Here, you can see sendmail identifies itself and gives its version number. This is valuable information; exploits can now be searched for that are appropriate for this target.

Where to from here

That’s the basics of beginning penetration testing by using nmap to perform research. There are many options to nmap and it is a very versatile tool. It is definitely worthwhile reading the documentation on insecure.org to understand other ways it can be used as well as good tips for successful stealthy probing.

One such tip is to space out the scanning over a period of time. Despite best attempts to be quiet, diligent admins may notice unusual network activity especially if this has a pattern to it like incrementing through a series of ports. In this case, nmap offers a –T0 flag to spread its scans over some considerable time. This means it will take a long time to return results but with the benefit of reducing the possibility of notice. By contrast, timing can be sped up greatly with –T5. This may be useful if the target system is on a high-speed network like a LAN and you only have a very small window of time to capture data. Other timings are possible through –T1 through –T4.

Another good nmap flag for beginners is –v which gives additional, verbose, output. With this set nmap will provide extra text explaining its actions and results.

Flags can be combined to perform more work in one run and speed up the gathering of results. An example is the single command nmap –v –sS –O –sV –T1 host.

You might also like to explore other open-source tools which can add more detail to the results obtained from nmap. Popular penetration testing programs include amap, scanrand and ike-scan. Good luck!