User Tools

Site Tools



Nmap Target Selection

Scan a single IPnmap
Scan a hostnmap
Scan a range of IPsnmap
Scan a subnetnmap
Scan targets from a text filenmap -iL list-of-ips.txt

These are all default scans, which will scan 1000 TCP ports.

Host discovery will take place.

Nmap Port Selection

Scan a single Portnmap -p 22
Scan a range of portsnmap -p 1-100
Scan 100 most common ports (Fast)nmap -F
Scan all 65535 portsnmap -p-

Nmap Port Scan types

Scan using TCP connectnmap -sT
Scan using TCP SYN scan (default)nmap -sS
Scan UDP portsnmap -sU -p 123,161,162
Scan selected ports - ignore discoverynmap -Pn -F

Privileged access is required to perform the default SYN scans.

If privileges are insufficient a TCP connect scan will be used.

A TCP connect requires a full TCP connection to be established and therefore is a slower scan.

Ignoring discovery is often required as many firewalls or hosts will not respond to PING, so could be missed unless you select the -Pn parameter.

Of course this can make scan times much longer as you could end up sending scan probes to hosts that are not there.

Service and OS Detection

Service and OS detection rely on different methods to determine the operating system or service running on a particular port.

The more aggressive service detection is often helpful if there are services running on unusual ports.

On the other hand the lighter version of the service will be much faster as it does not really attempt to detect the service simply grabbing the banner of the open service.

Detect OS and Servicesnmap -A
Standard service detectionnmap -sV
More aggressive Service Detectionnmap -sV –version-intensity 5
Lighter banner grabbing detectionnmap -sV –version-intensity 0

Nmap Output Formats

Save default output to filenmap -oN outputfile.txt
Save results as XMLnmap -oX outputfile.xml
Save results in a format for grepnmap -oG outputfile.txt
Save in all formatsnmap -oA outputfile

The default format could also be saved to a file using a simple file redirect command > file.

Using the -oN option allows the results to be saved but also can be monitored in the terminal as the scan is under way.

Digging deeper with NSE Scripts

Scan using default safe scriptsnmap -sV -sC
Get help for a scriptnmap –script-help=ssl-heartbleed
Scan using a specific NSE scriptnmap -sV -p 443 –script=ssl-heartbleed.nse
Scan with a set of scriptsnmap -sV –script=smb*

According to my Nmap install there are currently 581 NSE scripts. The scripts are able to perform a wide range of security related testing and discovery functions. If you are serious about your network scanning you really should take the time to get familiar with some of them.

The option –script-help=$scriptname will display help for the individual scripts. To get an easy list of the installed scripts try locate nse | grep script.

You will notice I have used the -sV service detection parameter. Generally most NSE scripts will be more effective and you will get better coverage by including service detection.

Search for DDOS reflection UDP services

Scan for UDP DDOS reflectorsnmap –sU –A –PN –n –pU:19,53,123,161 –script=ntp-monlist,dns-recursion,snmp-sysdescr

UDP based DDOS reflection attacks are a common problem that network defenders come up against. This is a handy Nmap command that will scan a target list for systems with open UDP services that allow these attacks to take place. Full details of the command and the background can be found on the Sans Institute Blog where it was first posted.

HTTP Service Information

Gather page titles from HTTP servicesnmap –script=http-title
Get HTTP headers of web servicesnmap –script=http-headers
Find web apps from known pathsnmap –script=http-enum

There are many HTTP information gathering scripts, here are a few that are simple but helpful when examining larger networks. Helps in quickly identifying what the HTTP service that is running on the open port. Note the http-enum script is particularly noisy. It is similar to Nikto in that it will attempt to enumerate known paths of web applications and scripts. This will inevitably generated hundreds of 404 HTTP responses in the web server error and access logs.

Detect Heartbleed SSL Vulnerability

Heartbleed Testingnmap -sV -p 443 –script=ssl-heartbleed

Heartbleed detection is one of the available SSL scripts. It will detect the presence of the well known Heartbleed vulnerability in SSL services. Specify alternative ports to test SSL on mail and other protocols (Requires Nmap 6.46).

IP Address information

Gather information related to the IP address and netblock owner of the IP address.

Uses ASN, whois and geoip location lookups. See the IP Tools for more information and similar IP address and DNS lookups.

Find Information about IP addressnmap –script=asn-query,whois,ip-geolocation-maxmind

nmap/nmap.txt · Last modified: 2020/07/15 10:30 by

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki