Quick answer: Nmap (Network Mapper) is an open source scanning tool used to discover live systems, open ports, running services and their versions on a network. It is the core tool of the reconnaissance phase of a penetration test. Within an authorized test it is used to map which services are exposed and the attack surface. On the defensive side, scanning your own network with Nmap lets you spot exposed services early.

What is Nmap used for?

A penetration test or security assessment cannot proceed without knowing what the target runs. Nmap answers exactly this question: which devices are up, which ports are open, and which service and version runs on those ports. This information maps the attack surface and guides the next steps.

An important point: Nmap is a tool for defenders, not just attackers. Regularly scanning your own network with Nmap lets you see an accidentally exposed management panel or a forgotten service before an attacker does.

Basic scan types

Scan Purpose
Host discovery Finding which devices are live on the network
Port scan Identifying open, closed and filtered ports
Service and version detection Which software and version runs on a port
OS detection Estimating the target's operating system
Script scan (NSE) Checking for known flaws and configurations

Nmap's scripting engine (NSE, Nmap Scripting Engine) turns the tool from a simple port scanner into a discovery platform that can also check for known vulnerabilities and misconfigurations.

Where does Nmap sit in a penetration test?

Nmap is used in the reconnaissance and mapping phase of a penetration test. It is the first active step after passive information gathering. However, Nmap is not a vulnerability validation tool. It finds open ports and services, but whether that service is actually exploitable requires separate validation. Detection and validation must not be confused.

Defensive side: what to do against Nmap scanning?

  • Expose only the necessary ports, close the rest with a firewall.
  • Keep service versions updated and do not leak unnecessary banner information.
  • Use network segmentation so a scan in one zone does not spread to another.
  • Monitor unusual scan traffic with intrusion detection systems.
  • Scan your own network regularly, and see the exposed surface before an attacker does.

The KAOS and DSET approach

DSET maps the target's attack surface in the reconnaissance phase of penetration tests and reports exposed services. Our KAOS security engine does not just list the open services found in reconnaissance, it tries to validate which of them are actually exploitable, because for us detection and validation are different things. Our goal is not a long list of ports but showing with evidence the surface that is genuinely risky.

Related reading: penetration test types and scope, OSINT and passive information gathering, PTES methodology 7 phases, web penetration testing with Burp Suite, Metasploit Framework guide, vulnerability scanning versus penetration testing.

Frequently asked questions

Is Nmap legal? Nmap itself is a legitimate security and network management tool and its use is legal. However, scanning a system that is not yours or that you are not authorized for can fall under unauthorized access and create legal liability. Nmap should only be used on your own systems or on targets for which you have written authorization.

Can an Nmap scan crash a system? A standard Nmap scan is usually harmless, but aggressive timing or some NSE scripts can cause problems on sensitive systems (especially old devices and industrial control systems). That is why on production and critical systems the scan scope and timing must be set carefully.

If Nmap finds an open port, does it mean the system is vulnerable? No. An open port only shows that a service is listening, not that the service is exploitable. For real risk, the version, configuration and known flaws of the found service must also be validated. Detection and validation are different steps.

Sources

To map your network's attack surface and audit exposed services, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.