The world's most powerful open-source network scanner. Discover hosts, open ports, running services, OS versions, and vulnerabilities. Every penetration test starts with Nmap. Includes a live online port scanner — scan any domain or IP instantly.
Nmap (Network Mapper) is a free, open-source tool for network discovery and security auditing. Created by Gordon Lyon in 1997, it has become the de facto standard for network reconnaissance in penetration testing, vulnerability assessment, and network inventory management.
Nmap sends raw IP packets to determine which hosts are available on the network, what services those hosts are running, what operating systems are in use, what type of firewalls are deployed, and dozens of other characteristics. Every professional penetration test starts here.
You are a junior penetration tester at a cybersecurity firm. Your client, AcmeCorp, has commissioned an external network assessment. They have provided written authorization to test their IP range 192.168.1.0/24.
Your first task is the Reconnaissance Phase: discover live hosts, enumerate open ports, identify running services, and detect any potentially vulnerable versions. Document all findings for the penetration test report.
nmap -sn 192.168.1.0/24
nmap -sV -sC 192.168.1.10
nmap -p- -T4 192.168.1.10
sudo nmap -sV -sC -O -p- -T4 192.168.1.10 -oN recon.txt
nmap --script vuln 192.168.1.10
sudo nmap -sV -sC -O -p- --script vuln -T4 192.168.1.10 -oN recon.txt -oX recon.xml
db_import recon.xml), OpenVAS, or report generators. This is your complete recon package for every professional engagement.nmap -sn first on the whole subnet before deep scanning individual hosts. Scanning all 65535 ports on a /24 subnet without knowing which hosts are alive would take hours.-sV. "Port 80 open, http" tells you almost nothing. "Apache 2.4.29" tells you about dozens of publicly known CVEs you can look up on NVD and exploit with Metasploit.-O requires sudo/root privileges. Without elevated privileges, Nmap cannot send the raw crafted TCP/IP packets needed for OS fingerprinting. Always prefix with sudo nmap when using -O.-oN report.txt and -oX report.xml. The XML file can be imported directly into Metasploit with db_import report.xml. It auto-populates all hosts and services into your msf database.mysql -h TARGET -u root --password=. A blank root password is a direct path to data exfiltration.nmap -sV <target> ·
HackerTarget ↗
Found an interesting IP or CVE during your Nmap scan? Look it up instantly with these live API widgets.