The Exploit HQ

Nmap for Beginners · lesson 2 · 2026-08-13 · updated 2026-10-12

Nmap for Beginners: What's Running Behind Open Ports (Part 2)

Before you start

Welcome back to The Exploit HQ. This is part two of our beginner Nmap series, and you still need zero experience to follow along.

In the last video, we found the open doors on a computer. Today, we go one step further.

We are going to find out what is actually running behind each of those open doors.

A quick reminder from part one. A port is like a numbered door on a computer, and an open door means something is listening there.

But knowing a door is open only tells us half the story. We also want to know what program is standing behind it.

That program is called a service. And most services have a name and a version number, just like an app on your phone.

Why does the version matter? Because older versions often have known security weaknesses. Knowing the version is the first step in checking if something is safe or out of date.

Nmap has a feature that reads these details for us. Let’s use it.

As always, we start at the very beginning. Open the terminal window.

Remember, the terminal is just a place where you type commands instead of clicking buttons.

You will see the prompt, the short line that ends in a dollar sign. That means the computer is ready for you to type.

First, let’s do a normal scan, exactly like we learned in part one, so we can see the difference in a moment.

We will keep it focused on just two doors to stay quick. Type: nmap, space, dash p, space, 22 comma 80, space, and then scanme dot nmap dot org.

Remember, dash p means ports, 22 comma 80 is our short list of doors, and scanme dot nmap dot org is the practice computer we are allowed to scan. Press Enter.

nmap -p 22,80 scanme.nmap.org

Here is our familiar result. We can see door 22 is open, and door 80 is open.

The SERVICE column gives us a short label. It says ssh for door 22, and http for door 80.

But these are just Nmap’s best guess based on the door number. It has not actually checked what is really there.

We do not yet know which program it is, or what version. Let’s ask Nmap to find out.

To do that, we add one small piece to the command. It is called dash s, capital V.

The capital V stands for version. This flag tells Nmap: do not just guess, actually talk to each service and identify it.

Type: nmap, space, dash s capital V, space, dash p, space, 22 comma 80, space, scanme dot nmap dot org.

So the only new part, compared to before, is dash s capital V. Press Enter.

This one may take a few extra seconds, because Nmap is now doing more work. It is having a short conversation with each service to learn its identity.

nmap -sV -p 22,80 scanme.nmap.org

Look at that. We have a new column on the right, called VERSION, and it is full of detail.

For door 22, it no longer just says ssh. It now tells us the actual program. In this case, OpenSSH, along with its version number.

OpenSSH is the software that lets people log in to this computer remotely and securely.

For door 80, it no longer just says http. It now tells us the web server software. Here, it is Apache, again with a version number.

Apache is one of the most common programs in the world for serving web pages.

This is the real power of this scan. We went from knowing a door was open, to knowing exactly what is behind it, and which version it is.

So why is this so useful? Let’s connect it to security.

Software companies release updates to fix security holes. When a hole is found, it usually affects specific older versions.

So if you can see that a service is running an old version, that is a signal it may need updating.

A security professional takes that version number and checks it against public lists of known issues. You have just learned the very first step of that whole process.

And to be clear, we are only reading information that the service openly shares. We are not breaking in or changing anything.

Let’s do one more, to see the full picture.

This time we will drop the dash p, so Nmap checks the common doors on its own, and we keep dash s capital V to identify whatever it finds.

Type: nmap, space, dash s capital V, space, scanme dot nmap dot org. Then press Enter. Give it a moment.

nmap -sV scanme.nmap.org

Now we get the full list. Every open door, and the program and version behind it, all in one view.

This is exactly the kind of summary a professional looks at first when getting to know a computer.

Before we finish, the golden rule from part one still applies, and it always will.

Only scan computers that you own, or that you have clear permission to test. We use scanme dot nmap dot org because the makers of Nmap set it up for us to practice on.

Let’s recap what you learned today.

You learned that an open port has a service behind it, a real program with a name and a version.

You learned the dash s capital V flag, which tells Nmap to identify those services instead of just guessing.

And you learned why the version number matters so much for security.

Take your time, and feel free to replay any part of this video. There is no rush.

In the next tutorial, we will look more closely at port states. What open, closed, and filtered really mean, and why a door might not answer at all.

Thanks for learning with The Exploit HQ. Practice on scanme dot nmap dot org, and I will see you in part three.