Lion Cipher Lab
Master Nmap: choose the right scan for the job
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Anyone can type `nmap -A target` and watch text scroll by. What separates a professional from a beginner is not knowing more flags — it is knowing WHICH scan to run, WHEN, and WHY, so the results are accurate and the scan is quiet and purposeful instead of loud and wasteful. The default `-A` blast is slow, noisy, and often wrong against a firewalled target; a staged approach gets better data and looks like a professional at work. This lab turns Nmap from a button you press into a decision you make.
What you'll learn
- Choosing SYN vs connect vs UDP scans
- Host discovery and -Pn
- Nmap timing templates
- Deciding when NSE scripts help
- Staged, purposeful reconnaissance
Steps in this lab
- The mindset: purposeful, not `-A` at everything
- Set up an isolated target you own
- Host discovery — and why -Pn matters when the target plays dead
- SYN vs Connect vs UDP — pick the scan that fits the job
- Timing — why -T4, not -T5, on a real assessment
- NSE — when scripts earn their place, and when they waste time
- Put it together: the staged scan a pro actually runs