Thuta Learning
Search
IntermediateSecurityintermediate

Nmap Deep Dive (Scan Types, Version Detection)

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

  • Understand Nmap Deep Dive (Scan Types, Version Detection) without the intimidation factor
  • Get hands-on running tools yourself in an authorized lab environment
  • Be ready to apply this concept directly in a real assessment/report

Let's think about this for a moment

A SYN scan (`-sS`) never completes the full TCP handshake (a 'half-open scan') — it's stealthier and faster than a traditional connect scan (and needs root/admin permission). Service/version detection (`-sV`) doesn't just tell you a port is open, it estimates which software/version is running there (for example, Apache 2.4.29) — knowing the version is what lets you check whether it has any known vulnerabilities. OS detection (`-O`) estimates the target's operating system based on TCP/IP stack behavior.

Let's connect it to a real scenario

Run `nmap -sV -O 192.168.56.101` and you'll get the port list, the Apache/MySQL versions, and the target's OS (Linux kernel version) all at once — look up a version number (say, vsftpd 2.3.4) in a public vulnerability database (CVE, Exploit-DB) to see if there are known vulnerabilities. Metasploitable's vsftpd 2.3.4 is famous for exactly this reason — it has a well-known backdoor vulnerability, deliberately included for CTF practice.

Let's look at an example together

bash
# SYN scan with version detection and OS detection
nmap -sS -sV -O 192.168.56.101

# Scan all 65535 ports (not just the common 1000)
nmap -p- 192.168.56.101

# Save output to a file for later reference
nmap -sV -oN scan-results.txt 192.168.56.101
You should see
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 2.3.4
OS details: Linux 2.6.9 - 2.6.33

Try it in 5 minutes

Scan your lab VM with `nmap -sV -O` and look up the resulting service version (for example, vsftpd) on Google or in a CVE database — check whether any known vulnerabilities exist (research only, don't attempt to exploit anything).

A quick word of caution

If you run a SYN scan (`-sS`) without root/administrator permission, Nmap automatically falls back to a connect scan (`-sT`) — keep in mind that the results can differ.

Easy traps

  • Running `-p-` (an all-port scan) against a production system without authorization — it takes a long time and generates a lot of network traffic
  • Blindly trusting version detection results as 100% correct — admins can intentionally spoof or hide banners (obscuring the real version)

Now try it yourself

Scan your lab VM with `nmap -sV -O` and look up the resulting service version (for example, vsftpd) on Google or in a CVE database — check whether any known vulnerabilities exist (research only, don't attempt to exploit anything).

You'll know it worked when: PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.3.4 OS details: Linux 2.6.9 - 2.6.33

Nmap Deep Dive (Scan Types, Version Detection) | Thuta Learning