Network Reconnaissance

nmap in 60 seconds

nmap sends packets to a host and infers which ports are open, what services are running, and sometimes the OS version — all from the response patterns.

# Quick scan — top 1000 ports, service detection
nmap -sV target.ip

# Full port scan
nmap -p- target.ip

# OS detection + service version + default scripts
nmap -sV -sC -O target.ip

# Save output
nmap -sV -oN scan.txt -oX scan.xml target.ip

Reading the output

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4
80/tcp open  http    Apache 2.4.51
443/tcp open ssl/http nginx 1.21

For each open port: note the service and version. Google service version CVE to find known vulnerabilities — CTF boxes often run deliberately outdated software.

Script scanning

nmap’s --script flag runs NSE (Lua) scripts:

# Run all safe default scripts
nmap -sC target.ip

# Check for specific vulnerabilities
nmap --script vuln target.ip
nmap --script http-enum target.ip   # directory bruteforce
nmap --script ftp-anon target.ip    # anonymous FTP login check
nmap --script ssh-brute --script-args userdb=users.txt,passdb=pass.txt target.ip

CTF-specific tips

• Always scan all 65535 ports (-p-) — CTF challenges hide services on high ports (8080, 4444, 31337).
• UDP services (-sU) are less common but worth checking if TCP finds nothing.
• -Pn skips host discovery (treats the host as up) — useful when ICMP is blocked.

Interpreting “filtered”

A filtered port means nmap got no response — a firewall dropped the packet. It’s not closed (which sends a RST). On CTF boxes, filtered ports sometimes open after you interact with the service in a specific way (port knocking).