recon-nmap

Authorized network reconnaissance with Nmap identifies open ports, running services, and operating systems across target networks. It requires explicit written permission and appropriate system privileges before executing any port scanning, service enumeration, or NSE scripting commands.

Mapping an attack surface involves using Nmap to identify live hosts, open ports, and service details. This builds a current view of network boundaries, firewall rules, and asset reachability to directly support security risk assessments and vulnerability discovery.

Yes, Nmap NSE scripting runs targeted scripts during network scans to gather vulnerability context and determine operating system details. This vulnerability-oriented discovery is applicable across internal networks, external perimeters, and test labs during security assessments.

Yes, you need privileges appropriate for your chosen scan types to perform OS fingerprinting and port scanning. Nmap must be installed on your system, and you must have explicit written authorization before scanning any network perimeter or internal subnet.

Running network reconnaissance without explicit written authorization violates the core requirement of this skill. You must not scan any network without proper permission, as unauthorized port scanning and service enumeration are strictly prohibited security violations.