Nmap is a free utility tool for network discovery, port scanning and security auditing, even though we can use it for more than that but in this article we will learn how to do these three things with nmap.
The original author of nmap is Gordon Lyon (Fyodor). Nmap is licensed under GPL v2 and has available ports in many different languages. Nmap is available for Linux, Windows, and Mac OS X. You can download your copy of nmap from their website.
Lets get started with nmap.
When performing pentests we always look for networks we are going to attack. We need to identify live hosts on the network so that we can attack them. There are plenty of tools available for finding live hosts on a network but nmap is one of the best tools for doing this job.
Lets start with simple host (target) discovery scans i,e scans that will tell us which ip address is up on our target network. Those ip addresses which are up on our target network are the ones that are assigned to a device connected on our target network. Every device on the network is going to have a unique ip address.
To perform a simple host discovery scan we use the following command
nmap -v -sn 10.10.10.0/24
flags we used in the above command are
-v for verbose output
-sn to disable port scan (we don't want to scan for ports right now)
Following the flags is the ip address of the target network on which we want to look for live hosts. The /24 at the end of the ip address is the CIDR that specifies the subnet of the network on which we are looking for live hosts.
After running the above command you should get a list of live hosts on your target network.
If you just want to know the list of ip addresses your command is going to scan, you can use the -sL flag of the nmap like this.
nmap -sL 10.10.10.0/24
this command will simply output the list of ip addresses to scan.
We sometimes want to do dns resolution (resolving ip addresses to domain names) when performing our network scans and sometimes we don't want dns resolution. While performing a host discovery scan with nmap if we want to perform dns resolution we use -R flag in our command like this:
nmap -v -sn -R 10.10.10.0/24
And if we don't want to perform dns resolution of hosts during our scan we add the -n flag to our command like this:
nmap -v -sn -n 10.10.10.0/24
After we have discovered the hosts that are up on our target network, we usually put the ip addresses of these hosts into a file for further enumeration.
Next step in our enumeration would be to detect which operating system and which ports are running on these live hosts, for that we run this command:
nmap -O -v 10.10.10.119
here we use -O (capital o not zero) for operating system detection and by default nmap performs SYN Scan for port discovery. However nmap scans for 1000 ports only by default of a particular host.
To make nmap go over a list of ip addresses in a file we use -iL flag like this:
nmap -O -v -iL targetlist
where targetlist is the name of the file which contains ip addresses that we want to perform port scan on.
To make nmap scan all the ports of a target we use the -p flag like this:
nmap -p- -v 10.10.10.121
We can also specify a range of ports using the -p flag like this:
nmap -p1-500 -v 10.10.10.121
here 1-500 means scan all the ports from 1 to 500.
We can use a number of scan techniques to discover open ports on our network but I will only discuss some of them for brevity.
We can perform a TCP SYN scan using nmap with -sS flag like this:
nmap -sS -v 10.10.10.150
We have also flags for TCP connect and ACK scans which are -sT -sA
nmap -sT -v 10.10.10.150
nmap -sA -v 10.10.10.150
We can also perform UDP scan as well instead of TCP scan using -sU flag
nmap -sU -v 10.10.10.150
We can perform TCP Null, FIN, and Xmas scans using the flags -sN, -sF, -sX
nmap -sN -v 10.10.10.150
nmap -sF -v 10.10.10.150
nmap -sX -v 10.10.10.150
If you don't know what these scans are then please visit Port Scanning Techniques and Algorithms for explanation.
After discovering the open ports on our target host, we want to enumerate what services are running on those open ports. To enumerate services and versions information on open ports we use the -sV flag like this:
nmap -sV -v 10.10.10.118
This should give us information about what services are running on what ports and what versions of those services are running on the target host.
nmap has an interesting feature called NSE nmap scripting engine. It allows users to write their own scripts, using the Lua programming language, to automate a wide variety of networking tasks. nmap ships with a diverse set of scripts which are very helpful to enumerate a target. To use the nmap default set of scripts while enumerating the target, we use the -sC flag like this:
nmap -sC -sV -v 10.10.10.118
We can also save the results of our nmap scans to a file using the -o flag like this
nmap -sC -sV -v -oA defaultscan 10.10.10.119
here -oA tells the nmap to output results in the three major formats at once and defaultscan is the name of the file that will be prepended to all the three output files.
This is the end of this short tutorial see you next time.
References:
https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Related word
- Github Hacking Tools
- Pentest Tools Url Fuzzer
- Pentest Reporting Tools
- New Hacker Tools
- Pentest Tools For Android
- Github Hacking Tools
- Underground Hacker Sites
- Pentest Tools List
- Hacker Tool Kit
- Hack Tools Online
- Hacking Tools For Windows Free Download
- Hack Tools For Windows
- Hacking Tools Windows 10
- Hacker Tools
- Pentest Tools Github
- Pentest Tools Android
- Hacking App
- Android Hack Tools Github
- Tools 4 Hack
- Hacker Search Tools
- Hack Apps
- Hack Website Online Tool
- Hacker Tools Hardware
- Hack Tools Pc
- Computer Hacker
- Hack Tools For Mac
- Hack Website Online Tool
- Pentest Automation Tools
- Hacker Tools Windows
- Hackrf Tools
- Nsa Hack Tools
- Underground Hacker Sites
- Best Hacking Tools 2019
- Hack Tool Apk
- Pentest Tools Free
- Best Pentesting Tools 2018
- Hacker Tools Hardware
- Hacker Tools List
- Top Pentest Tools
- Hack Tools
- Hacker Tools 2020
- Pentest Tools Find Subdomains
- Hack Tools 2019
- Hack Tools
- Hacking Tools For Windows
- Termux Hacking Tools 2019
- Hacker Tools For Windows
- Hacking Tools For Mac
- Hacking Tools Free Download
- Hack Tools For Ubuntu
- World No 1 Hacker Software
- Pentest Tools Download
- Hacker Tools List
- Hacking Tools For Windows Free Download
- How To Make Hacking Tools
- Hacking Tools Kit
- Hack Tools Pc
- Pentest Tools Open Source
- Hack Tools For Pc
- Pentest Tools Windows
- Pentest Tools Windows
- Hacking Tools Github
- Bluetooth Hacking Tools Kali
- Pentest Tools Port Scanner
- Hacking Tools For Windows 7
- Pentest Reporting Tools
- Hacker Tools For Pc
- Pentest Tools Website Vulnerability
- Pentest Tools Website Vulnerability
- Pentest Tools For Mac
- Hacker Tools Apk
- Bluetooth Hacking Tools Kali
- Hack Tools Pc
- Hacker Tools Software
- Hacker Tools Mac
- Computer Hacker
- Hacker Tools Online
- Hacking Tools Software
- How To Make Hacking Tools
- Hacking Apps
- Termux Hacking Tools 2019
- Pentest Tools For Mac
- Tools 4 Hack
- Hack Tools
- Hacking Tools Github
- Hacking Tools Free Download
- Hack Tools
- Pentest Tools Open Source
- Hacking Tools For Windows
- Hacker Tools 2020
- World No 1 Hacker Software
- Computer Hacker
- Pentest Tools Download
- Free Pentest Tools For Windows
- Hacks And Tools
- Pentest Automation Tools
- How To Make Hacking Tools
- Ethical Hacker Tools
- Hacker Tools Online
- Hacking Tools For Mac
- Hacking Tools 2019
- Best Hacking Tools 2019
- Hack Tools For Pc
- Hack Apps
- Hacker Tool Kit
- Hack Tools For Mac
- Nsa Hack Tools
- Hack Tools
- Pentest Tools For Windows
- Pentest Tools Windows
- Hacker Tools List
- Hacking Tools Windows 10
- Pentest Tools Open Source
- Pentest Tools Kali Linux
- Hak5 Tools
- Pentest Reporting Tools
- Hacker Techniques Tools And Incident Handling
- Wifi Hacker Tools For Windows
- Hacks And Tools
- Bluetooth Hacking Tools Kali
- Hak5 Tools
- Pentest Tools Free
- Hacking Tools For Windows
- Pentest Tools Framework
- Hacking Tools For Games
- Pentest Tools Bluekeep
- Hack Tool Apk
- Pentest Tools Nmap
- Hak5 Tools
- Blackhat Hacker Tools
- Computer Hacker
- Pentest Tools For Mac
- Hack Tools For Pc
- Hack Rom Tools
- Tools Used For Hacking
- Easy Hack Tools
- Hacking Tools For Games
- Tools For Hacker
- Bluetooth Hacking Tools Kali
- Kik Hack Tools
- Hack Tools Mac
- Black Hat Hacker Tools
- Pentest Tools Nmap
- Termux Hacking Tools 2019
- Hack And Tools
- Hacker Tool Kit
- Hacking Tools Name
- Pentest Tools Nmap
- Nsa Hack Tools
- World No 1 Hacker Software
- Hack Rom Tools
- Hack And Tools
- Hacking Tools Software
- Hacking Tools Hardware
- Hacker Tools Free
- Hack Tools Download
- Tools For Hacker
- Hacking Tools Name
- Hack Tool Apk No Root
- Top Pentest Tools
- Github Hacking Tools
- Pentest Tools Port Scanner
No comments:
Post a Comment