A write-up from my cybersecurity self-study — August 2026
Why I did this room
As part of building on my Cyber Security degree with hands-on practice, I completed the Nmap room on TryHackMe. Nmap (Network Mapper) is one of the most widely used tools in the industry for network discovery and security auditing, and it’s referenced constantly in job specs for SOC analyst and IT support roles — so I wanted to move from knowing it in theory to actually using it.
What the room covered
The room walked through Nmap from first principles:
• Deploying a target machine and connecting to it safely within TryHackMe’s isolated lab environment
• Core Nmap switches — the command-line flags that control how a scan behaves, from basic host discovery to more detailed service enumeration
• Scan types — understanding the difference between a full TCP Connect scan (which completes the standard three-way TCP handshake) versus faster or stealthier scan techniques, and why a security professional would choose one over another depending on the situation
• Interpreting scan output — reading which ports are open, closed, or filtered, and what that tells you about a machine’s exposed services
What I actually learned
Going in, I understood scanning conceptually from my degree modules on network security. What this room added was the practical side:
• Why scan type matters, not just that it exists. A TCP Connect scan is reliable and doesn’t require special privileges, but it’s also the “noisiest” — it completes full connections, which shows up clearly in logs. That’s a useful thing to know both offensively (as a pentester trying to stay quiet) and defensively (as someone who might be reading those logs on the other end).
• Reading command syntax is a skill in itself. Nmap has a huge number of flags, and the room forced me to actually parse documentation and combine switches correctly rather than copy-pasting a single command.
• Recon is the first step of almost everything in security. Whether you’re attacking or defending, you can’t secure — or exploit — what you don’t know exists on a network. This room made that idea concrete rather than just a line in a textbook.
Where I’d take this next
This was an introductory room, so the natural next step is applying Nmap against a slightly more complex target — ideally one where I also have to interpret the results to figure out what service is running and whether it’s outdated or misconfigured. I’m planning to follow this up with a room that builds on scanning into basic vulnerability identification.
Takeaway
Recon sounds abstract until you actually run a scan and watch a black box turn into a list of open ports and services. That shift — from “I know this exists” to “I have used this” — is exactly why I’m working through these rooms alongside my job search.
