actively probe target services to identify known CVEs and dangerous server misconfigurations.

In this lab, you'll enumerate Remote Desktop Protocol (RDP) services, identify vulnerabilities, and gain access using weak credentials. Use `nmap` for scanning, `xfreerdp` for connection, and retrieve a flag from the remote desktop session.

In this lab, you will learn how to properly document and parse penetration testing data. You will configure Nmap to save its scan results into Normal, Grepable, and XML formats, and use Linux text-processing tools to quickly extract lists of open ports for downstream exploitation tools.

In this lab, you will learn to perform Server Message Block (SMB) enumeration. You'll use `nmap` to identify the SMB service, exploit a guest access misconfiguration with `smbclient`, and retrieve a flag from a shared directory, simulating a common network vulnerability.

In this lab, you will learn the basics of network enumeration. You'll use `nmap` to scan a target for open ports, identify a vulnerable Telnet service, and gain access to retrieve a flag, simulating a basic penetration test.

In this lab, you will learn to enumerate and exploit a misconfigured Rsync service. You'll use `nmap` to detect the service, connect anonymously to sync files from a remote target, and retrieve a flag, highlighting risks in backup synchronization services.

In this lab, you will understand the low-level mechanics of network port scanning. You will utilize Nmap to perform full TCP Connect scans, stealthy TCP SYN (Half-Open) scans, and notoriously difficult UDP port scans to accurately identify open services on a target machine.

In this lab, you will explore passive Domain Name System (DNS) reconnaissance using `dig` and `host`. You will attempt DNS zone transfers, query specific records (like MX for email and TXT for SPF rules), and map out hidden subdomains to expand your target attack surface.

In this lab, you will learn the basics of network enumeration and file transfer protocol exploitation. You'll use `nmap` to scan a target for open ports, identify a vulnerable FTP service, gain anonymous access, and retrieve a flag, simulating a basic penetration test.

In this lab, you will learn how to use Nmap's version detection feature (-sV) to interrogate open ports and accurately identify the exact software names and version numbers running on the target.

In this lab, you will learn how to tune Nmap to scan large enterprise networks efficiently. You will practice optimizing scan speeds using timing templates (-T), controlling parallel host execution, and targeting highly specific port lists to reduce scan times from hours to minutes.

In this lab, you will learn how attackers determine a server's operating system remotely. You will utilize Nmap's OS fingerprinting capabilities (-O) to analyze the unique quirks in how a target responds to malformed TCP/IP packets, effectively guessing its underlying operating system.

In this lab, you'll enumerate weak credentials for a Telnet service using a wordlist. You will scan with nmap, use hydra for a brute-force attack, and gain access to a target system to retrieve a flag, highlighting the risks of weak passwords.

In this lab, you will transition Nmap from a simple port scanner into a versatile auditing tool by exploring the Nmap Scripting Engine (NSE) and running default scripts.