Tools & Commands · Ethical Hacking Tools
Nmap
Discovery · Beginner
A network scanner used to discover hosts and see which ports respond, and often which services they appear to run. It is a mapping tool for networks you are allowed to assess.
It asks which machines are up and which doors answer. Administrators use that inventory to find forgotten servers. The same questions are rude and often illegal on networks you do not administer.
Example: An authorized scan of 192.0.2.10 reports that TCP 22 is open and looks like a secure shell. Open means the port accepted a connection during that scan.
Git in the Zone explains security tools and attack terminology so you can recognize them and defend against them. Practice only on systems you own or have written permission to test. Nothing on this site runs a command or an exploit.
What it is for
Discover hosts, ports, and visible services on an authorized network.
Authorized use: Use it only on systems you own or have written permission to test. Git in the Zone explains the tool; it does not launch it.
Operating systems: Windows, Linux, and macOS.
Language you will see
- open
- closed
- filtered
- host discovery
- service version
How to read the options
- Host discovery: Checks which addresses respond, without trying to describe every application.
- Version probe: Asks responding ports which service they appear to be, so an inventory is more than a list of numbers.
- Port selection: Limits the test to the ports you were asked to check instead of implying every possible number.
How to read a result line
22/tcp open ssh 80/tcp open http 443/tcp filtered https
Open means the scan received a response that accepts connections. Filtered means a filter dropped or blocked the probe, so the state is uncertain. The service name is the scanner's best guess, not a security approval.
Common misconception
- An open port is not permission to log in, and a filtered port is not proof that nothing is listening.