In 2024, the Volt Typhoon threat group was caught inside U.S. critical infrastructure for five years — partly because defenders weren’t watching for the slow, low-volume reconnaissance that preceded every lateral move. Nmap, used carelessly, announces your presence instantly. Used skillfully, it tells you almost everything about a target while staying under the radar. Here’s how professionals actually run it.
1. Fingerprinting Services Without Triggering IDS
A default nmap -sV scan blasts every open port with aggressive version-detection probes. Modern intrusion detection systems (IDS) — think Snort or Suricata — catch this pattern in seconds. The fix is surgical: combine a SYN scan with limited version intensity and careful timing.
nmap -sS -sV --version-intensity 2 -T2 -p 22,80,443,8443,8080 \
--source-port 53 -oA recon/corp-web 192.0.2.45
Breaking this down: -sS sends a SYN packet and reads the SYN-ACK without completing the TCP handshake — stealthier than a full connect scan. --version-intensity 2 (scale 0–9) limits probe volume so you’re not carpet-bombing the service. -T2 (“Polite” timing) slows inter-probe delay to roughly 0.4 seconds. --source-port 53 spoofs a DNS source port, which some misconfigured firewalls allow through as “legitimate DNS traffic.”
Here’s what the output looks like against a realistic target:
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11
80/tcp open http nginx 1.18.0
443/tcp open ssl/https nginx 1.18.0
8443/tcp open ssl/https Apache Tomcat 9.0.58
8080/tcp closed http
Nmap done: 1 IP address (1 host up) scanned in 42.17 seconds
What matters here: Tomcat 9.0.58 on port 8443 is interesting. CVE-2025-24813, a partial PUT deserialization flaw, affects Tomcat versions before 9.0.99. That’s your next pivot — confirm the exact patch level and check whether the default manager app is exposed. The SSH version also tells you the OS: Ubuntu 20.04 LTS. Now you have an attack surface, not just a list of open ports.
2. NSE Scripts: Turning Nmap Into an Active Vulnerability Scanner
The Nmap Scripting Engine (NSE) — a built-in library of Lua scripts — lets you go from “port is open” to “here’s the actual vulnerability” in one command. Scripts live in /usr/share/nmap/scripts/ and cover everything from HTTP header enumeration to SMB exploit detection.
Suppose your recon above flagged port 443. You want to check for weak TLS configuration and exposed HTTP security headers on corp-web.acme-internal.lab:
nmap -sV -p 443 \
--script ssl-enum-ciphers,http-security-headers,http-title \
--script-args http.useragent="Mozilla/5.0" \
192.0.2.45
PORT STATE SERVICE VERSION
443/tcp open ssl/https nginx 1.18.0
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_RSA_WITH_RC4_128_SHA - E (weak cipher)
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - A
| least strength: E
| http-security-headers:
| X-Frame-Options: MISSING
| Content-Security-Policy: MISSING
| Strict-Transport-Security: MISSING
|_ X-Content-Type-Options: MISSING
| http-title:
|_ Acme Corp Employee Portal
Two immediate findings. First, RC4 is still enabled — a cipher retired in RFC 7465 (2015). Any session using it is vulnerable to BEAST and related attacks. Second, every major security header is missing. No CSP means XSS is trivially exploitable without the browser’s built-in mitigation. No HSTS means a downgrade attack is viable on the same network.
A defender reading this output patches the cipher suite in /etc/nginx/nginx.conf today. A pentester documents each finding, maps it to OWASP or CVE references, and chains it into the next phase: if that employee portal accepts login credentials over a downgrade-able connection, credential interception is now on the table.
3. Host Discovery on Segmented Networks
Inside an engagement, you often land in a segment with no DNS and no idea what else is alive. Default Nmap host discovery — ICMP echo plus TCP to 80/443 — fails when ICMP is blocked at the segment boundary. Use this instead:
nmap -sn -PS22,80,443,3389,8080 -PA80,443 \
--disable-arp-ping \
192.0.2.0/28 \
-oG recon/live-hosts.gnmap
-sn skips port scanning — this is pure host discovery. -PS sends TCP SYN probes to those specific ports (common services that are usually reachable). -PA sends TCP ACK probes, which can pass through stateless ACL rules that block SYN. --disable-arp-ping is critical when you’re routing through a pivot rather than sitting on the same Layer 2 segment — ARP doesn’t cross routers.
The -oG grepable output format makes parsing trivial:
grep "Up" recon/live-hosts.gnmap
# Host: 192.0.2.41 Status: Up
# Host: 192.0.2.44 Status: Up
# Host: 192.0.2.45 Status: Up
# Host: 192.0.2.47 Status: Up
Four live hosts in a /28 you assumed was empty. Feed those IPs straight into your next targeted scan. Every host is a new attack surface.
What To Do Now
Pull up any lab environment or practice range you have access to — HackTheBox, TryHackMe, or a local VM — and run the NSE script combo from section two against a web-facing target. Focus on reading what ssl-enum-ciphers grades each cipher suite and understand why the grade is assigned. That single habit — not just running Nmap but interpreting what it returns — is what separates a scanner operator from a pentester.
