Introduction

Some of the things I like the most about Nmap is its stability and how customizable it is when scanning large networks. Nmap can be used to scan millions of IPs in a single run with incredible efficiency. We just need to be careful to understand and adjust the variables that can affect performance, and really think about our scan objectives beforehand.

This chapter covers the most important aspects that one needs to consider when scanning large networks. We start by introducing basic tasks such as reading target lists, selecting the correct timing template, generating random targets, and skipping phases to save time. The advanced tasks covered in this chapter include an overview of the timing and performance arguments available in Nmap, and how to use them correctly. I will also show you how to collect HTTP headers from the Internet for analysis, such as the popular service "ShodanHQ", but using only Nmap.

Finally, I cover a non-official tool named Dnmap that helps us distribute...