Nmap Mastery: Advanced Scanning for Pentesters

In the 2024 Scattered Spider campaign, attackers mapped internal networks within minutes of initial access — using nothing exotic, just disciplined enumeration. Nmap, used carelessly, gives you a list of open ports. Used well, it hands you a blueprint of the target. Here’s how to use it well.

Service Fingerprinting That Actually Tells You Something

Default scans tell you port 443 is open. That’s useless. You need to know what is running on port 443, and what version. That’s where -sV and -A earn their place.

Run this against a target like web01.corp.internal (192.0.2.14):

nmap -sV -A -p 22,80,443,8080 --version-intensity 9 192.0.2.14

Here’s what real output looks like:

PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey:
|   2048 ab:cd:ef:12:34:56:78:90:aa:bb:cc:dd (RSA)
80/tcp   open  http       Apache httpd 2.4.6 ((CentOS))
|_http-title: Corp Internal Portal
443/tcp  open  ssl/http   nginx 1.14.0
| ssl-cert: Subject: commonName=web01.corp.internal
| Not valid after: 2025-03-12
8080/tcp open  http       Apache Tomcat 8.5.32
|_http-title: Apache Tomcat/8.5.32

This single scan just handed you three attack vectors. Apache 2.4.6 on CentOS is end-of-life — check it against CVE-2017-7679 and friends. Tomcat 8.5.32 is vulnerable to CVE-2018-11784, a redirect manipulation bug. And that SSL cert expired in March 2025, which is a client to interrogate about patch hygiene. --version-intensity 9 pushes Nmap to probe harder, trading speed for accuracy. Always worth it on targeted assessments.

What you do next: pull the Tomcat version string, cross-reference with searchsploit tomcat 8.5, and start checking for manager console exposure on /manager/html.

NSE Scripts: Turning Nmap Into a Vulnerability Scanner

Nmap’s scripting engine (NSE) — a library of Lua scripts bundled with Nmap — lets you go from “port is open” to “here’s the vulnerability” in one command. Most pentesters underuse it.

Target the same host and run the vuln category alongside SMB-specific scripts against an internal box at 192.0.2.22 (fs01.corp.internal):

nmap -p 445 --script smb-vuln-ms17-010,smb-security-mode,smb2-security-mode -Pn 192.0.2.22

Host script results:
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers
|     State: VULNERABLE
|     IDs: CVE:CVE-2017-0143
|     Risk factor: HIGH
|     Description: The SMBv1 server in Microsoft Windows is vulnerable
|                  to remote code execution via MS17-010 (EternalBlue).
|     Disclosure date: 2017-03-14
|     References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled

EternalBlue is still alive in enterprise networks — this is not a 2017 problem, it’s a patching-discipline problem. Two critical findings in one script run: the host is vulnerable to MS17-010, and SMB signing is disabled. Disabled signing means you can relay NTLM authentication with Responder and ntlmrelayx without cracking a single hash.

The guest account being used for enumeration also tells you null sessions are allowed — that’s an Active Directory misconfiguration worth escalating in your report. From here, a real engagement pivots to Metasploit’s exploit/windows/smb/ms17_010_eternalblue or, if you’re going stealthier, manual exploitation. Either way, Nmap told you exactly where to point the cannon.

Evading Detection With Timing and Fragmentation

Noisy scans get caught. IDS signatures trigger on SYN floods from a single source. When you’re in a red team engagement where detection matters, slow down and fragment.

nmap -sS -T1 -f --data-length 24 --randomize-hosts -D 192.0.2.55,192.0.2.67,ME \
  -p 22,80,443,3389 192.0.2.0/28

Breaking this down: -T1 (sneaky timing) inserts long delays between probes, staying under most rate-based detection thresholds. -f fragments packets into 8-byte chunks, breaking simple packet-inspection rules. --data-length 24 pads packets to look less like textbook Nmap traffic. -D 192.0.2.55,192.0.2.67,ME sends decoy packets from two spoofed IPs alongside your real traffic — analysts watching the IDS see noise from three sources, not one clear attacker.

Use this on internal segments when the SOC is actively monitoring. It’s slower, but in a two-week red team, slow and quiet beats fast and caught. Pair it with --source-port 53 on networks that whitelist DNS traffic, and you’ll slide past a surprising number of firewalls.

What To Do Now

Pick one live host on your lab network — a spare VM or a purposely vulnerable box like Metasploitable2. Run this exact command against it:

nmap -sV -A --script vuln -p- --open -oA scan_results 192.0.2.x

The -oA flag saves output in all three formats (normal, XML, grepable) simultaneously. Open the .xml file in Metasploit’s db_import or upload it to Faraday. Practice reading the version strings and mapping them to CVEs before your next engagement — that habit, built in a lab, is what separates a fast pentester from a thorough one.