The 10 Commands · lesson 1 · 2026-08-28 · updated 2026-10-12
The 10 Nmap Commands Most Used in 2026
Before you start
- A Kali Linux machine or VM (Nmap is preinstalled).
- Internet access: the lesson scans
scanme.nmap.org, a host the Nmap project provides for test scans. - A writable working folder: the lesson saves
myscan.*files. - Only test systems you own or are authorized to test.
Welcome to The Exploit HQ. Today, the ten Nmap commands you will actually reach for in twenty twenty-six, each one explained piece by piece, and each one run for real on a safe practice server.
Nmap is the tool that looks at a computer over the network and tells you which doors, which ports, are open, and what is sitting behind them. It is the first tool almost every security person learns, and it is still the one they use most.
Here is how this will work.
Ten commands, ten minutes
- Each command gets a breakdown slide first
- Then we run it live and read the real output
- Jump to any number — nothing depends on the last
- Brand new? Start with our Nmap beginner series
Every command gets its own breakdown slide, so you can see exactly what each part does, and then we run it and read the real answer together. Nothing here depends on anything before it, so jump to whichever number you need. And if you have never opened a terminal at all, start with our Nmap beginner series first, it is linked below.
Every scan today points at scanme dot nmap dot org. That is a practice server the Nmap Project runs on purpose, for exactly this. It is the one address you may always safely scan.
Number one, the plain scan. The one you will type more than any other.
1 — The plain scan
nmap scanme.nmap.org| Part | What it does |
|---|---|
nmap |
the tool itself — the port scanner |
scanme.nmap.org |
the computer we are looking at, our safe practice server |
Just the tool, and an address. No flags at all. nmap, space, scanme dot nmap dot org, and press Enter.
That is the default, and it checks the one thousand most common ports. Look at the state column. Open means something is listening and will talk to you. Closed means nothing is there right now. This one command already tells you most of what you want to know.
Number two, when a thousand ports is more than you need.
2 — The fast scan
nmap -F scanme.nmap.org| Part | What it does |
|---|---|
-F |
fast — check only the top 100 ports instead of 1,000 |
Dash capital F stands for fast. Same scan, but it only checks the hundred most common ports, so it finishes far sooner. nmap, space, dash capital F, space, scanme dot nmap dot org, and press Enter.
Much quicker, and on most machines you still find everything interesting. This is the flag to reach for when you are scanning a lot of computers and do not want to wait.
Number three, when you want to choose the number yourself.
3 — Choose how many ports
nmap --top-ports 10 scanme.nmap.org| Part | What it does |
|---|---|
--top-ports 10 |
check only the 10 most commonly used ports |
Dash dash top dash ports lets you pick the number. Ten gives you a very quick look at only the most popular doors. nmap, space, dash dash top dash ports, space, ten, space, scanme dot nmap dot org, and press Enter.
Ten ports, checked in a moment. You can put any number there. This is the dial between fast and thorough, and it is yours to turn.
Number four, when you already know exactly which ports you care about.
4 — Pick exact ports
nmap -p 22,80,443 scanme.nmap.org| Part | What it does |
|---|---|
-p |
ports — I will name them myself |
22,80,443 |
remote login, web, and secure web |
Dash p means ports, and then you simply list them, separated by commas, no spaces. Twenty-two is remote login, eighty is web, and four four three is secure web. nmap, space, dash p, space, twenty-two comma eighty comma four four three, space, scanme dot nmap dot org, and press Enter.
Only the three we asked for. This is the sharpest, quickest question you can ask, and it is the command you will use when you are checking one specific thing.
Number five, and this is where it gets genuinely useful. Not just is the door open, but what is behind it.
5 — What software is running?
nmap -sV -p 22,80 scanme.nmap.org| Part | What it does |
|---|---|
-sV |
version — ask each open port what software it is |
-p 22,80 |
just these two, to keep it quick |
Dash s capital V asks each open port to introduce itself, and it answers with the software name and often the exact version. We will limit it to two ports so it stays quick. nmap, space, dash s capital V, space, dash p, space, twenty-two comma eighty, space, scanme dot nmap dot org, and press Enter.
Now look at that version column. That is the real prize. Knowing the exact version is how a defender works out whether a machine is missing a patch, because a known weakness always belongs to a specific version.
Number six, the smallest question of all. Is that computer even switched on?
6 — Is it even switched on?
nmap -sn scanme.nmap.org| Part | What it does |
|---|---|
-sn |
no port scan — only check the computer answers at all |
Dash s n means skip the ports entirely and just check whether the machine answers. nmap, space, dash s n, space, scanme dot nmap dot org, and press Enter.
Host is up. That is all we asked, and that is all we got. Point this at a whole address range and it becomes the fastest way to find out what is actually alive on a network before you scan anything properly.
Number seven, for when Nmap wrongly decides a computer is not there.
7 — Scan past a firewall
nmap -Pn -p 80 scanme.nmap.org| Part | What it does |
|---|---|
-Pn |
skip the ‘are you alive’ check — just scan anyway |
Normally Nmap knocks first, and if nothing answers it gives up. But plenty of machines are told to ignore that knock, so they look dead when they are not. Dash capital P, small n, says skip the knock and scan anyway. nmap, space, dash capital P small n, space, dash p, space, eighty, space, scanme dot nmap dot org, and press Enter.
If a scan ever comes back saying a host seems down, and you are certain it is not, this is the flag that fixes it. It is one of the most useful habits you can pick up.
Number eight, the speed dial.
8 — Speed it up
nmap -T4 -F scanme.nmap.org| Part | What it does |
|---|---|
-T4 |
timing 4 of 5 — noticeably quicker, still well behaved |
-F |
and only the top 100 ports |
Dash capital T sets the timing, from zero, painfully slow, up to five, reckless. Four is the sweet spot most people use. We will combine it with dash capital F. nmap, space, dash capital T four, space, dash capital F, space, scanme dot nmap dot org, and press Enter.
Two flags, stacked, and that is the point. Nmap flags combine freely, and this particular pair is probably the most typed combination in the whole tool.
Number nine, the part of Nmap most beginners never discover.
9 — Run a ready-made script
nmap --script http-title -p 80 scanme.nmap.org| Part | What it does |
|---|---|
--script |
run one of Nmap’s built-in mini-programs |
http-title |
this one fetches the web page’s title |
Nmap ships with hundreds of small ready-made programs called scripts. Dash dash script runs one of them. We will use http dash title, which simply fetches the title of the web page. nmap, space, dash dash script, space, http dash title, space, dash p, space, eighty, space, scanme dot nmap dot org, and press Enter.
It found the page title. That is Nmap doing something well beyond simple port scanning, and there are hundreds more scripts sitting there already installed, waiting for you to explore them.
And number ten. The one that turns a scan into something you can keep.
10 — Save the results
nmap -oA myscan -F scanme.nmap.org| Part | What it does |
|---|---|
-oA |
output all formats at once |
myscan |
the base name for the saved files |
-F |
and keep it quick |
Dash o capital A means output all formats, and you give it one base name of your choosing. We will call ours, my scan. nmap, space, dash o capital A, space, my scan, space, dash capital F, space, scanme dot nmap dot org, and press Enter.
The scan printed as normal, but it also quietly wrote itself to disk. Let’s see what it made. l s, space, dash l, space, my scan, dot, star, and press Enter.
ls -l myscan.*Three files from one command. The dot nmap file is the readable report, the dot gnmap file is a one line per computer version that is easy to search, and the dot x m l file is for other tools to read. Keeping a record is the habit that separates someone poking around from someone doing this properly.
There are all ten.
Your 2026 Nmap toolkit
- Plain scan · -F fast · –top-ports N
- -p exact ports · -sV what software
- -sn is it alive · -Pn scan anyway
- -T4 faster · –script extras · -oA save it
The plain scan, dash capital F for speed, dash dash top dash ports to pick your own number, dash p for exact ports, dash s capital V for the software behind them, dash s n to check a machine is alive, dash capital P small n to scan it anyway, dash capital T four to go faster, dash dash script for the extras, and dash o capital A to save it all.
And the one rule that never changes.
Before you go
- Only scan what you own or have written permission to test
- scanme.nmap.org is offered by the Nmap Project for practice
- Scanning strangers’ machines is illegal in most countries
- New to this? The Nmap beginner series is linked below
Only ever scan a computer you own, or one you have clear written permission to test. Scanning somebody else’s machine is against the law in most of the world. Our practice server is offered by the Nmap Project for precisely this purpose, so use it freely.
Save this one, because these ten will carry you a very long way. Thanks for learning with The Exploit HQ, and I will see you in the next one.