Introduction
NMAP (Network Mapper) is one of the most powerful and versatile network scanning tools available for security professionals, system administrators, and ethical hackers. When combined with Claude through the Model Context Protocol (MCP), it becomes an even more powerful tool, allowing you to leverage AI to intelligently analyze scan results, suggest scanning strategies, and interpret complex network data.
In this deep dive, we’ll explore how to set up NMAP with Claude Desktop using an MCP server, and demonstrate 20+ comprehensive vulnerability checks and reconnaissance techniques you can perform using natural language prompts.
⚠️ Legal Disclaimer: Only scan systems and networks you own or have explicit written permission to test. Unauthorized scanning may be illegal in your jurisdiction.
Prerequisites
- macOS, Linux, or Windows with WSL
- Basic understanding of networking concepts
- Permission to scan target systems
- Claude Desktop installed
Part 1: Installation and Setup
Step 1: Install NMAP
On macOS:
# Using Homebrew
brew install nmap
# Verify installation
On Linux (Ubuntu/Debian):Step 2: Install Node.js (Required for MCP Server)
The NMAP MCP server requires Node.js to run.
Mac OS:
brew install node
node --version
npm --versionStep 3: Install the NMAP MCP Server
The most popular NMAP MCP server is available on GitHub. We’ll install it globally:
cd ~/
rm -rf nmap-mcp-server
git clone https://github.com/PhialsBasement/nmap-mcp-server.git
cd nmap-mcp-server
npm install
npm run buildStep 4: Configure Claude Desktop
Edit the Claude Desktop configuration file to add the NMAP MCP server.
On macOS:
CONFIG_FILE="$HOME/Library/Application Support/Claude/claude_desktop_config.json"
USERNAME=$(whoami)
cp "$CONFIG_FILE" "$CONFIG_FILE.backup"
python3 << 'EOF'
import json
import os
config_file = os.path.expanduser("~/Library/Application Support/Claude/claude_desktop_config.json")
username = os.environ['USER']
with open(config_file, 'r') as f:
config = json.load(f)
if 'mcpServers' not in config:
config['mcpServers'] = {}
config['mcpServers']['nmap'] = {
"command": "node",
"args": [
f"/Users/{username}/nmap-mcp-server/dist/index.js"
],
"env": {}
}
with open(config_file, 'w') as f:
json.dump(config, f, indent=2)
print("nmap server added to Claude Desktop config!")
print(f"Backup saved to: {config_file}.backup")
EOF
Step 5: Restart Claude Desktop
Close and reopen Claude Desktop. You should see the NMAP MCP server connected in the bottom-left corner.
Part 2: Understanding NMAP MCP Capabilities
Once configured, Claude can execute NMAP scans through the MCP server. The server typically provides:
- Host discovery scans
- Port scanning (TCP/UDP)
- Service version detection
- OS detection
- Script scanning (NSE – NMAP Scripting Engine)
- Output parsing and interpretation
Part 3: 20 Most Common Vulnerability Checks
For these examples, we’ll use a hypothetical target domain: example-target.com (replace with your authorized target).
1. Basic Host Discovery and Open Ports
Prompt:
Scan example-target.com to discover if the host is up and identify all open ports (1-1000). Use a TCP SYN scan for speed.
What this does: Performs a fast SYN scan on the first 1000 ports to quickly identify open services.
Expected NMAP command:
nmap -sS -p 1-1000 example-target.com2. Comprehensive Port Scan (All 65535 Ports)
Prompt:
Perform a comprehensive scan of all 65535 TCP ports on example-target.com to identify any services running on non-standard ports.What this does: Scans every possible TCP port – time-consuming but thorough.
Expected NMAP command:
nmap -p- example-target.com3. Service Version Detection
Prompt:
Scan the top 1000 ports on example-target.com and detect the exact versions of services running on open ports. This will help identify outdated software.What this does: Probes open ports to determine service/version info, crucial for finding known vulnerabilities.
Expected NMAP command:
nmap -sV example-target.com4. Operating System Detection
Prompt:
Detect the operating system running on example-target.com using TCP/IP stack fingerprinting. Include OS detection confidence levels.What this does: Analyzes network responses to guess the target OS.
Expected NMAP command:
nmap -O example-target.com5. Aggressive Scan (OS + Version + Scripts + Traceroute)
Prompt:
Run an aggressive scan on example-target.com that includes OS detection, version detection, script scanning, and traceroute. This is comprehensive but noisy.What this does: Combines multiple detection techniques for maximum information.
Expected NMAP command:
nmap -A example-target.com6. Vulnerability Scanning with NSE Scripts
Prompt:
Scan example-target.com using NMAP's vulnerability detection scripts to check for known CVEs and security issues in running services.What this does: Uses NSE scripts from the ‘vuln’ category to detect known vulnerabilities.
Expected NMAP command:
nmap --script vuln example-target.com7. SSL/TLS Security Analysis
Prompt:
Analyze SSL/TLS configuration on example-target.com (port 443). Check for weak ciphers, certificate issues, and SSL vulnerabilities like Heartbleed and POODLE.What this does: Comprehensive SSL/TLS security assessment.
Expected NMAP command:
nmap -p 443 --script ssl-enum-ciphers,ssl-cert,ssl-heartbleed,ssl-poodle example-target.com8. HTTP Security Headers and Vulnerabilities
Prompt:
Check example-target.com's web server (ports 80, 443, 8080) for security headers, common web vulnerabilities, and HTTP methods allowed.What this does: Tests for missing security headers, dangerous HTTP methods, and common web flaws.
Expected NMAP command:
nmap -p 80,443,8080 --script http-security-headers,http-methods,http-csrf,http-stored-xss example-target.comPrompt:
Scan example-target.com for SMB vulnerabilities including MS17-010 (EternalBlue), SMB signing issues, and accessible shares.What this does: Critical for identifying Windows systems vulnerable to ransomware exploits.
Expected NMAP command:
nmap -p 445 --script smb-vuln-ms17-010,smb-vuln-*,smb-enum-shares example-target.com10. SQL Injection Testing
Prompt:
Test web applications on example-target.com (ports 80, 443) for SQL injection vulnerabilities in common web paths and parameters.What this does: Identifies potential SQL injection points.
Expected NMAP command:
nmap -p 80,443 --script http-sql-injection example-target.com11. DNS Zone Transfer Vulnerability
Prompt:
Test if example-target.com's DNS servers allow unauthorized zone transfers, which could leak internal network information.What this does: Attempts AXFR zone transfer – a serious misconfiguration if allowed.
Expected NMAP command:
nmap --script dns-zone-transfer --script-args dns-zone-transfer.domain=example-target.com -p 53 example-target.com12. SSH Security Assessment
Prompt:
Analyze SSH configuration on example-target.com (port 22). Check for weak encryption algorithms, host keys, and authentication methods.What this does: Identifies insecure SSH configurations.
Expected NMAP command:
nmap -p 22 --script ssh-auth-methods,ssh-hostkey,ssh2-enum-algos example-target.comPrompt:
Check if example-target.com's FTP server (port 21) allows anonymous login and scan for FTP-related vulnerabilities.What this does: Tests for anonymous FTP access and common FTP security issues.
Expected NMAP command:
nmap -p 21 --script ftp-anon,ftp-vuln-cve2010-4221,ftp-bounce example-target.comPrompt:
Scan example-target.com's email servers (ports 25, 110, 143, 587, 993, 995) for open relays, STARTTLS support, and vulnerabilities.What this does: Comprehensive email server security check.
Expected NMAP command:
nmap -p 25,110,143,587,993,995 --script smtp-open-relay,smtp-enum-users,ssl-cert example-target.com15. Database Server Exposure
Prompt:
Check if example-target.com has publicly accessible database servers (MySQL, PostgreSQL, MongoDB, Redis) and test for default credentials.What this does: Identifies exposed databases, a critical security issue.
Expected NMAP command:
nmap -p 3306,5432,27017,6379 --script mysql-empty-password,pgsql-brute,mongodb-databases,redis-info example-target.com16. WordPress Security Scan
Prompt:
If example-target.com runs WordPress, enumerate plugins, themes, and users, and check for known vulnerabilities.What this does: WordPress-specific security assessment.
Expected NMAP command:
nmap -p 80,443 --script http-wordpress-enum,http-wordpress-users example-target.com17. XML External Entity (XXE) Vulnerability
Prompt:
Test web services on example-target.com for XML External Entity (XXE) injection vulnerabilities.What this does: Identifies XXE flaws in XML parsers.
Expected NMAP command:
nmap -p 80,443 --script http-vuln-cve2017-5638 example-target.com18. SNMP Information Disclosure
Prompt:
Scan example-target.com for SNMP services (UDP port 161) and attempt to extract system information using common community strings.What this does: SNMP can leak sensitive system information.
Expected NMAP command:
nmap -sU -p 161 --script snmp-brute,snmp-info example-target.com19. RDP Security Assessment
Prompt:
Check if Remote Desktop Protocol (RDP) on example-target.com (port 3389) is vulnerable to known exploits like BlueKeep (CVE-2019-0708).What this does: Critical Windows remote access security check.
Expected NMAP command:
nmap -p 3389 --script rdp-vuln-ms12-020,rdp-enum-encryption example-target.com20. API Endpoint Discovery and Testing
Prompt:
Discover API endpoints on example-target.com and test for common API vulnerabilities including authentication bypass and information disclosure.What this does: Identifies REST APIs and tests for common API security issues.
Expected NMAP command:
nmap -p 80,443,8080,8443 --script http-methods,http-auth-finder,http-devframework example-target.comPart 4: Deep Dive Exercises
Deep Dive Exercise 1: Complete Web Application Security Assessment
Scenario: You need to perform a comprehensive security assessment of a web application running at webapp.example-target.com.
Claude Prompt:
I need a complete security assessment of webapp.example-target.com. Please:
1. First, discover all open ports and running services
2. Identify the web server software and version
3. Check for SSL/TLS vulnerabilities and certificate issues
4. Test for common web vulnerabilities (XSS, SQLi, CSRF)
5. Check security headers (CSP, HSTS, X-Frame-Options, etc.)
6. Enumerate web directories and interesting files
7. Test for backup file exposure (.bak, .old, .zip)
8. Check for sensitive information in robots.txt and sitemap.xml
9. Test HTTP methods for dangerous verbs (PUT, DELETE, TRACE)
10. Provide a prioritized summary of findings with remediation advice
Use timing template T3 (normal) to avoid overwhelming the target.
What Claude will do:
Claude will execute multiple NMAP scans in sequence, starting with discovery and progressively getting more detailed. Example commands it might run:
# Phase 1: Discovery
nmap -sV -T3 webapp.example-target.com
# Phase 2: SSL/TLS Analysis
nmap -p 443 -T3 --script ssl-cert,ssl-enum-ciphers,ssl-known-key,ssl-heartbleed,ssl-poodle,ssl-ccs-injection webapp.example-target.com
# Phase 3: Web Vulnerability Scanning
nmap -p 80,443 -T3 --script http-security-headers,http-csrf,http-sql-injection,http-stored-xss,http-dombased-xss webapp.example-target.com
# Phase 4: Directory and File Enumeration
nmap -p 80,443 -T3 --script http-enum,http-backup-finder webapp.example-target.com
# Phase 5: HTTP Methods Testing
nmap -p 80,443 -T3 --script http-methods --script-args http-methods.test-all webapp.example-target.com
Learning Outcomes:
- Understanding layered security assessment methodology
- How to interpret multiple scan results holistically
- Prioritization of security findings by severity
- Claude’s ability to correlate findings across multiple scans
Deep Dive Exercise 2: Network Perimeter Reconnaissance
Scenario: You’re assessing the security perimeter of an organization with the domain company.example-target.com and a known IP range 198.51.100.0/24.
Claude Prompt:
Perform comprehensive network perimeter reconnaissance for company.example-target.com (IP range 198.51.100.0/24). I need to:
1. Discover all live hosts in the IP range
2. For each live host, identify:
- Operating system
- All open ports (full 65535 range)
- Service versions
- Potential vulnerabilities
3. Map the network topology and identify:
- Firewalls and filtering
- DMZ hosts vs internal hosts
- Critical infrastructure (DNS, mail, web servers)
4. Test for common network misconfigurations:
- Open DNS resolvers
- Open mail relays
- Unauthenticated database access
- Unencrypted management protocols (Telnet, FTP)
5. Provide a network map and executive summary
Use slow timing (T2) to minimize detection risk and avoid false positives.
What Claude will do:
# Phase 1: Host Discovery
nmap -sn -T2 198.51.100.0/24
# Phase 2: OS Detection on Live Hosts
nmap -O -T2 198.51.100.0/24
# Phase 3: Comprehensive Port Scan (may suggest splitting into chunks)
nmap -p- -T2 198.51.100.0/24
# Phase 4: Service Version Detection
nmap -sV -T2 198.51.100.0/24
# Phase 5: Specific Service Checks
nmap -p 53 --script dns-recursion 198.51.100.0/24
nmap -p 25 --script smtp-open-relay 198.51.100.0/24
nmap -p 3306,5432,27017 --script mysql-empty-password,pgsql-brute,mongodb-databases 198.51.100.0/24
nmap -p 23,21 198.51.100.0/24
# Phase 6: Vulnerability Scanning on Critical Hosts
nmap --script vuln -T2 [critical-hosts]
Learning Outcomes:
- Large-scale network scanning strategies
- How to handle and analyze results from multiple hosts
- Network segmentation analysis
- Risk assessment across an entire network perimeter
- Understanding firewall and filtering detection
Deep Dive Exercise 3: Advanced Vulnerability Research – Zero-Day Hunting
Scenario: You’ve discovered a host running potentially vulnerable services and want to do deep reconnaissance to identify potential zero-day vulnerabilities or chained exploits.
Claude Prompt:
I've found a server at secure-server.example-target.com that's running multiple services. I need advanced vulnerability research:
1. Aggressive version fingerprinting of all services
2. Check for version-specific CVEs in detected software
3. Look for unusual port combinations that might indicate custom applications
4. Test for default credentials on all identified services
5. Check for known backdoors in the detected software versions
6. Test for authentication bypass vulnerabilities
7. Look for information disclosure issues (version strings, debug info, error messages)
8. Test for timing attacks and race conditions
9. Analyze for possible exploit chains (e.g., LFI -> RCE)
10. Provide detailed analysis with CVSS scores and exploit availability
Run this aggressively (-T4) as we have permission for intensive testing.
What Claude will do:
# Phase 1: Aggressive Fingerprinting
nmap -sV --version-intensity 9 -T4 secure-server.example-target.com
# Phase 2: All Vulnerability Scripts
nmap --script vuln,exploit -T4 secure-server.example-target.com
# Phase 3: Default Credential Testing
nmap --script auth -T4 secure-server.example-target.com
# Phase 4: Backdoor Detection
nmap --script backdoor-check,unusual-port -T4 secure-server.example-target.com
# Phase 5: Authentication Testing
nmap --script auth-bypass,brute -T4 secure-server.example-target.com
# Phase 6: Information Disclosure
nmap --script banner,http-errors,http-git,http-svn-enum -T4 secure-server.example-target.com
# Phase 7: Service-Specific Deep Dives
# (Claude will run targeted scripts based on discovered services)
After scans, Claude will:
- Cross-reference detected versions with CVE databases
- Explain potential exploit chains
- Provide PoC (Proof of Concept) suggestions
- Recommend remediation priorities
- Suggest additional manual testing techniques
Learning Outcomes:
- Advanced NSE scripting capabilities
- How to correlate vulnerabilities for exploit chains
- Understanding vulnerability severity and exploitability
- Version-specific vulnerability research
- Claude’s ability to provide context from its training data about specific CVEs
Part 5: Wide-Ranging Reconnaissance Exercises
Exercise 5.1: Subdomain Discovery and Mapping
Prompt:
Help me discover all subdomains of example-target.com and create a complete map of their infrastructure. For each subdomain found:
- Resolve its IP addresses
- Check if it's hosted on the same infrastructure
- Identify the services running
- Note any interesting or unusual findings
Also check for common subdomain patterns like api, dev, staging, admin, etc.
What this reveals: Shadow IT, forgotten dev servers, API endpoints, and the organization’s infrastructure footprint.
Exercise 5.2: API Security Testing
Prompt:
I've found an API at api.example-target.com. Please:
1. Identify the API type (REST, GraphQL, SOAP)
2. Discover all available endpoints
3. Test authentication mechanisms
4. Check for rate limiting
5. Test for IDOR (Insecure Direct Object References)
6. Look for excessive data exposure
7. Test for injection vulnerabilities
8. Check API versioning and test old versions for vulnerabilities
9. Verify CORS configuration
10. Test for JWT vulnerabilities if applicable
Exercise 5.3: Cloud Infrastructure Detection
Prompt:
Scan example-target.com to identify if they're using cloud infrastructure (AWS, Azure, GCP). Look for:
- Cloud-specific IP ranges
- S3 buckets or blob storage
- Cloud-specific services (CloudFront, Azure CDN, etc.)
- Misconfigured cloud resources
- Storage bucket permissions
- Cloud metadata services exposure
Exercise 5.4: IoT and Embedded Device Discovery
Prompt:
Scan the network 192.168.1.0/24 for IoT and embedded devices such as:
- IP cameras
- Smart TVs
- Printers
- Network attached storage (NAS)
- Home automation systems
- Industrial control systems (ICS/SCADA if applicable)
Check each device for:
- Default credentials
- Outdated firmware
- Unencrypted communications
- Exposed management interfaces
Exercise 5.5: Checking for Known Vulnerabilities and Old Software
Prompt:
Perform a comprehensive audit of example-target.com focusing on outdated and vulnerable software:
1. Detect exact versions of all running services
2. For each service, check if it's end-of-life (EOL)
3. Identify known CVEs for each version detected
4. Prioritize findings by:
- CVSS score
- Exploit availability
- Exposure (internet-facing vs internal)
5. Check for:
- Outdated TLS/SSL versions
- Deprecated cryptographic algorithms
- Unpatched web frameworks
- Old CMS versions (WordPress, Joomla, Drupal)
- Legacy protocols (SSLv3, TLS 1.0, weak ciphers)
6. Generate a remediation roadmap with version upgrade recommendations
Expected approach:
# Detailed version detection
nmap -sV --version-intensity 9 example-target.com
# Check for versionable services
nmap --script version,http-server-header,http-generator example-target.com
# SSL/TLS testing
nmap -p 443 --script ssl-cert,ssl-enum-ciphers,sslv2,ssl-date example-target.com
# CMS detection
nmap -p 80,443 --script http-wordpress-enum,http-joomla-brute,http-drupal-enum example-target.com
Claude will then analyze the results and provide:
- A table of detected software with current versions and latest versions
- CVE listings with severity scores
- Specific upgrade recommendations
- Risk assessment for each finding
Part 6: Advanced Tips and Techniques
6.1 Optimizing Scan Performance
Timing Templates:
-T0(Paranoid): Extremely slow, for IDS evasion-T1(Sneaky): Slow, minimal detection risk-T2(Polite): Slower, less bandwidth intensive-T3(Normal): Default, balanced approach-T4(Aggressive): Faster, assumes good network-T5(Insane): Extremely fast, may miss results
Prompt:
Explain when to use each NMAP timing template and demonstrate the difference by scanning example-target.com with T2 and T4 timing.
6.2 Evading Firewalls and IDS
Prompt:
Scan example-target.com using techniques to evade firewalls and intrusion detection systems:
- Fragment packets
- Use decoy IP addresses
- Randomize scan order
- Use idle scan if possible
- Spoof MAC address (if on local network)
- Use source port 53 or 80 to bypass egress filtering
Expected command examples:
# Fragmented packets
nmap -f example-target.com
# Decoy scan
nmap -D RND:10 example-target.com
# Randomize hosts
nmap --randomize-hosts example-target.com
# Source port spoofing
nmap --source-port 53 example-target.com
6.3 Creating Custom NSE Scripts with Claude
Prompt:
Help me create a custom NSE script that checks for a specific vulnerability in our custom application running on port 8080. The vulnerability is that the /debug endpoint returns sensitive configuration data without authentication.
Claude can help you write Lua scripts for NMAP’s scripting engine!
6.4 Output Parsing and Reporting
Prompt:
Scan example-target.com and save results in all available formats (normal, XML, grepable, script kiddie). Then help me parse the XML output to extract just the critical and high severity findings for a report.
Expected command:
nmap -oA scan_results example-target.comClaude can then help you parse the XML file programmatically.
Part 7: Responsible Disclosure and Next Steps
After Finding Vulnerabilities
- Document everything: Keep detailed records of your findings
- Prioritize by risk: Use CVSS scores and business impact
- Responsible disclosure: Follow the organization’s security policy
- Remediation tracking: Help create an action plan
- Verify fixes: Re-test after patches are applied
Using Claude for Post-Scan Analysis
Prompt:
I've completed my NMAP scans and found 15 vulnerabilities. Here are the results: [paste scan output].
Please:
1. Categorize by severity (Critical, High, Medium, Low, Info)
2. Explain each vulnerability in business terms
3. Provide remediation steps for each
4. Suggest a remediation priority order
5. Draft an executive summary for management
6. Create technical remediation tickets for the engineering team
Claude excels at translating technical scan results into actionable business intelligence.
Part 8: Continuous Monitoring with NMAP and Claude
Set up regular scanning routines and use Claude to track changes:
Prompt:
Create a baseline scan of example-target.com and save it. Then help me set up a cron job (or scheduled task) to run weekly scans and alert me to any changes in:
- New open ports
- Changed service versions
- New hosts discovered
- Changes in vulnerabilities detected
Conclusion
Combining NMAP’s powerful network scanning capabilities with Claude’s AI-driven analysis creates a formidable security assessment toolkit. The Model Context Protocol bridges these tools seamlessly, allowing you to:
- Express complex scanning requirements in natural language
- Get intelligent interpretation of scan results
- Receive contextual security advice
- Automate repetitive reconnaissance tasks
- Learn security concepts through interactive exploration
Key Takeaways:
- Always get permission before scanning any network or system
- Start with gentle scans and progressively get more aggressive
- Use timing controls to avoid overwhelming targets or triggering alarms
- Correlate multiple scans for a complete security picture
- Leverage Claude’s knowledge to interpret results and suggest next steps
- Document everything for compliance and knowledge sharing
- Keep NMAP updated to benefit from the latest scripts and capabilities
The examples provided in this guide demonstrate just a fraction of what’s possible when combining NMAP with AI assistance. As you become more comfortable with this workflow, you’ll discover new ways to leverage Claude’s understanding to make your security assessments more efficient and comprehensive.
Additional Resources
- Official NMAP Documentation
- NMAP NSE Script Library
- Model Context Protocol Specification
- OWASP Testing Guide
- CVE Database
- National Vulnerability Database
About the Author: This guide was created to help security professionals and system administrators leverage AI assistance for more effective network reconnaissance and vulnerability assessment.
Last Updated: 2025-11-21
Version: 1.0