Nmap is a free program that asks a computer which network doors are open, and which software answers behind each one. Learn it before any hacking tool, because you cannot test a system until you know what it exposes.
You can install it tonight on an old Windows laptop and run your first legal scan in 30 minutes. This article shows how, and how to read what comes back.
What is Nmap, in plain words?
Every computer on a network has numbered doors called ports. A website usually answers on port 80 or 443. Remote login for admins usually answers on port 22.
Nmap knocks on these doors and writes down what happens. Some doors answer, some stay silent, and some are blocked by a firewall. Nmap can also ask the software behind an open door for its name and version.
That last part matters most. An old version of a web server or login service is often where a real test begins.
Where does Nmap fit in ethical hacking?
Ethical hacking follows an order. First you collect public information about the target. Then you scan it to list what it exposes. Only then do you test each thing you found, and write a report.
Nmap is the scanning step. Everything after it depends on that list. If you skip a port, you never test the service behind it.
That is why we put it early. At Saarathi Academy in Old Baneshwor, Kathmandu, Week 1 of the cybersecurity course covers how the internet works, and what ports and protocols are. Week 3 is Nmap: scan types, service detection and safe defaults. In the same week you check Nmap's results against the raw traffic in Wireshark, and wrap your scan in a small Bash script that saves a list of services.
Week 9 then returns to the services you listed in Week 3, and tests them. A weak scan in Week 3 means less to test in Week 9.
Is it legal to use Nmap in Nepal?
Testing a computer without permission can be a crime in Nepal. Section 45 of the Electronic Transactions Act 2063 covers unauthorised access to a computer, with up to three years in prison. Nmap's own guide says there is no simple answer to whether port scanning is legal. So treat any scan without permission as a real risk.
The rule we follow is simple. Only scan your own laptop, scanme.nmap.org, or a free practice lab that gives you a target on purpose. The second one is a machine the Nmap project set up for practice.
Nmap's own page on legal issues gives permission to scan scanme.nmap.org with Nmap only. It does not allow attacks on it. It also asks you to keep to about a dozen scans a day. The same page says to get written permission before you scan any other network.
Do not scan your college network, your office Wi-Fi or a friend's website "just to see". If a teacher or course tells you to, ask for the written permission first.
How do you try Nmap in 30 minutes?
Download it from the official Nmap download page. On Windows, the installer includes Zenmap, a window where you type the target and see the result. It supports Windows 7 and newer, so a slow college laptop is fine. On Linux, it is usually one install command away.
Then run these, one at a time. Type them in the Command Prompt, or in the command box inside Zenmap.
First, scan your own laptop with nmap localhost. This is the safest first scan, and it shows which doors your own machine leaves open.
Next, run nmap -F scanme.nmap.org. The -F option is fast mode, so it checks fewer ports than a normal scan.
Then run nmap -sV -F scanme.nmap.org -oN scan1.txt. The -sV option asks each open port for its software name and version. The -oN option saves the result in a text file, so you can read it again later.
That is two of your dozen scans of scanme.nmap.org for the day. Stop there.
How do you read the result?
The main part of the result has three columns: the port, its state and the service name. Most beginners only look for the word "open". Read every state, because each one tells you something.
Nmap's guide to port states explains them. The three you will see most:
- open: a program is listening and accepting connections on that port.
- closed: the port can be reached, but no program is listening.
- filtered: a firewall or filter blocks Nmap, so it cannot tell if the port is open.
A filtered port does not mean nothing is there. It means something is in the way. Write that down in your notes, the same as an open port.
Now pick one open port from your scan. Write the service name and version next to it. Then search that version name with the word "documentation" and read what the software does. You have just done a small part of the enumeration step that real tests depend on.
Which Nmap habits should you skip?
It is tempting to run nmap -A with the fastest timing on every target. The -A option turns on system detection, version detection, scripts and a route trace, all at once. Nmap's own legal page advises default timing, and no heavy features unless you need them.
We agree. Learn to read a plain scan first. A plain scan you understand is worth more than a heavy scan you copied.
Keep a note for every scan: the date, the target, the exact command and what you found. Real test reports are written from notes like these.
Your next step
Tonight, install Nmap, scan your own laptop, and run your three scans on scanme.nmap.org. Then read Nmap's port states page once more with your own result open next to it.
If you want to know what an ethical hacking course in Nepal should really cover, we wrote about that in why ethical hacking training in Nepal is growing.
Our cybersecurity course page shows how the course runs, and the full week-by-week syllabus is public before you pay.
Top comments (0)