The Exploit HQ

The 10 Commands · lesson 2 · 2026-08-28 · updated 2026-10-12

The 10 Commands That Show You How Vulnerability Scanning Works in 2026

Before you start

Everyone talks about vulnerability scanning like it is one magic button. It is not. It is a chain of small, ordinary steps, and today we run every one of them for real.

By the end you will know exactly how a scanner decides that something is vulnerable, because you will have done it by hand. Everything runs against scanme dot nmap dot org, the practice server the Nmap Project puts online for precisely this.

Step one. Before anything else, is there even a machine there?

1 — Is anything actually there?

nmap -sn scanme.nmap.org
Part What it does
-sn no port scan — only ask whether the machine answers

Dash s n skips the ports entirely and just asks whether the machine is alive. Scanners always start here, because there is no sense examining a computer that is switched off.

nmap, space, dash s n, space, scanme dot nmap dot org, and press Enter.

Host is up. That is the whole answer, and it is the green light for everything that follows.

Step two. Which doors are open?

2 — Which doors are open?

nmap -F scanme.nmap.org
Part What it does
-F fast — check the top 100 ports rather than 1,000

Dash capital F checks the hundred most common ports. A closed port cannot be attacked, so a scanner only cares about the open ones. This is how the list of things worth examining gets built.

nmap, space, dash capital F, space, scanme dot nmap dot org, and press Enter.

Two open doors. Port twenty-two, and port eighty. Everything from here on is about those two, and nothing else.

Step three, and this is the one that turns a port scan into a vulnerability scan.

3 — What software, and WHICH VERSION?

nmap -sV -p 22,80 scanme.nmap.org
Part What it does
-sV ask each open port what software it is running
-p 22,80 just our two open ports

Dash s capital V asks each open port to introduce itself, and it answers with a software name and, crucially, a version number. Pay attention here, because that version number is the entire hinge of vulnerability scanning.

nmap, space, dash s capital V, space, dash p, space, twenty-two comma eighty, space, scanme dot nmap dot org, and press Enter.

Look at port eighty. Apache httpd two point four point seven. That is not just, a web server. That is an exact version. And a known weakness always belongs to a specific version, which is why this single line is worth more than everything before it.

Step four. Never trust one source. Confirm it.

4 — Confirm it from a second source

nmap --script banner -p 22,80 scanme.nmap.org
Part What it does
--script banner grab the greeting each service sends on connect

Many services announce themselves the moment you connect. That greeting is called a banner. Reading it separately gives you a second, independent opinion on what is really running, and good analysts always want two.

nmap, space, dash dash script, space, banner, space, dash p, space, twenty-two comma eighty, space, scanme dot nmap dot org, and press Enter.

The banner agrees with the version scan. When two independent checks say the same thing, your confidence goes up. When they disagree, that itself is interesting, and worth chasing.

Step five. Web servers hand out evidence for free.

5 — Read what the web server volunteers

nmap --script http-headers -p 80 scanme.nmap.org
Part What it does
--script run one of Nmap’s built-in checks
http-headers print the hidden labels sent with every page

Every web page arrives with a set of hidden labels called headers, which your browser reads but never shows you. They often name the exact server software, and they also reveal which security protections are switched on, or missing.

nmap, space, dash dash script, space, http dash headers, space, dash p, space, eighty, space, scanme dot nmap dot org, and press Enter.

There is the server naming itself again, a third time now. A real assessment would also note which protective headers are absent, because a missing protection is a finding in its own right.

Step six. Not every weakness is an old version. Some are just bad settings.

6 — Check for risky settings

nmap --script http-methods -p 80 scanme.nmap.org
Part What it does
--script run one of Nmap’s built-in checks
http-methods list which request types the server permits

This asks the server which kinds of request it is willing to accept. Some of them, like PUT or DELETE, can let a stranger upload or remove files if they are left switched on by accident. Nothing is out of date here. The setting itself is the problem.

nmap, space, dash dash script, space, http dash methods, space, dash p, space, eighty, space, scanme dot nmap dot org, and press Enter.

This is a whole category of finding that has nothing to do with patching. It is configuration, and it is one of the most common real-world problems there is.

Step seven. The same idea, but for encryption.

7 — Is the encryption any good?

nmap --script ssh2-enum-algos -p 22 scanme.nmap.org
Part What it does
--script run one of Nmap’s built-in checks
ssh2-enum-algos list the encryption S S H will accept

This lists every encryption method the S S H service will accept. Old, weak methods left enabled are a genuine finding, and this is exactly the sort of check a professional scanner runs and then quietly reports.

nmap, space, dash dash script, space, s s h two dash enum dash algos, space, dash p, space, twenty-two, space, scanme dot nmap dot org, and press Enter.

That list is long, and we are only seeing the start of it. That is fine. The skill is not memorising algorithm names, it is knowing that this list exists and that somebody should be checking it against current guidance.

Step eight. Now we answer the actual question. Is that version dangerous?

8 — Match the version to known problems

searchsploit --disable-colour 'apache 2.4.7 mod_status'
Part What it does
searchsploit search a local database of known public issues
--disable-colour plain text, easier to read on screen
'apache 2.4.7 …' the exact version we found in step 3

Search sploit searches a database of publicly known issues that lives on your own machine. We hand it the exact version we discovered back in step three. This is the step people imagine is magic. It is a lookup.

search sploit, space, dash dash disable dash colour, space, and in quotes, apache two point four point seven mod underscore status. Press Enter.

There it is. A publicly documented issue affecting that exact version. That is the whole chain closing: open port, then software, then version, then a known problem. A commercial scanner does precisely this, only faster and across thousands of machines.

Step nine, and this one is about restraint.

9 — Read the script BEFORE you run it

nmap --script-help ssl-heartbleed
Part What it does
--script-help explain what a script does — without running it
ssl-heartbleed the script we are asking about

Nmap ships with scripts that actively test for weaknesses, and some of them can disturb or even crash a fragile service. Dash dash script dash help tells you what one does without firing it. Reading first is what separates a professional from someone causing an outage.

nmap, space, dash dash script dash help, space, s s l dash heartbleed, and press Enter.

A plain description, and nothing was sent to anybody. Notice that we did not run the aggressive vulnerability scripts against our practice server today, and that is deliberate. Restraint is part of the skill.

And step ten. A finding nobody wrote down never happened.

10 — Write the finding down

nmap -sV -oN vulnscan.txt -p 22,80 scanme.nmap.org
Part What it does
-oN vulnscan.txt save the readable report into a file
-sV with the version detail that matters

Dash o capital N saves the readable report to a file of your choosing. We will keep the version detection switched on, because the versions are the part anybody reading your report will actually care about.

nmap, space, dash s capital V, space, dash o capital N, space, vuln scan dot txt, space, dash p, space, twenty-two comma eighty, space, scanme dot nmap dot org, and press Enter.

It printed as usual, and quietly saved a copy. Let’s read it back. cat, space, vuln scan dot txt, and press Enter.

cat vulnscan.txt

Timestamped, on disk, and shareable. That is the difference between poking around and doing an assessment somebody can act on.

So that is the whole chain, and there was never a magic button in it.

How vulnerability scanning actually works

Find out whether the machine is alive. Find the open ports. Identify the software and its exact version. Confirm that from a second source. Check the settings and the encryption, not only whether patches are missing. Match the version against known issues. Then write it down.

A commercial vulnerability scanner does exactly these steps. It is faster than you, and it does it to thousands of machines at once, but it is not doing anything you have not now done yourself by hand.

And the rule that outranks every command here.

Before you go

Only ever scan a machine you own, or one you have clear written permission to test. And remember step nine. Read what a script does before you point it at anything, because some of them can genuinely knock a service over.

If any of this moved too quickly, our beginner Nmap course starts from opening the terminal for the very first time, and it is linked below. Thanks for learning with The Exploit HQ, and I will see you in the next one.