Scanning for Open Ports and Vulnerabilities with Nmap

Nmap (Network Mapper) is an open-source network discovery tool that identifies hosts, services, and potential security issues. It's an essential tool for system administrators and developers to map a server's network, letting you see which ports are open, what services are running, and what operating system a target system is using. This guide covers key security tasks with Nmap, including scanning a host for open ports, identifying services running on those ports, and detecting vulnerabilities using the Nmap Scripting Engine (NSE), plus how to interpret the output and take basic remediation steps. By the end, you'll have run multiple Nmap scans, detected a real misconfiguration, and fixed it.

Prerequisites

Before you begin, you need access to a Linux-based server as a non-root user with sudo privileges.

Install Nmap

1. Install nmap according to your operating system.

On Debian/Ubuntu-based systems:

$ sudo apt update && sudo apt install -y nmap

On Rocky Linux and other RHEL-based systems:

$ sudo dnf install -y nmap

2. Verify the installation:

$ nmap --version

You should see output similar to the following:

Nmap version 7.94SVN ( https://nmap.org )
Platform: x86_64-pc-linux-gnu
Compiled with: liblua-5.4.6 openssl-3.0.13 libssh2-1.11.0 libz-1.3 libpcre2-10.42 libpcap-1.10.4 nmap-libdnet-1.12 ipv6
Compiled without:
Available nsock engines: epoll poll select

The nmap Command

The nmap command uses the following syntax:

nmap [SCAN TYPES...] [OPTIONS] TARGET

• [SCAN TYPES...]: Defines how Nmap scans. This group controls if and how Nmap probes the target for open ports.
• [OPTIONS]: One or more optional flags and parameters that modify Nmap's behavior. They control the output's scope, speed, and verbosity.
• TARGET: The hosts or networks to be scanned. You can provide a single IP, an IP range, a hostname, or a subnet.

Scan Types

Command Options

Perform a Basic Port Scan

A basic scan checks the 1,000 most common ports. This guide uses localhost as the target — replace it with an IP address or hostname you have explicit permission to scan.

1. Run a basic scan:

$ sudo nmap localhost

Sample output:

Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-10-03 21:49 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000011s latency).
Other addresses for localhost (not scanned): ::1
Not shown: 997 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
3001/tcp open  nessus
5432/tcp open  postgresql

Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds

Understanding the output:

• Not shown: 997 closed tcp ports: These ports are closed or filtered.
• PORT: Port number and protocol.
• STATE: Whether the port is open, closed, or filtered.
• SERVICE: The service Nmap detected running on the port (when identifiable).

In this example, open ports include 22 (SSH), 3001 (reported as nessus), and 5432 (PostgreSQL).

Scan for Service Versions and Operating Systems

Nmap can reveal detailed service information on open ports, including version numbers, which helps detect outdated or vulnerable services.

1. Use the -sV flag to probe open ports for running services:

$ sudo nmap -sV localhost

Sample output:

Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-10-03 21:56 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000011s latency).
Other addresses for localhost (not scanned): ::1
Not shown: 997 closed tcp ports (reset)
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 9.6p1 Ubuntu 3ubuntu13.13 (Ubuntu Linux; protocol 2.0)
3001/tcp open  nessus?
5432/tcp open  postgresql PostgreSQL DB 9.6.0 or later

This scan shows specific versions for detected services, such as OpenSSH 9.6p1 and PostgreSQL 9.6.0 or later. The question mark after Nessus indicates that Nmap is unsure, and the service identification may require further verification.

Scan for Vulnerabilities Using the Nmap Scripting Engine (NSE)

The Nmap Scripting Engine (NSE) allows Nmap to use scripts to automate various networking tasks, including vulnerability scanning. The vuln script category tests services for known vulnerabilities. This section installs vsftpd, an FTP server, intentionally creates a vulnerability, and then detects and mitigates it using Nmap's scripting engine.

1. Install vsftpd.

On Ubuntu/Debian-based systems:

$ sudo apt install -y vsftpd

On Rocky Linux/RHEL-based systems:

$ sudo dnf install -y vsftpd

2. Enable anonymous login for vsftpd to create a vulnerability. Edit the vsftpd configuration file:

$ sudo nano /etc/vsftpd.conf

Find the line anonymous_enable=NO and change the value from NO to YES. Save and close the file.

3. Restart vsftpd:

$ sudo systemctl restart vsftpd

Now that you've intentionally created this issue, you can use a specific Nmap script to detect it. The ftp-anon script is part of the NSE and automatically tests whether an FTP server allows anonymous login.

4. Run a vulnerability scan using ftp-anon on port 21, the port used by vsftpd:

$ sudo nmap -p 21 --script ftp-anon localhost

Sample output:

Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-08-22 11:04 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00010s latency).
Other addresses for localhost (not scanned): ::1

PORT   STATE SERVICE
21/tcp open  ftp
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)

Nmap done: 1 IP address (1 host up) scanned in 0.14 seconds

The scan detected an issue: Anonymous FTP login allowed (FTP code 230).

Steps to Mitigate

1. Edit the configuration file:

$ sudo nano /etc/vsftpd.conf

Find the line anonymous_enable=YES and change the value from YES to NO. Save and exit the file.

2. Restart the service to apply the changes:

$ sudo systemctl restart vsftpd

3. Run the Nmap scan on port 21 again:

$ sudo nmap -p 21 --script ftp-anon localhost

Output:

Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-08-22 11:19 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00010s latency).
Other addresses for localhost (not scanned): ::1

PORT   STATE SERVICE
21/tcp open  ftp

Nmap done: 1 IP address (1 host up) scanned in 2.53 seconds

Next Steps

• Automate recurring Nmap scans with cron to catch newly opened ports or services.
• Explore the full vuln NSE script category to check for known CVEs beyond anonymous FTP.
• Pair Nmap output with a firewall tool like UFW or firewalld to close unneeded ports.
• Review the Nmap official documentation for more scan types and NSE scripts.

For the full guide with additional tips, visit the original article on Vultr Docs.