Nmap Mastery: Advanced Scanning for Pentesters

During the 2024 Okta breach, attackers mapped internal services before pivoting laterally — reconnaissance that a well-tuned Nmap scan would have surfaced first. Most pentesters use Nmap daily but stop at -sV and move on. That leaves serious intelligence on the table.

Service Fingerprinting That Actually Tells You Something

A basic version scan gives you port numbers. Aggressive fingerprinting gives you exact software builds, misconfigurations, and attack surface. The difference matters when you’re deciding which exploit to reach for.

Run this against a target host:

nmap -sV --version-intensity 9 -sC -O -p 22,80,443,8080,3306 \
  --open 192.0.2.47 -oN recon_web01.txt

Here’s what that output looks like against a misconfigured internal web server:

PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey:
|   2048 ab:cd:12:34:ef:56:78:90:aa:bb:cc:dd (RSA)
80/tcp   open  http       Apache httpd 2.4.6
| http-title: Intranet Portal - corp-web01
| http-server-header: Apache/2.4.6 (CentOS)
3306/tcp open  mysql      MySQL 5.7.38
| mysql-info:
|   Version: 5.7.38-log
|_  Some Canary: N
OS details: Linux 3.10 - 4.11
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OpenSSH 7.4 on CentOS is end-of-life and vulnerable to username enumeration (CVE-2018-15473). MySQL exposed on 3306 with no firewall rule means you can attempt direct authentication. The OS fingerprint pointing to kernel 3.10–4.11 opens the door to a range of local privilege escalation exploits. This one scan just gave you three attack threads.

The flags: --version-intensity 9 pushes Nmap to try every probe, not just the likely ones. -sC runs the default NSE script set. -O adds OS detection. --open filters out closed and filtered ports so your output stays clean.

NSE Scripts: Your Built-In Exploit Recon Layer

Nmap’s Scripting Engine — NSE — ships with over 600 scripts. Most pentesters know http-enum. Far fewer use the scripts that pull back credential exposure, vulnerability confirmation, and misconfiguration details in a single pass.

Target a suspected SMB host with this:

nmap -p 445 --script smb-vuln-ms17-010,smb-security-mode,\
smb2-security-mode,smb-enum-shares \
--script-args smbuser=guest,smbpass='' \
192.0.2.112 -oN smb_scan_dc01.txt

Sample output:

Host: 192.0.2.112 (corp-dc01.internal)
PORT    STATE SERVICE
445/tcp open  microsoft-ds

| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1
|     State: VULNERABLE
|     Risk factor: HIGH
|     CVE: CVE-2017-0144 (EternalBlue)

| smb-security-mode:
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled

| smb-enum-shares:
|   account_used: guest
|   \\192.0.2.112\ADMIN$: READ, WRITE
|   \\192.0.2.112\C$: READ, WRITE
|_  \\192.0.2.112\IPC$: READ ONLY

EternalBlue still showing up in 2026 internal networks is not rare — it appears in assessments more than it should. Message signing disabled means you can relay NTLM hashes without breaking them first. Guest read/write on ADMIN$ and C$ is game over for that host. You’d pivot immediately to Metasploit’s exploit/windows/smb/ms17_010_eternalblue or start an NTLM relay with Responder and ntlmrelayx.

The script syntax is worth knowing cold. --script accepts comma-separated names, wildcards (smb-*), or categories like vuln or auth. --script-args passes credentials or options directly into the scripts.

Firewall Evasion When the Loud Scans Get Dropped

Corporate firewalls and IDS rulesets are tuned to catch SYN floods and sequential port sweeps. When a standard scan returns suspiciously clean results, it’s time to vary your timing and fragmentation.

nmap -sS -T2 -f --mtu 24 --data-length 48 \
--source-port 53 -D 192.0.2.200,192.0.2.201,ME \
-p 1-1024 192.0.2.88 -oN evasion_scan_fw01.txt

Breaking down the evasion stack: -T2 slows packet timing to blend into normal traffic. -f fragments packets; --mtu 24 forces tiny 24-byte fragments that many stateful inspection engines fail to reassemble correctly. --data-length 48 pads packets to look less like a probe. --source-port 53 spoofs the source as DNS traffic, which many firewall rules pass without inspection. -D inserts decoy IPs into the scan so the target sees traffic from multiple sources simultaneously — harder to block, harder to attribute.

Use this when a target network returns all ports filtered on a clean scan but you know services are running. If you start seeing open ports appear that were hidden before, the firewall is doing shallow inspection and your evasion is working.

What To Do Now

Pull up the last internal assessment report you have access to and rerun the original scan with --version-intensity 9 -sC --script vuln added. Compare the output against what was originally captured. You will almost certainly find a service version, an NSE hit, or a misconfiguration that the basic scan missed — and that’s your starting point for a deeper look.