Nmap in Kali Linux – Port Scanning and Network Discovery Commands

Nmap is a popular network scanning tool used to find devices, open ports, and running services. It provides many useful commands for network discovery and security testing. It comes pre-built with Kali Linux, so you can use it directly from the terminal to learn the basics of network scanning using simple commands.

Here’s what you can do with Nmap in Kali Linux:

  • Discover active devices on a network.
  • Scan open ports on a host.
  • Identify running services.
  • Detect service versions.
  • Detect the operating system.
  • Perform different types of port scans.
  • Scan specific ports.
  • Scan multiple ports.
  • Save scan results to files.
  • Use Nmap scripts for security testing.

Note: Only scan systems and networks that you own or have permission to test.

Nmap Installation Commands

Nmap is usually pre-installed in Kali Linux. First, check whether it is available.

nmap --version

If Nmap is not installed, update the package list.

sudo apt update

Install Nmap.

sudo apt install nmap -y

Check the installed version again.

nmap --version

Nmap Usage Commands

Below are some useful Nmap commands that you can use in Kali Linux. You can use these commands to discover devices, scan ports, check running services, detect operating systems, and perform different types of network scans.

Before scanning, replace 192.168.1.1 or other example targets with a system you are authorized to test.

Scan a host:

nmap 192.168.1.1

This performs a basic scan and shows the detected open ports.

Scan a domain:

nmap example.com

Scan specific ports:

nmap -p 80,443 192.168.1.1

Scan a range of ports:

nmap -p 1-1000 192.168.1.1

Scan all TCP ports:

nmap -p- 192.168.1.1

Detect service and version information:

nmap -sV 192.168.1.1

Detect the operating system:

sudo nmap -O 192.168.1.1

Use OS and service detection together:

sudo nmap -A 192.168.1.1

Perform a basic host discovery scan:

nmap -sn 192.168.1.0/24

This checks which hosts are active without performing a normal port scan.

Scan a specific subnet:

nmap 192.168.1.0/24

Scan multiple targets:

nmap 192.168.1.1 192.168.1.10 192.168.1.20

You can also place multiple targets in a file:

192.168.1.1
192.168.1.10
192.168.1.20

Then scan the targets from the file:

nmap -iL targets.txt

Save the normal scan output to a file:

nmap 192.168.1.1 -oN scan.txt

Save the results in XML format:

nmap 192.168.1.1 -oX scan.xml

Save results in all major output formats:

nmap 192.168.1.1 -oA scan

Scan using a TCP SYN scan:

sudo nmap -sS 192.168.1.1

Scan using TCP connect:

nmap -sT 192.168.1.1

Scan UDP ports:

sudo nmap -sU 192.168.1.1

Use a default set of Nmap scripts:

nmap -sC 192.168.1.1

You can combine service detection and default scripts:

nmap -sC -sV 192.168.1.1

Use a specific Nmap script:

nmap --script <script-name> 192.168.1.1

List available Nmap scripts:

ls /usr/share/nmap/scripts/

Search for a particular script:

ls /usr/share/nmap/scripts/ | grep http

Show Nmap help:

nmap --help

For more detailed help:

nmap -h

Nmap also provides extensive documentation through its manual page:

man nmap

You can combine different Nmap options to get more information from a scan. Start with simple scans and slowly explore other options to understand how Nmap works.

Overview

Nmap is a powerful tool for network scanning and security testing. It provides many useful commands to find devices, check open ports, identify services, and gather network information, while Kali Linux includes Nmap by default, allowing you to run different network scanning commands from the terminal.

SHARE THIS POST: