Nmap

v7.94Nmap Project (Gordon Lyon)

The reference network mapper. Sweeps address ranges, finds live hosts, enumerates open TCP/UDP ports, fingerprints service versions and operating systems, and runs NSE scripts for deeper checks. In the range it scans the authored estate: subnets, VLANs, firewall rules and host services all shape the result, so a blocked port really is filtered.

Category: Discovery & reconnaissance
Package: nmap
Runs on: Linux · Windows
Commands: nmap, ncat

Scans the simulated topology only. Results come from authored host services and firewall policy — nothing touches a real network.

Install it

The scripts below install the real Nmap Project (Gordon Lyon) package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-nmap.sh

Windows installer (PowerShell)

Install-nmap.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install Nmap
```
sudo apt install -y nmap
```

RHEL, Fedora (dnf)

Install Nmap
```
sudo dnf install -y nmap
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install Nmap
```
sudo pacman -S --noconfirm nmap
```

Alpine (apk)

Install Nmap
```
sudo apk add nmap
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which nmap
```
Check the version
```
nmap --version
```
The range reports 7.94.

Remove it

Take it off again
```
sudo apt remove --purge nmap
```

On Windows

Windows Package Manager (winget)

Search the catalog
```
winget search nmap
```
Install Nmap
```
winget install --id nmap -e
```
Package names drift between distributions; search first if this one misses.

Chocolatey (choco)

Install Nmap
```
choco install nmap -y
```
Run the shell as administrator.

Check it worked

Confirm it resolves
```
where nmap
```
Check the version
```
nmap --version
```
The range reports 7.94.

Remove it

Take it off again
```
winget uninstall --id nmap
```

Inside the range

Tick it on the launch screen
Under Nmap's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y nmap
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Nmap

Reps: Ask the Internetdig, whois, curl and nmap -sn against real public names, graded against what those names actually answer — not against a stored string. Records change; your report has to match today's truth.
Reps: Read the Output (Run the Tool, Justify the Flag)Install nmap, tcpdump and YARA from the catalog on a Linux box, run each one properly, then explain the output line by line — which flag produced it, what the range actually reported, and what you would have missed with the defaults.
Reps: Range Targets — swing at the piñataA per-run virtual estate of intentionally-weak boxes. Use nmap, curl, sqlmap, nikto and hydra against the range's own hosts; the target names, credentials, tables and flags change every run, so the walkthrough has to be earned, not memorised.
Reps: Range Targets — swing at the piñata (Windows)The Range Targets estate, worked from a Windows analyst box. Same per-run virtual targets, driven with PowerShell, nmap, sqlmap, nikto and hydra from a Windows console — the names, credentials, tables and flags still change every run.
Pentest: External Recon to FootholdEnumerate a customer's public perimeter from an approved scan window, chain a stale service to a foothold, and file the first finding with CVSS and remediation before you touch anything else.
Pentest: Cloud Privilege EscalationGiven an access key with s3:GetObject only, walk a chain of over-permissive roles and trust policies to end up in a shell on a build server. File the trust-policy finding — the fix is one JSON edit.
Pentest: Wireless AssessmentSit in an authorized coffee-shop parking lot, sweep the 2.4/5 GHz bands, capture the guest-WPA2 handshake, crack it against a scoped wordlist, then file a rotation-and-802.1X finding on the corporate SSID.