The Exploit HQ

Nmap for Beginners · lesson 1 · 2026-08-12 · updated 2026-10-12

Nmap for Absolute Beginners: Your First Scan

Before you start

Welcome to The Exploit HQ. This is a tutorial for absolute beginners, and you need zero experience to follow along.

By the end, you will understand what Nmap is, and you will run your very first network scan yourself.

Nmap is a free tool used by security professionals all over the world.

In simple terms, it looks at a computer and tells you which of its doors are open.

Those doors are called ports, and knowing which ones are open is the first step in checking how secure a computer is.

Don’t worry about any of the words yet. We will explain everything as we go.

Let’s begin. The first thing you do is open the terminal window.

The terminal is simply a place where you type commands, instead of clicking buttons.

You will see a line that ends in a dollar sign. That is called the prompt. It just means the computer is ready and waiting for you to type.

Everything we do today, we type right here.

First, let’s make sure Nmap is installed on the computer.

Type the word nmap, then a space, then two dashes, and the word version. Then press Enter.

This command simply asks the tool to tell us about itself.

nmap --version

There we go. This tells us that Nmap is installed, and which version we have.

If you see a version number like this, you are ready to continue.

Notice what just happened. We typed a command, pressed Enter, and the computer answered on the lines below. That back and forth is the heart of how the terminal works.

Before we scan anything, let’s cover a few simple ideas. First, what is a network?

A network is just a group of computers that are connected and can talk to each other. The internet is simply the biggest network of all.

Every computer on a network has its own address, called an I P address. It works a bit like a home’s street address. It is how one computer finds another.

Now, two more words that we will use a lot: host, and port.

A host is just any computer on a network. It could be a website’s server, a laptop, or even a phone.

A port is like a numbered door on that computer.

There are tens of thousands of possible ports, but usually only a handful are open at any time.

Each service uses its own door. Web pages usually arrive through door number 80. Secure web pages use door 443. And remote logins use door 22.

When a door is open, it means a service is listening there, ready to talk.

Nmap’s whole job is to knock on these doors, and tell us which ones are open.

Now, one very important rule. Only scan computers that you own, or that you have clear permission to scan.

Scanning someone else’s computer without permission can be illegal.

Luckily, the makers of Nmap give us a practice computer that we are allowed to scan.

Its address is scanme dot nmap dot org, and we will use it for the rest of this lesson.

Alright. Let’s run your very first scan.

Type nmap, then a space, then scanme dot nmap dot org, and press Enter.

Here, nmap is the tool, and scanme dot nmap dot org is the target we are allowed to test. Give it a few seconds.

nmap scanme.nmap.org

Here are our results. Let’s read them together, slowly.

Host is up means the computer answered us. It is online.

Below that is a table. The first column is the port, or door number, and its job. The second column tells us whether that door is open or closed.

We can see door 22, called ssh, is open. That door is used for remote logins.

Door 80, called http, is also open. That one is used for web pages.

A closed door simply means nothing is listening there right now.

You may have noticed the scan took a few seconds. That is because, by default, Nmap quietly checked the one thousand most common doors for us.

And at the very bottom, Nmap tells us how long the whole scan took.

Congratulations. You just ran your very first network scan.

Sometimes, you only care about a few specific doors, instead of all of them.

You can tell Nmap exactly which ports to check, using dash p.

Type nmap, a space, dash p, a space, 22 comma 80, a space, and then scanme dot nmap dot org.

The dash p means ports, and 22 comma 80 is the short list of doors we want to check.

nmap -p 22,80 scanme.nmap.org

This time, Nmap only checked those two doors, and it finished much faster.

Let’s recap what you just learned.

You opened the terminal, you confirmed Nmap was installed, and you ran two real scans.

You learned that ports are like doors, and that open ports are where services are listening.

And most importantly, you learned to only scan targets that you are allowed to.

Take your time with all of this. There is no rush, and you can replay any part of this video as many times as you need.

In the next tutorial, we will discover what software is running behind those open doors.

Thanks for learning with The Exploit HQ. Practice on scanme dot nmap dot org, and I will see you in the next one.