Nmap for finding your initial clues

In a pentest, you can't attack what you don't know exists — that's where Nmap comes in.Nmap is the tools that helps to find What network ports are open on this target, and what might be running behind them.In this blog, I'll explain how Nmap works, some of its most useful options, and how it can make the reconnaissance stage of penetration testing easier and more effective.

Nmap is one of the most commonly used tools in penetration testing. We mainly use it to find out which ports are open on a target machine and what services are running on those ports. For example, if Nmap shows ports 22, 80, and 445 as open, we can understand that SSH, HTTP, and SMB services may be running there.

But Nmap is not only used for finding open ports. It can also help us identify the service versions, get some information about the operating system, and perform further enumeration using its built-in scripts. This makes Nmap very useful during the initial stage of a pentest because it gives us a better idea of what we are dealing with before moving to the next step.

So the command for running nmap:

nmap -T4 -p- -A -sV -sC IP Address

probably you will get

PORT STATE SERVICE VERSION

22/tcp open ssh OpenSSH

80/tcp open http Apache

445/tcp open microsoft-ds

3389/tcp open ms-wbt-server

something like this.That means this ports are open and they are running services.Nmap is also finding the services as well.

The command nmap -T4 -p- -A -sV IP Address is used for performing a detailed scan of a target during a penetration test.

Here, nmap starts the Nmap scanner, while -T1/2/3/4/5 increases the scanning speed, making it faster than the default timing.

The -p- option tells Nmap to scan all 65,535 TCP ports, which is useful because a service might be running on an unusual port instead of the common ones.

The -A option enables several advanced features, such as OS detection, version detection, default NSE scripts, and trace-route, allowing us to gather more information about the target.

The -sV option focuses specifically on identifying the services and their versions, so instead of simply seeing that port 80 is open, we might learn that an Apache web server is running there.

We can use rustscan as well to scan more fast.

And after that you have an initial concept about the pentesting.