1. Full TCP sweep
On an authorized target, -p- scans all 65535 TCP ports and -T4 picks a faster timing template.
nmap -p- -T4 targetTyporithm · medium
nmap Deep Scanning
nmap-deeppentestnmapportsnse
Saved on this device
Full lesson · 8 learning steps Open any exercise for focused practice
10%
Step 1 of 8 · intro card
Learn nmap Deep Scanning
Scanning & Enum
Within an authorized engagement, a full TCP sweep (-p-) finds every open port, then -sC -sV runs default scripts and version detection on the interesting ones. -sU covers UDP, NSE vuln scripts flag known issues, and timing templates trade speed for stealth.
Scanning is the heart of an authorized penetration test: you can only attack what you can see. nmap -p- sweeps all 65535 TCP ports so nothing is missed, and -T4 speeds it up when stealth is not a concern.
Once you know which ports are open, you focus: nmap -sC -sV -p 22,80,443 runs the default NSE scripts and version detection only on those services, identifying exact software and versions.
UDP is scanned separately with -sU because it behaves differently and is slow, so --top-ports 100 keeps it practical. NSE vuln scripts surface known weaknesses, but they are starting points — every finding is manually validated, never reported on the scanner's word alone.
01
-p- scans all 65535 TCP ports; -T4 is faster timing.
02
-sC -sV adds default scripts and version detection.
03
-sU scans UDP; vuln scripts only suggest issues to verify.
nmap -p- -T4 target
nmap -sC -sV -p 22,80,443 target
nmap -sU --top-ports 100 target
nmap --script "vuln" targetRead the implementation
Connect each part of the code to the concept before you type.
2. Scripts + versions
-sC runs the default NSE scripts and -sV does version detection, focused on the ports you already found open.
nmap -sC -sV -p 22,80,443 target3. UDP scan
-sU scans UDP; it is slow, so --top-ports 100 limits it to the most common services.
nmap -sU --top-ports 100 target4. Vuln scripts
The vuln NSE category flags known issues, but each hit must be manually confirmed before you trust it.
nmap --script "vuln" targetA complete learning loop
01
Understand
Read the concept map and follow the code breakdown.
02
Reconstruct
Type the implementation, repair mistakes and work through every recall exercise.
03
Verify
Use the final check without hints; revisit weak concepts in short practice sessions.