Nmap as a Decision Engine: Operating Under Pressure During a Red Team Engagement

1. Entry Point Thinking: The Clock is Ticking

The Rules of Engagement are signed. Four hours to map an unfamiliar /24, find an exploitable way in, and prove impact without knocking anything over in production. No asset inventory. An IPS watching the wire the whole time. The clock started when I hit enter.

Before I open a terminal I’m not asking which tool to use. I’m asking two things: how noisy can I afford to be, and what does “success” actually look like when the report lands on a director’s desk. Success isn’t a beautiful network map. It’s one exploitable path, proven, with time to spare. The fastest way to lose the first hour is to trust ICMP — assume a host is dead because it won’t answer a ping, and you’ll walk straight past the box that owns the domain. Silence on the wire is not the same as an empty subnet, and confusing the two is the beginner’s tell.

2. The First Scan Decision: Speed vs. Truth

Running nmap -A across a /24 is a confession. It’s loud, it’s slow, and it puts your source IP on the perimeter’s naughty list inside the first minute. What I want is discovery without a signature — live hosts, no alarms.

nmap -sn -PE -PP -PS21,22,23,25,80,113,443 -PA80,113,443,10025 --source-port 53 203.0.113.0/24 -oA initial_sweep

What’s this doing? A standard ping sweep dies against Windows firewalls and edge gateways that drop echo requests by default. So I mix probe types — ICMP echo, timestamp, and TCP packets sourced from port 53 so they read like DNS responses coming back through the firewall. It’s not invisible. It’s just quiet enough that a tuned-out analyst won’t look twice. The trade-off is speed: this sweep is deliberately slower and less thorough than -A, and it will miss a host that answers on none of the probe ports. That’s the price of not getting banned in the first ninety seconds.

I expected 30-40 live hosts.

I got 4.

3. When Things Go Wrong: The Silent Drop

Four live hosts on a corporate /24? That number is a lie. The packets aren’t being rejected — a reject would send back an RST or an ICMP unreachable. They’re being silently dropped, which is the signature of a stateful firewall doing its job. Speeding up won’t help; it’ll just get me throttled or blacklisted faster.

So I stop hunting for open ports and start mapping the wall itself.

nmap -sA -T2 203.0.113.0/24

A TCP ACK scan doesn’t tell you what’s open — it tells you what the firewall lets through. An unsolicited ACK to an unfiltered port draws a RST; a filtered port draws nothing. -T2 keeps the timing slow enough to stay under the rate-limiting threshold that would otherwise cut me off.

The pattern emerges. The firewall is disciplined on the standard ports and sloppy above 10000 — the range someone configured by hand once and never revisited. That inconsistency is the crack I’ll widen.

4. Attack Surface Expansion: The Hidden Depths

Three hosts alive and answering on high ports. Now I need to know what’s actually listening. Management interfaces hide on ports nobody documents — 8443, 10443, 9090, whatever the installer picked — and guessing wastes time I don’t have. So I scan all 65,535.

nmap -sS -p- --min-rate 300 --max-retries 1 203.0.113.5 -oA full_tcp

A SYN scan never completes the handshake, so the target application never logs a connection — the RST comes before anything upstream of the kernel notices. --min-rate 300 pushes the pace because time is tight; --max-retries 1 stops Nmap from re-probing filtered ports and flooding the link. The trade-off is real: at this rate, a genuinely open-but-slow port can register as filtered and get missed. Against the clock, I’ll take that risk.

The results change the engagement. 80 and 443 as expected — and 10443, an open service parked on a non-standard port, which is exactly the kind of thing an admin forgets exists.

5. Service Enumeration With Intent

Service enumeration is where you get caught. Nmap fires a battery of probes at each port, and that burst is exactly what an IPS is tuned to flag. So I stay selective — two ports, not the whole host.

nmap -sV --version-light -p 22,10443 203.0.113.5

--version-light caps Nmap at intensity 2 — the highest-confidence probes only, skipping the exhaustive set. Fewer packets, less signature, a version banner good enough to act on.

Results:

• Port 22: OpenSSH 8.2p1 (Ubuntu)
• Port 10443: Apache Tomcat 9.0.31

6. The Decision Point: Tactical Prioritization

OpenSSH 8.2 or Tomcat 9.0.31 — which one breaks first?

OpenSSH 8.2p1 is current and hard. Brute-forcing it burns hours and guarantees detection; not a serious option with the clock running. Tomcat is the softer target every time. A Java app on a non-standard port usually means someone who believed the port number was the security control. Those boxes ship with the Manager console enabled, a default or throwaway password, and a patch cadence measured in years. That’s where I go.

7. NSE As A Weapon (Not a Feature)

The Nmap Scripting Engine is a scalpel or a sledgehammer depending on how you hold it. Firing --script vuln at a monitored target is amateur hour — it runs dozens of noisy checks, most irrelevant, and lights up every sensor on the segment. I stay surgical: three scripts, one port.

nmap -sV -p 10443 --script http-tomcat-mgr-enum,http-title,http-enum 203.0.113.5

Page title, common directories, and the Tomcat Manager endpoint specifically. The result is the one I was hoping for: /manager/html responds, and it’s asking for Basic auth.

8. Stealth vs. Speed Tradeoff

Ninety minutes left. I know the target, I know the service, and the IPS hasn’t cut me off — the slow SYN work paid for itself. Stealth has done its job, and now stealth is a liability. The remaining budget is better spent making noise at one door than staying quiet everywhere.

I point Hydra at the Manager panel and let it run flat out. Basic auth over a single endpoint, rapid-fire. Four minutes later: tomcat:s3cr3t. A default that survived because nobody thought a service on port 10443 counted.

9. The Internal Network Shift

Valid credentials on the Manager mean I can deploy a WAR file, and a WAR file means a reverse shell. I’m inside the firewall now, running as the tomcat service account.

Nmap’s job changes entirely. I push a statically compiled binary to the box, because the internal network is a different world. Outside I was fighting an IPS for every packet. Inside, most corporate networks are a soft centre — flat, unsegmented, monitored far less than the perimeter. Stealth stops being the constraint. Speed and reach take over.

./nmap -sT -p 445,3389 10.10.0.0/24 > smb_targets.txt

Full TCP connect scans (-sT), because the tomcat account doesn’t have root and raw sockets need root — a SYN scan would fail silently and hand me an empty file. I’m hunting 445 and 3389, SMB and RDP, the two protocols that carry lateral movement in almost every Windows estate.

10. The Automation Mindset

I can’t eyeball every result and still finish inside the window. So I let the shell do the fan-out.

for ip in $(cat smb_targets.txt | grep open | awk '{print $2}'); do 
    ./nmap -p 445 --script smb-os-discovery $ip >> lateral_map.txt & 
done

A one-line loop. For every host with 445 open, kick off smb-os-discovery in the background. The script pulls the OS version, the hostname, and the Active Directory domain the box is joined to — the details that tell you which target is the crown jewel and which is a print server. One caveat worth naming: firing dozens of scans in parallel with & will happily saturate the link and can wedge the compromised host, so on a fragile target you throttle it. Here, the network held.

11. Real Finding to Exploit Path

One host stands out: Windows Server 2008 R2, SMBv1 enabled, sitting deep in the network past its end-of-life. An OS Microsoft stopped patching in January 2020, still running the file shares.

That’s MS17-010 — EternalBlue. The exploit that powered WannaCry, still landing in 2026 because someone couldn’t decommission a legacy box.

Fourteen minutes later I’ve tunnelled the exploit through the Tomcat foothold and I’m sitting as NT AUTHORITY\SYSTEM on the file server. That’s the finding. Everything after this is writing it up.

12. The Defensive Perspective

Every step of that chain had a place it could have died. None of them did, and it’s worth being specific about why.

The DNS-sourced packets hitting non-DNS ports are a clean detection — traffic claiming source port 53 that isn’t going to or from a resolver is anomalous, and a perimeter rule can catch it. The repeated ACK probes against the firewall are the second chance: a burst of unsolicited ACKs from one external host should trip an automated ban, not just get dropped. The third is the one that would actually have stopped me — an internal baseline scan that diffs against yesterday. When port 10443 appears on a host that had nothing above 443 on Thursday, the SOC gets paged on Friday night, before the brute-force ever starts. The catch, and the reason it usually fails: nobody funds the person who reads the Friday-night baseline diff.

13. Translating Technical Execution to Business Impact

In the executive brief, nobody wants to hear about SYN scans or ACK probes. They want to know what it cost them and what it would cost them next time. So the finding gets translated:

“An undocumented Tomcat server on a non-standard port, running a default password. We logged in and got a shell in your DMZ. From there your internal network offered no resistance — flat, unsegmented, unmonitored — and we reached end-of-life Windows servers holding your file shares. A ransomware crew taking exactly this path would have your SMB estate encrypted inside an hour. The uncomfortable part: your perimeter firewall worked. It did its job. The failure was the assumption that the perimeter was enough, and that anything already inside could be trusted.”

14. Why Nmap is Mandatory for Modern Operations

Nessus, Qualys and Nexpose earn their keep on compliance work — comprehensive coverage, tidy reports, an audit trail. But drop them into a live engagement where an IPS is actively fighting you, stealth decides whether you finish, and the clock is real, and they fall over. They’re built to be thorough, which means loud, which means blocked inside a minute.

Nmap isn’t a scanner you point and click. It’s a way of manipulating packets that only works if you understand what’s happening on the wire — every flag changes the behaviour of the frame, and knowing which one to reach for under an IPS is the whole skill. That’s also the honest downside: it demands TCP/IP fluency the point-and-click tools let you skip, and it will happily let you scan the wrong thing all afternoon if you don’t know what you’re asking for. That cost is the point. It forces you to think like the packets do, which is the only way to see the network the way an attacker actually sees it.