Certified Noob - Question (Scanning own company network legally with NMAP)

Every org is different and you should only scan with explicit permission - generally, this means going through change control, making sure the people responsible for the environment know what scans you are going to do, what potential impact it has etc.

Depending where you live and on your corporate culture, getting this wrong can have serious side effects.

That said, if a system crashes when it is scanned, that’s a finding. If the system admins are too worried that a system might crash to allow scanning, that’s also a finding.

On a related topic, it is important that you understand what is happening with the scans you run. You can’t rely on blanket statements like “-sC might cause a crash” or “NSE scripts cause crashes” - because that doesn’t really help you, it just leads to “never use -sC/Scripts” or “always use -sV/Scripts”.

Take some time to understand how each scan type works and what each script does. For example, do they actually try to exploit a vulnerability or do they just send specific packets to see if a vulnerability exists? Few if any vuln scanners try to exploit in the way most people would describe exploit, but you cant make that assumption until you look at what the script does.