📖 What is Nmap (Network Mapper)?
Nmap (Network Mapper) is an industry-standard open-source tool used for network discovery and security auditing. It uses raw IP packets to determine what hosts are available on the network, what services they offer, and what operating systems they are running.
"Memorize common flags like -sS for stealth SYN scans and -sV for version detection, as these are frequent targets for exam questions."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Nmap (Network Mapper)?
- ▸ TCP SYN Scanning (-sS) performs a 'half-open' scan by not completing the three-way handshake, making it stealthier and faster than full connect scans.
- ▸ Service Version Detection (-sV) probes open ports to identify the specific software and version running, which is essential for mapping known vulnerabilities.
- ▸ OS Fingerprinting (-O) analyzes unique TCP/IP stack responses to determine the target's operating system, helping testers tailor their subsequent attack vectors.
- ▸ The Nmap Scripting Engine (NSE) allows users to automate tasks like vulnerability detection and advanced discovery using a wide library of Lua scripts.
- ▸ UDP Scanning (-sU) identifies open UDP ports, though it is significantly slower than TCP scans due to the connectionless nature of the protocol.
🎯 How does Nmap (Network Mapper) appear on the PT0-002 Exam?
You may be asked to identify the best scan type when the objective is to minimize the footprint on target logs while identifying open TCP ports. You should select the SYN scan (-sS) as it avoids completing the full three-way handshake.
A scenario might describe a situation where you have identified an open port but need to determine if the service is vulnerable to a specific CVE. Expect to choose version detection (-sV) to find the exact software version.
Expect questions where you must choose the correct tool or flag to perform a vulnerability scan using a pre-defined script. This requires knowledge of the Nmap Scripting Engine (NSE) and the --script flag.
❓ Frequently Asked Questions
What is the primary difference between a TCP Connect scan (-sT) and a SYN scan (-sS)?
A Connect scan completes the full three-way handshake, which is easily logged by the target. A SYN scan is 'half-open,' sending a SYN and waiting for a SYN/ACK but never sending the final ACK, making it more discreet.
Why is UDP scanning often slower and less reliable than TCP scanning?
UDP is connectionless, meaning services often don't respond when a port is open. Furthermore, firewalls frequently drop ICMP 'Port Unreachable' messages, forcing Nmap to wait for timeouts before marking a port as filtered.