Network Reconnaissance with Nmap

Introduction

30 Second Summary

Every computer connected to a network has thousands of virtual "doors" called ports. Knowing which doors are open on a system is the very first thing a security professional checks when assessing whether that system is vulnerable to attack.

In this project, you will use Nmap to scan a live target machine on an isolated lab network, discover its open ports, identify the services running on those ports, and determine their software versions.

What You'll Build

A complete network reconnaissance workflow that connects to a TryHackMe lab via VPN, scans a live target with Nmap, and documents the discovered ports, services, and versions.

By the end of this project, you'll have:

• A configured Debian machine with Nmap and OpenVPN connected to TryHackMe's isolated lab network.
• Completed port scans showing open ports, running services, and software versions on a live target.
• A TryHackMe public profile with documented progress that employers can see.
• Secret Mission: Use Nmap's Scripting Engine (NSE) to scan for known vulnerabilities on the target machine.

Are there any prerequisites?

No programming required. You just need a Debian Linux machine with at least 8GB of RAM. This guide walks you through installing all required tools from scratch.

Install Tools and Connect to TryHackMe

Every security assessment begins with preparation. Before you can scan a target, you need the right tools installed and a secure tunnel into the lab environment where your target lives.

In this step, you will install two essential security tools on your Debian machine and connect to TryHackMe's isolated network. This gives you a safe, legal environment to practice network reconnaissance without touching real-world systems.

In this step, get ready to:

• Install OpenVPN and Nmap from Debian's package repositories.
• Create a free TryHackMe account and download your personal VPN configuration.
• Connect to TryHackMe's isolated lab network via OpenVPN.

Install OpenVPN and Nmap

Your Debian machine needs two tools. Nmap is the industry-standard port scanner used by security professionals worldwide. OpenVPN creates encrypted tunnels that let you securely connect to remote networks.

• Open a terminal on your Debian machine. Press the Super key (the key between Ctrl and Alt), type Terminal, and press Enter to open it.
• Update your package list and install both tools by running these commands:

sudo apt update
sudo apt install openvpn nmap -y

What do these commands do?

• sudo apt update refreshes the list of available packages from Debian's repositories so you get the latest versions.
• sudo apt install openvpn nmap -y downloads and installs both OpenVPN (for VPN tunneling) and Nmap (for port scanning). The -y flag automatically confirms the installation.

• Verify Nmap installed successfully by running:

nmap --version

• You should see version information printed to your terminal, starting with Nmap version 7.9 or similar.
• Verify OpenVPN installed successfully by running:

openvpn --version

• You should see version information starting with OpenVPN 2.6 or similar.

Command not found or permission denied?

• If you see a permission error, make sure you included sudo at the start of the install command. Your user account needs administrator privileges to install packages.
• If apt reports that packages cannot be found, check your internet connection and try running sudo apt update again.

ask for help with installing packages on Debian

Create a free TryHackMe account and download your VPN config

TryHackMe is a platform with hundreds of free cybersecurity labs. It hosts deliberately vulnerable machines on an isolated network that you connect to via VPN. This keeps your practice legal and separated from the real internet.

• Open your web browser and navigate to tryhackme.com/signup.
• Click Continue with Google, Continue with LinkedIn, or enter your email address to create a free account.
• Complete the registration prompts. No payment is required for the free tier.
• Once logged in, navigate to the Connect page by going to tryhackme.com/connect?o=vpn in your browser's address bar.
• Download your personal OpenVPN configuration file (a .ovpn file). This file is unique to your account.
• Save the file to your ~/Downloads directory. Note the exact filename. It will look something like yourusername.ovpn.

What is the .ovpn file?

This file contains all the settings OpenVPN needs to establish a secure, encrypted connection to TryHackMe's network. It includes server addresses, encryption keys, and authentication details specific to your account.

Treat it like a password. Do not share it with anyone.

• Confirm the file downloaded by running:

ls ~/Downloads/*.ovpn

• You should see your .ovpn filename printed in the output.

Connect to TryHackMe via OpenVPN and verify

Now you will use that .ovpn file to open a VPN tunnel into TryHackMe's lab network. This tunnel stays open in one terminal while you use a second terminal for scanning.

• In your current terminal, start the VPN connection by running:

cd ~/Downloads
sudo openvpn [[OVPN_FILE="your-downloaded-file.ovpn"]]

What does this command do?

The cd ~/Downloads moves you into the directory where your config file lives. The sudo openvpn command reads your personal configuration and establishes an encrypted tunnel to TryHackMe's servers.

It requires sudo because creating a network tunnel needs root-level access to your system's networking.

• Watch the terminal output. You will see connection logs scrolling. Wait until you see the message:

Initialization Sequence Completed

• This confirms your VPN tunnel is active. Do NOT close this terminal. It must stay open to maintain the connection.
• Open a second terminal window. Press the Super key, type Terminal, and press Enter.
• In your new terminal, verify the VPN created a tunnel interface by running:

ip addr show tun0

You should see output showing the tun0 interface with an inet 10.x.x.x address. This is your IP on TryHackMe's lab network.

✔️ I see an inet 10.x.x.x address

Your VPN tunnel is active and working. You are connected to TryHackMe's isolated lab network and ready to scan targets. All future commands in this project go in this second terminal.

ⓧ I see an error or no tun0 interface

• Switch back to your first terminal and check for error messages. Common issues:
• If you see a "cannot resolve host" error, check your internet connection.
• If you see "AUTH: Received control message: AUTH_FAILED", re-download your .ovpn file from tryhackme.com/connect?o=vpn. Config files can expire.
• If the command hangs without reaching "Initialization Sequence Completed", wait up to 60 seconds. TryHackMe's servers can be slow during peak hours.
• Make sure you used the correct filename for your .ovpn file. Run ls ~/Downloads/*.ovpn to double-check.

ask for help connecting to TryHackMe VPN

Why use your own machine instead of TryHackMe's browser AttackBox?

TryHackMe offers a browser-based AttackBox, but the free tier limits it to 1 hour per day. Connecting from your own machine via OpenVPN gives you unlimited practice time.

It also teaches a real-world skill. Security professionals routinely VPN into client networks from their own machines during engagements.

Your security lab is ready. You have Nmap installed, a TryHackMe account created, and a live VPN tunnel into the lab network. Next up, you will deploy a target machine and run your first real network scan.

Deploy Your Target and Run Your First Scan

Your security environment is ready and connected to TryHackMe's isolated lab network. Now it's time to put it to work.

Every security assessment begins with reconnaissance. Before you can find weaknesses in a target, you need to discover what services it's running. In this step, you'll deploy a deliberately vulnerable machine and run your first Nmap scan against it.

In this step, get ready to:

• Join the TryHackMe Nmap room and deploy a target machine.
• Run your first Nmap port scan against the live target.
• Interpret scan results to identify open ports and services.

Join the Nmap room and deploy the target machine

TryHackMe organizes its labs into "rooms." Each room contains a virtual machine you can deploy and attack safely. You'll join the Further Nmap room, which is free and includes a deployable target.

• In your browser, navigate to tryhackme.com/room/furthernmap.
• Click Join Room.
• Scroll down to Task 1 and click Start Machine.
• Wait about one minute for the machine to boot. A target IP address in the format 10.10.x.x appears at the top of the task.
• Copy that IP address somewhere you can reference it easily.

What is the target machine?

The target is a deliberately vulnerable virtual machine running on TryHackMe's isolated network. It only exists while your session is active and is completely separate from the real internet.

Because you connected via OpenVPN in Step 1, your Debian machine can reach this target directly through the VPN tunnel.

Run a basic Nmap scan against the target

A port scan sends packets to a range of ports on the target and records which ones respond. This tells you what services are listening and potentially exploitable.

• Switch to your second terminal (not the one running OpenVPN) and run your first scan:

nmap [[TARGET_IP="your target IP (e.g. 10.10.23.45)"]]

What does this command do?

Running nmap with just an IP address performs a default TCP connect scan of the 1,000 most common ports. It checks each port by attempting a full TCP connection.

For each port, Nmap reports a state (open, closed, or filtered) and the service name it thinks is running there.

• Wait for the scan to finish. It typically takes 10-30 seconds.
• Look at the output in your terminal. You should see a table with columns for PORT, STATE, and SERVICE.

Not seeing any results?

• Check that your OpenVPN connection is still active in the first terminal. Look for a blinking cursor or recent log output. If it disconnected, restart it.
• Make sure you copied the target IP correctly from the TryHackMe page. A single wrong digit means Nmap scans the wrong address.
• Verify your VPN interface is up by running ip addr show tun0 in your second terminal. If no tun0 interface appears, your VPN dropped.

Help me troubleshoot why my Nmap scan is not returning any results against the TryHackMe target

Understand your scan output

Your scan results show every discovered port alongside its state and service name. Each state tells you something different about the target.

• Open means a service is actively listening and accepting connections on that port. This is what attackers look for.
• Closed means the port is accessible (not firewalled) but no service is currently listening there.
• Filtered means a firewall is blocking Nmap's packets, so it cannot determine whether a service is running.

Why do open ports matter?

Every open port is a potential entry point. If a web server runs on port 80, an attacker can probe it for web vulnerabilities. If SSH runs on port 22, an attacker can attempt credential attacks.

Reconnaissance is about mapping these entry points so you know where to focus your testing. The more open ports you find, the larger the attack surface.

• Note which ports are open and what service names are listed next to them. This is your first reconnaissance result.

You just completed your first real reconnaissance scan. You know what services the target is running and which ports they listen on. Next, you'll explore different scan types to learn how professionals control the speed, stealth, and depth of their scans.

Explore Scan Types

Your default scan from Step 2 already found open ports on the target. But that scan used only one method to knock on each port's door.

In this step, you will run three different scan types and learn when to use each one. Professional penetration testers choose their scan type based on the situation: do they need speed, stealth, or coverage of non-TCP services?

In this step, get ready to:

• Run a TCP Connect scan that completes a full handshake with each port.
• Run a SYN (stealth) scan that avoids detection by never completing the connection.
• Run a UDP scan to find services invisible to TCP-only scans.

Run a TCP Connect scan

A TCP Connect scan completes the full TCP three-way handshake (SYN, SYN-ACK, ACK) for every port it checks. This makes it reliable but also slower and easily logged by the target system.

• Run a TCP Connect scan against your target by running this command:

nmap -sT [[TARGET_IP="your target IP (10.10.x.x)"]]

What does this command do?

The -sT flag tells Nmap to use a TCP Connect scan. For each port, Nmap completes the entire three-way handshake just like a normal application would.

Because it uses the operating system's built-in connection functions, this scan does not require root privileges. The tradeoff is that the target's logs will record every completed connection.

You should see output listing ports and their states, similar to your default scan from Step 2. The results may look identical because the default scan also uses TCP.

Scan hanging or timing out?

Make sure you are running this in your second terminal, not the one running OpenVPN. Also confirm your VPN is still connected by checking that the first terminal still shows no errors.

If the target machine has expired (TryHackMe machines shut down after a period), return to the room page and click Start Machine again. The IP address may change.

Help me troubleshoot my Nmap TCP Connect scan timing out.

Run a SYN scan (stealth scan)

A SYN scan is called a "stealth" scan because it never completes the handshake. It sends a SYN packet, and if it receives SYN-ACK back (meaning the port is open), Nmap immediately sends RST to tear down the connection.

This is faster and less likely to appear in application-level logs. It requires root privileges because Nmap crafts raw network packets instead of using normal OS functions.

• Run a SYN scan against your target by running this command:

sudo nmap -sS [[TARGET_IP="your target IP (10.10.x.x)"]]

What does this command do?

The -sS flag tells Nmap to use a SYN scan. The sudo prefix is required because crafting raw packets (instead of going through the OS networking stack) requires root access.

Compare the results and speed to your TCP Connect scan. You should see the same open ports discovered, but notice the scan completes faster.

Why is SYN scan considered stealthy?

Because the three-way handshake never completes, many application-level logging mechanisms do not record the connection attempt. The target's firewall or IDS may still detect it, but services running on the ports typically will not log it the way they would a full TCP Connect.

Permission denied error?

SYN scans require root privileges. Make sure you included sudo at the start of the command. You will be prompted for your password if you have not used sudo recently.

Help me fix a permission error when running a SYN scan with Nmap.

Run a UDP scan

UDP is a completely different transport protocol from TCP. It has no handshake at all. Services like DNS, DHCP, and SNMP run exclusively on UDP.

If you only scan TCP ports, you miss these services entirely. That means missing potential attack surface.

• Run a UDP scan against the top 20 ports by running this command:

sudo nmap -sU --top-ports 20 [[TARGET_IP="your target IP (10.10.x.x)"]]

What does this command do?

The -sU flag tells Nmap to scan UDP ports instead of TCP. The --top-ports 20 flag limits the scan to the 20 most commonly used UDP ports.

Without the port limit, a full UDP scan would take a very long time. UDP scanning is inherently slow because Nmap must wait for responses (or lack of responses) without the confirmation mechanism TCP provides.

This scan takes noticeably longer than the TCP scans. You may see ports listed as open|filtered, which means Nmap could not determine whether the port is open or blocked by a firewall.

Why is UDP scanning slower?

TCP gives clear signals: a SYN-ACK means open, a RST means closed. UDP gives no guaranteed response. Nmap sends a packet and waits. If nothing comes back, the port might be open (the service silently accepted it) or filtered (a firewall dropped it).

The only definitive closed signal is an ICMP "port unreachable" message. This ambiguity is why UDP scans take much longer.

UDP scan seems stuck?

UDP scans are naturally much slower than TCP scans. A 20-port UDP scan may take a minute or more. Let it run. If it takes more than 5 minutes, press Ctrl+C to cancel and try again. Your VPN may have disconnected.

Help me understand why my UDP scan is so slow.

You have now used three fundamentally different scanning techniques. You know which ports are open, but not what software is actually running behind them. Next up, you will probe those open ports to discover exact service names and version numbers.

Detect Services and Save Your Results

You now know which ports are open and how different scan types work. The next question is: what software is actually running behind those ports?

Knowing that port 80 is open tells you a web server exists. Knowing it runs Apache 2.4.49 specifically tells you whether it has known vulnerabilities. In this step, you will use Nmap's version detection and OS fingerprinting to build a complete profile of the target.

In this step, get ready to:

• Run a version detection scan to identify exact software and version numbers on open ports.
• Combine version and OS detection to determine the target's operating system.
• Save your scan results to a file for professional documentation.

Run a version detection scan

Your earlier scans showed port numbers and service names like "http" or "ssh". Version detection goes deeper by actively probing each open port to identify the exact application and its version number.

• Run a version detection scan against your target by running this command in your second terminal:

nmap -sV [[TARGET_IP="your target IP (10.10.x.x)"]]

What does -sV do?

The -sV flag tells Nmap to probe each open port with a series of requests designed to trigger responses that reveal the running software.

Instead of just showing "http" on port 80, you now see the exact web server software and its version number. This information is critical because specific versions have known vulnerabilities that attackers can exploit.

Your output now shows a VERSION column with entries like software names and version numbers next to each open port.

Scan taking a long time?

Version detection probes each port individually, so it takes longer than a basic scan. Wait for it to complete. If it seems stuck, confirm your VPN is still connected in terminal 1.

help me debug my slow Nmap version detection scan

Add OS detection to your scan

Version detection tells you what software is running. OS detection tells you what operating system the target is built on. This matters because exploits and attack techniques differ between Linux, Windows, and other systems.

• Run a combined version and OS detection scan by running this command:

sudo nmap -sV -O [[TARGET_IP="your target IP (10.10.x.x)"]]

Why does this need sudo?

The -O flag attempts to identify the target's operating system by sending specially crafted packets and analyzing how the target responds. Crafting these raw packets requires root privileges, which is why you need sudo.

Look for the "OS details" line in the output. It shows the detected operating system and a confidence percentage indicating how closely the target's responses match known OS fingerprints.

You should see a "Device type" line, a "Running" line showing the OS family, and an "OS details" line with the specific version guess.

Seeing "No exact OS matches"?

This is normal. Nmap compares the target's responses against a database of known fingerprints. If there is no perfect match, it shows its closest guesses with a confidence percentage. The information is still useful for your reconnaissance.

help me understand my Nmap OS detection results

Save your results to a file

Professional security assessments always save scan output to files. This creates a documented record of findings that you can reference in reports, share with team members, or compare against future scans.

• Run the version detection scan again, this time saving the output to a file:

nmap -sV -oN scan_results.txt [[TARGET_IP="your target IP (10.10.x.x)"]]

What does -oN do?

The -oN flag saves the scan output to a file in "normal" format. This is the same human-readable format you see in your terminal. Nmap also supports XML (-oX) and grepable (-oG) formats for automated processing.

Your file scan_results.txt now contains a permanent record of your reconnaissance. This is how professionals work. Every scan gets saved.

• Verify the file was created and view its contents by running:

cat scan_results.txt

You should see the full scan output including open ports, service names, and version numbers printed from the saved file.

File is empty or missing?

Make sure you typed the filename correctly in both the scan command and the cat command. Check for typos in scan_results.txt. Also confirm the scan completed successfully before it wrote the file.

help me find my saved Nmap scan results file

Secret mission

Probe for Vulnerabilities with NSE Scripts

You have mapped the target's open ports and identified its services. Now go further. Use Nmap's Scripting Engine (NSE) to probe those services for known vulnerabilities, turning your reconnaissance into actionable security intelligence.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally on your Debian machine and uses TryHackMe's free tier, so there are no ongoing costs.

Resources you used:

• OpenVPN connection (running in terminal 1).
• TryHackMe target machine (deployed in the Further Nmap room).
• Scan result files (scan_results.txt and vuln_results.txt).
• OpenVPN config file (.ovpn file in ~/Downloads).
• Installed packages (Nmap and OpenVPN via apt).

Keep everything running

No action needed. Choose this if you plan to continue practicing with TryHackMe rooms or want to revisit your scan results later.

• Your OpenVPN connection stays active in the first terminal.
• Your TryHackMe target machine will auto-terminate after a period of inactivity, so you can redeploy it anytime from the room page.
• Nmap and OpenVPN remain installed and ready for future labs.
• Your TryHackMe account and public profile remain active with your progress saved.

Pause - I'll come back to this later

Shut down running processes to free up system resources. Your files, installed packages, and TryHackMe account remain intact.

• Switch to the terminal running OpenVPN and press Ctrl+C to disconnect from the VPN.
• In the TryHackMe room page, click Terminate on the target machine to stop it.
• Your scan result files, .ovpn config, and installed packages remain on your machine for when you return.

Delete - I don't want to use this again

Remove all project resources and start fresh. This removes the tools and files from your machine.

• Switch to the terminal running OpenVPN and press Ctrl+C to disconnect from the VPN.
• In the TryHackMe room page, click Terminate on the target machine.
• Remove the scan result files by running:

rm scan_results.txt vuln_results.txt

• Remove the OpenVPN config file by running:

rm ~/Downloads/*.ovpn

• Uninstall Nmap and OpenVPN by running:

sudo apt remove nmap openvpn

• When prompted, enter y to confirm the removal.

Nice Work!

Nice Work!

You just performed a real network reconnaissance scan against a live target using the same tool that professional penetration testers and SOC analysts use every day. That is hands-on cybersecurity experience you can prove.

Here's what you accomplished:

• Set up a professional security testing environment on Debian with Nmap and OpenVPN, then connected to an isolated lab network the same way professionals connect to client environments.
• Performed TCP Connect, SYN, and UDP scans against a live target, understanding when each scan type is the right choice for the situation.
• Discovered running services and their exact version numbers on open ports, then saved your reconnaissance results to files like a professional documenting an engagement.
• Secret Mission: Used NSE vulnerability scripts to go beyond port discovery and probe for known security weaknesses on the target.

Ready to quiz yourself?