$ man nmap

Nmap

Which ports and services does your server expose, and which versions?

map the surfacesends requests to the targetvia awesome-security

⚠ Recon your own assets, or targets you have written permission to test. Passive OSINT reads public data, but using it to target someone else's systems can still be illegal or against their terms. Examples on this site use example.com placeholders.

## why a developer should care

Every open port is a door. Nmap lists them and asks each service what it is - exactly what an attacker does after recon.

## install

$ brew install nmap # or: apt install nmap

Other platforms and pre-built binaries: official install guide ↗

Check it worked: open a new terminal and run nmap --version. "command not found" means it isn't installed or isn't on your PATH yet.

## shortcuts

host:

# Top ports + service versions

$ nmap -sV -T4 {{target}}

# What does the web server say about itself?

$ nmap -p 80,443 --script http-headers,http-server-header {{target}}

→ official docs · ← all tools