ToolsNmap
networkSlow

Nmap

Network Mapper · Port Scanner

"The industry standard for port scanning, service detection, and network mapping."

▶ Scan with Nmap
What it does

Nmap is the most widely used network scanner in security. It sends crafted packets to discover which ports are open on a target, what services are running on those ports, and which versions of those services are installed. From a single IP address to a /16 network range, nmap gives you a complete picture of what's exposed.

PTK exposes 10 different nmap scan types — from a fast top-100-ports sweep to a deep full-port scan with script execution and OS detection. Each scan type produces structured findings with port numbers, service names, version strings, and CVE matches when a vulnerable version is detected.

Use nmap as the first tool on any new target. Its findings tell you what attack surface exists before running deeper tools like nuclei or nikto.

Scan options
OptionDescriptionEst. time
fast
Top 100 most common ports, fast timing
~2 min/host
shortDEFAULT
Top 1000 ports + service/version detection
~5 min/host
deep
All 65535 ports, scripts, OS detection
~16 min/host
stealth
SYN scan — less likely to be loggedRequires root
~3 min/host
decoy
Scan with randomized decoy IPsRequires root
~3 min/host
udp
UDP port scan (often skipped, very valuable)Requires root
~10 min/host
version-intense
Full version detection intensity
~8 min/host
script-vuln
Run NSE vulnerability scripts on open ports
~10 min/host
discovery
Host discovery only — no port scan
~1 min/host
slow
Paranoid timing — IDS/IPS evasion
~20 min/host
Example findings
CRITICALPort 22 — SSH Exposed to 0.0.0.0/0nmap
HIGHPort 3306 — MySQL Exposed Without Authenticationnmap
HIGHOpenSSH 7.9 — CVE-2023-38408 Remote Code Executionnmap
MEDIUMPort 8080 — HTTP Admin Interface Accessiblenmap
What it finds
  • Open ports exposing services to the internet
  • Service names and version strings (nginx 1.18.0, OpenSSH 7.9, etc.)
  • Outdated service versions with known CVEs
  • Operating system fingerprints
  • Firewall rules and filtered port behavior
  • UDP services (DNS, SNMP, RDP, TFTP)