Sunday, June 4, 2023

Nmap: Getting Started Guide


Nmap is a free utility tool for network discovery, port scanning and security auditing, even though we can use it for more than that but in this article we will learn how to do these three things with nmap.

The original author of nmap is Gordon Lyon (Fyodor). Nmap is licensed under GPL v2 and has available ports in many different languages. Nmap is available for Linux, Windows, and Mac OS X. You can download your copy of nmap from their website.

Lets get started with nmap.

When performing pentests we always look for networks we are going to attack. We need to identify live hosts on the network so that we can attack them. There are plenty of tools available for finding live hosts on a network but nmap is one of the best tools for doing this job.

Lets start with simple host (target) discovery scans i,e scans that will tell us which ip address is up on our target network. Those ip addresses which are up on our target network are the ones that are assigned to a device connected on our target network. Every device on the network is going to have a unique ip address.
To perform a simple host discovery scan we use the following command

nmap -v -sn 10.10.10.0/24




flags we used in the above command are
-v for verbose output
-sn to disable port scan (we don't want to scan for ports right now)

Following the flags is the ip address of the target network on which we want to look for live hosts. The /24 at the end of the ip address is the CIDR that specifies the subnet of the network on which we are looking for live hosts.

After running the above command you should get a list of live hosts on your target network.
If you just want to know the list of ip addresses your command is going to scan, you can use the -sL flag of the nmap like this.

nmap -sL 10.10.10.0/24

this command will simply output the list of ip addresses to scan.

We sometimes want to do dns resolution (resolving ip addresses to domain names) when performing our network scans and sometimes we don't want dns resolution. While performing a host discovery scan with nmap if we want to perform dns resolution we use -R flag in our command like this:

nmap -v -sn -R 10.10.10.0/24

And if we don't want to perform dns resolution of hosts during our scan we add the -n flag to our command like this:

nmap -v -sn -n 10.10.10.0/24

After we have discovered the hosts that are up on our target network, we usually put the ip addresses of these hosts into a file for further enumeration.

Next step in our enumeration would be to detect which operating system and which ports are running on these live hosts, for that we run this command:

nmap -O -v 10.10.10.119


here we use -O (capital o not zero) for operating system detection and by default nmap performs SYN Scan for port discovery. However nmap scans for 1000 ports only by default of a particular host.

To make nmap go over a list of ip addresses in a file we use -iL flag like this:

nmap -O -v -iL targetlist

where targetlist is the name of the file which contains ip addresses that we want to perform port scan on.

To make nmap scan all the ports of a target we use the -p flag like this:

nmap -p- -v 10.10.10.121

We can also specify a range of ports using the -p flag like this:

nmap -p1-500 -v 10.10.10.121

here 1-500 means scan all the ports from 1 to 500.

We can use a number of scan techniques to discover open ports on our network but I will only discuss some of them for brevity.

We can perform a TCP SYN scan using nmap with -sS flag like this:

nmap -sS -v 10.10.10.150

We have also flags for TCP connect and ACK scans which are -sT -sA

nmap -sT -v 10.10.10.150

nmap -sA -v 10.10.10.150

We can also perform UDP scan as well instead of TCP scan using -sU flag

nmap -sU -v 10.10.10.150

We can perform TCP Null, FIN, and Xmas scans using the flags -sN, -sF, -sX

nmap -sN -v 10.10.10.150

nmap -sF -v 10.10.10.150

nmap -sX -v 10.10.10.150

If you don't know what these scans are then please visit Port Scanning Techniques and Algorithms for explanation.

After discovering the open ports on our target host, we want to enumerate what services are running on those open ports. To enumerate services and versions information on open ports we use the -sV flag like this:

nmap -sV -v 10.10.10.118

This should give us information about what services are running on what ports and what versions of those services are running on the target host.

nmap has an interesting feature called NSE nmap scripting engine. It allows users to write their own scripts, using the Lua programming language, to automate a wide variety of networking tasks. nmap ships with a diverse set of scripts which are very helpful to enumerate a target. To use the nmap default set of scripts while enumerating the target, we use the -sC flag like this:

nmap -sC -sV -v 10.10.10.118

We can also save the results of our nmap scans to a file using the -o flag like this

nmap -sC -sV -v -oA defaultscan 10.10.10.119

here -oA tells the nmap to output results in the three major formats at once and defaultscan is the name of the file that will be prepended to all the three output files.

This is the end of this short tutorial see you next time.

References:
https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Related word

  1. What Is Hacking Tools
  2. Hacking Tools 2020
  3. Hacker Tools Free Download
  4. Hack Tools Download
  5. Pentest Tools Apk
  6. Hacking Tools 2019
  7. Pentest Tools Github
  8. How To Hack
  9. Pentest Tools Kali Linux
  10. Hacks And Tools
  11. Hacking Tools For Games
  12. Hacker Tools Linux
  13. Hackrf Tools
  14. Hacker Tools
  15. Hacker Tools 2020
  16. Pentest Tools Review
  17. Hacker Tools Linux
  18. Bluetooth Hacking Tools Kali
  19. Hack Tools Pc
  20. Hack Rom Tools
  21. Pentest Recon Tools
  22. Hack Tools Mac
  23. Hacking Tools For Pc
  24. Top Pentest Tools
  25. Pentest Tools Alternative
  26. Nsa Hacker Tools
  27. Pentest Tools
  28. Pentest Tools For Windows
  29. How To Make Hacking Tools
  30. Wifi Hacker Tools For Windows
  31. Hackrf Tools
  32. Pentest Tools Kali Linux
  33. Tools Used For Hacking
  34. Termux Hacking Tools 2019
  35. How To Install Pentest Tools In Ubuntu
  36. Hack Tools For Windows
  37. Hacking Tools Hardware
  38. Hacker Tools Mac
  39. Pentest Tools For Android
  40. Hack Tools 2019
  41. Install Pentest Tools Ubuntu
  42. Hacker Tools
  43. Hacking Tools Name
  44. Hacker Techniques Tools And Incident Handling
  45. Android Hack Tools Github
  46. Hacker Tools Github
  47. Hack Tools
  48. Tools Used For Hacking
  49. Pentest Tools Nmap
  50. Hacking Tools Windows 10
  51. Hacking Tools Hardware
  52. Pentest Tools Tcp Port Scanner
  53. Hack Tools For Ubuntu
  54. Pentest Tools Website Vulnerability
  55. Hacker Tool Kit
  56. Hack Tools For Games
  57. Hacking Tools Free Download
  58. Hacker Tools For Ios
  59. Hacker Tools Free
  60. World No 1 Hacker Software
  61. Pentest Tools For Mac
  62. Hacking Tools Online
  63. Hacking App
  64. Hacking Tools Windows
  65. Hacker
  66. Hacker Tools For Ios
  67. Hacking Tools
  68. Tools For Hacker
  69. New Hacker Tools
  70. Ethical Hacker Tools
  71. Hacking Tools For Windows Free Download
  72. Wifi Hacker Tools For Windows
  73. Pentest Tools Android
  74. Hacking Apps
  75. Nsa Hack Tools
  76. Hacking Tools For Pc
  77. Hacking Apps
  78. Pentest Tools Linux
  79. Kik Hack Tools
  80. Hacking Tools For Beginners
  81. Hacking Tools Windows 10
  82. Nsa Hack Tools Download
  83. Pentest Tools Bluekeep
  84. Hacker Tools For Ios
  85. Hacking Tools Free Download
  86. How To Make Hacking Tools
  87. Hacks And Tools
  88. Hacking Tools Windows 10
  89. Pentest Tools Free
  90. Pentest Tools Url Fuzzer
  91. Beginner Hacker Tools
  92. Black Hat Hacker Tools
  93. Hacker Tools Software
  94. Usb Pentest Tools
  95. Hacker Tools Github
  96. Hack Tools Github
  97. Hacking Tools For Beginners
  98. Hacking App
  99. Hacking Tools For Games
  100. Hacking Tools Usb
  101. Hacking Tools Download
  102. Pentest Tools Framework
  103. Beginner Hacker Tools
  104. Hacking Tools Download
  105. Hacking Tools For Windows
  106. Hacking Tools For Mac
  107. Kik Hack Tools
  108. How To Install Pentest Tools In Ubuntu
  109. Pentest Recon Tools
  110. Install Pentest Tools Ubuntu
  111. Pentest Tools Download
  112. Hacker Hardware Tools
  113. Best Hacking Tools 2020
  114. Hacker Tools Windows
  115. Usb Pentest Tools
  116. Hack And Tools
  117. Pentest Tools For Ubuntu
  118. Hack Tools
  119. Hacking Tools Download
  120. Tools 4 Hack
  121. Hacker Security Tools
  122. Hacker Tools For Windows
  123. Hack Tools 2019
  124. Pentest Tools Android
  125. Hacking Tools Usb
  126. Tools 4 Hack
  127. Hacker Tools Hardware
  128. Bluetooth Hacking Tools Kali
  129. Hacking Tools
  130. Hacker Tools Linux
  131. Hacker Search Tools
  132. Hack And Tools
  133. Tools 4 Hack
  134. Hacking Tools 2019
  135. Hacker Tools Hardware
  136. Hacking Tools
  137. Hacker Tools 2019
  138. Game Hacking
  139. Pentest Tools Android
  140. Top Pentest Tools
  141. Wifi Hacker Tools For Windows
  142. Hacking Tools For Windows 7
  143. Hacking Tools For Windows
  144. Hacker Tools For Windows
  145. Hacker Tools Apk Download
  146. Hack Tools
  147. Hack And Tools
  148. Pentest Tools For Ubuntu
  149. Computer Hacker
  150. Hacking Tools Download
  151. Tools 4 Hack
  152. Pentest Tools Apk
  153. Hacking Tools Pc
  154. Pentest Tools For Windows
  155. Install Pentest Tools Ubuntu
  156. Hacking Tools For Mac
  157. Hacking Tools Download
  158. Physical Pentest Tools
  159. Hack And Tools
  160. Hacker Tools Mac
  161. Hacking Tools Usb
  162. Pentest Tools Online
  163. Pentest Tools Website Vulnerability
  164. Hacking Tools Download
  165. Usb Pentest Tools
  166. Hacker Hardware Tools
  167. Hacking Tools Name
  168. Hacking Tools For Beginners
  169. Pentest Tools For Windows

No comments: