Nmap is a port scanner that is comprehensive, feature- and fingerprint-rich, and widely used by the IT security community. It is written and maintained by Fyodor. It is a must-have tool for a penetration tester because of its quality and flexibility.

Besides being used as a port scanner, Nmap has several other capabilities, as follows:

• Host discovery: Nmap can be used to find live hosts on the target systems. By default, Nmap will send an ICMP echo request, a TCP SYN packet to port 443, a TCP ACK packet to port 80, and an ICMP timestamp request to carry out host discovery.
• Service/version detection: After Nmap has discovered the ports, it can further check for the service protocol, the application name, and the version number used on the target machine.
• Operating system detection: Nmap sends a series of packets to the remote host, and examines the responses. Then, it compares these responses with its operating system fingerprint database and prints out the details if there is a match. If it is not able to determine the operating system, Nmap will provide a URL to which you can submit the fingerprint to update its operating system fingerprint database. Of course, you should submit the fingerprint if you know the operating system used on the target system.
• Network traceroute: This is performed to determine the port and protocol that are most likely to reach the target system. Nmap traceroute starts with a high value of TTL and decrements it until the TTL value reaches zero.
• Nmap Scripting Engine: With this feature, Nmap can be extended. If you want to add a check that is not included with the default Nmap, you can do so by writing the check using the Nmap scripting engine. Currently, there are checks for vulnerabilities in network services and for enumerating resources on the target system.

It is good practice to always check for new versions of Nmap. If you find the latest version of Nmap that is available for Kali Linux, you can update your Nmap by issuing the following commands:

apt-get update
apt-get install nmap  

To start Nmap, you can navigate to Applications and then to Information Gathering. You can also start Nmap by going to the console to execute the following command:

nmap  

This will display all of the Nmap options with their descriptions.

A user who is new to Nmap will find the available options quite overwhelming.

Fortunately, you only need one option to scan for the remote machine. That option is your target IP address or hostname, if you have set up the DNS correctly. This is done with the following command:

    nmap 172.16.43.156

The following is the result of the scan without any other options:

    Nmap scan report for 172.16.43.156
    Host is up (0.00025s latency).
    Not shown: 977 closed ports
    PORT     STATE SERVICE
    21/tcp   open  ftp
    22/tcp   open  ssh
    23/tcp   open  telnet
    25/tcp   open  smtp
    53/tcp   open  domain
    80/tcp   open  http
    111/tcp  open  rpcbind
    139/tcp  open  netbios-ssn
    445/tcp  open  microsoft-ds
    512/tcp  open  exec
    513/tcp  open  login
    514/tcp  open  shell
    1099/tcp open  rmiregistry
    1524/tcp open  ingreslock
    2049/tcp open  nfs
    2121/tcp open  ccproxy-ftp
    3306/tcp open  mysql
    5432/tcp open  postgresql
    5900/tcp open  vnc
    6000/tcp open  X11
    6667/tcp open  irc
    8009/tcp open  ajp13
    8180/tcp open  unknown
    MAC Address: 00:0C;29:18:0F:08 (VMware)
    
    Nmap done: 1 IP address (1 host up) scanned in 1.7 seconds

From the preceding result, we can see that the target machine is very vulnerable to attack because it has many open ports.

Before we continue to use Nmap, let's take a look at the port states that can be identified by Nmap. There are six port states that are recognized by Nmap, as follows:

• Open: This means that there is an application accepting a TCP connection, UDP datagram, or SCTP association.
• Closed: This means that although the port is accessible, there is no application listening on the port.
• Filtered: This means that Nmap can't determine whether the port is open or not because there is a packet-filtering device blocking the probe to reach the target.
• Unfiltered: This means that the port is accessible, but Nmap cannot determine whether it is open or closed.
• Open|Filtered: This means that Nmap is unable to determine whether a port is open or filtered. This happens when a scan of open ports doesn't give a response. It can be achieved by setting the firewall to drop packets.
• Closed|Filtered: This means Nmap is unable to determine whether a port is closed or filtered.

After describing the port states, we will describe several options that are commonly used during penetration testing, and, after that, we will use those options in practice.