In the following steps, we will use the built-in Nmap module. Hakateemi also offers an [Nmap course](/courses/nmap) if you want to dive deeper into the tool, but here is a quick guide to help you get started.

### Basic mapping

Nmap can be executed simply without parameters by using only the computer name or IP address. This gives a basic survey of the target.

```sh
nmap 10.10.10.10
```

### Basic mapping of IP range

Instead of scanning a single IP address, it is often desired to scan a broader IP range at once and find active targets from there. This could be done, for example, like this.

```sh
nmap 10.10.10.0/24
```

### Port Scan

Nmap can be configured to scan specific ports. This is usually done by adding the **-p** parameter and a list of port numbers.

```sh
nmap -p 80.443 10.10.10.10
```

### Common ports

**-p** Instead of the **-p** parameter, you can use the **--top-ports** parameter, which scans the most common ports.

```sh
nmap --top-ports 10.10.10.10
```

### Version scanning

When you know the IP address and an open port, you can try to identify the listening service behind the port with the **-sV** parameter.

```sh
nmap -p 80 -sV 10.10.10.10
```

### Operating System Scan

Nmap can attempt to determine the operating system of the server behind the network service using the **-O** parameter.

```sh
nmap -p 80 -O 10.10.10.10
```

### Host identification

The commonly used method to find hosts with Nmap is ping scanning, which sends ICMP requests to the target. This helps determine if the target is available on the network and if it responds to ping requests. If the target responds to ping requests, it is considered an active host.

Ping scanning is not always possible, as some networks or hosts may block ICMP requests. In such situations, Nmap offers the -Pn parameter, which completely disables ping scanning.

If nmap complains that the IP address is not up even though you know or suspect it is, give the port scan the **-Pn** parameter and try again.

```sh
nmap -Pn 10.10.10.10
```

### Combination

You can also ask Nmap to combine different parameters. For example, you can perform a scan that scans a specific range of ports, server versions, and operating systems.

```sh
nmap -p 1-100 -sV -O 10.10.10.10
```

### Versions, operating systems, and scripts

In Nmap, you can enable operating system and service detection, as well as some scripts, all with one parameter: -A

```sh
nmap -A 10.10.10.10
```


Nmap crash course

Metasploit is a popular attack framework that helps professionals identify and exploit security holes. In this course, you will go through the use of Metasploit and learn how it can be used to carry out attacks and find security holes.

Metasploit, the Swiss Army Knife of Penetration Testing

Welcome to the wonderful world of Metasploit! Metasploit is a penetration testing framework used by cybersecurity professionals throughout the world.

In this context, a framework refers to a codebase. More specifically, it refers to a stack of reusable Ruby code that makes it convenient to create more Ruby code that does cyber stuff. Particularly, the framework is designed for penetration testing.

You don't need to know how to code in Ruby to use Metasploit. In the course, we will also explore customization and building our own modules, but Metasploit already has thousands of these modules ready for you to get started. Besides, Metasploit now also supports Python extensions.

Module is a Ruby file in the Metasploit directory that serves a specific purpose.

There are different types of modules for different purposes. For example, the 

 modules (located in the exploits directory) are attacks that exploit a vulnerability and typically open a command channel to the compromised device, such as a server.

Modules are not used directly from files, but with tools of the Metasploit framework such as 

The flagship command-line tool of Metasploit is 

. With the tool, it is easy to search for and use Metasploit modules.

In the course, you progress step by step and practice using various techniques using Metasploit in the Hakatemian lab environment. After that, you will move on to exercises where you will no longer receive assistance, you only know the target's IP address, and you have access to Nmap and Metasploit, as well as the goal of breaking into the server by applying the skills you have learned in the course.

Nmap crash course

Learn to hack — start here