Network Mapper (Nmap)
Simply, Nmap is a network exploration tool that can be used to scan the ports (TCP/UDP) that the hosts are listening on. Nmap allows network admins to find which devices are running on their network, discover open ports and services, and detect vulnerabilities.
It is open source Linux command line tool that is
- Used to scan a single host single port to multiple hosts multiple ports
- Used to determine the services hosted on certain ports by the server
Nmap has become hugely popular, being featured in movies like The Matrix and the popular series Mr. Robot.
Nmap is ..
- Flexible: Supports many port scanning mechanisms (both TCP & UDP), OS detection, version detection, and more.
- Powerful: Nmap has been used to scan huge networks of literally hundreds of thousands of machines.
- Easy: While Nmap offers a rich set of advanced features for power users, you can start out as simply as “nmap -v -A targethost”.
- Free and Open Source: The primary goals of the Nmap Project is to help make the Internet a little more secure and to provide administrator with an tool for exploring their networks.
Host: The computer, server, or device on a network identified by an IP address or domain name (e.g.,
192.168.1.1orexample.com).Port: A logical number from
0to65535that directs incoming data to a specific application or service running on that host (e.g.,80for HTTP or443for HTTPS).
For detailed overview please refer to https://nmap.org/book/man-briefoptions.html
Summary:
From man page of nmap, the most commonly used flags are:
Nmap 7.99SVN ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION: Can pass hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
-iL <inputfilename>: Input from list of hosts/networks
-iR <num hosts>: Choose random targets
--exclude <host1[,host2][,host3],...>: Exclude hosts/networks
--excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
-sL: List Scan - simply list targets to scan
-sn: Ping Scan - disable port scan
-Pn: Treat all hosts as online -- skip host discovery
-PS/PA/PU/PY[portlist]: TCP SYN, TCP ACK, UDP or SCTP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
-PO[protocol list]: IP Protocol Ping
-n/-R: Never do DNS resolution/Always resolve [default: sometimes]
--dns-servers <serv1[,serv2],...>: Specify custom DNS servers
--system-dns: Use OS's DNS resolver
--traceroute: Trace hop path to each host
SCAN TECHNIQUES:
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
-sU: UDP Scan
-sN/sF/sX: TCP Null, FIN, and Xmas scans
--scanflags <flags>: Customize TCP scan flags
-sI <zombie host[:probeport]>: Idle scan
-sY/sZ: SCTP INIT/COOKIE-ECHO scans
-sO: IP protocol scan
-b <FTP relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
-p <port ranges>: Only scan specified ports
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
--exclude-ports <port ranges>: Exclude the specified ports from scanning
-F: Fast mode - Scan fewer ports than the default scan
-r: Scan ports sequentially - don't randomize
--top-ports <number>: Scan <number> most common ports
--port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
-sV: Probe open ports to determine service/version info
--version-intensity <level>: Set from 0 (light) to 9 (try all probes)
--version-light: Limit to most likely probes (intensity 2)
--version-all: Try every single probe (intensity 9)
--version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
-sC: equivalent to --script=default
--script=<Lua scripts>: <Lua scripts> is a comma separated list of
directories, script-files or script-categories
--script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
--script-args-file=filename: provide NSE script args in a file
--script-trace: Show all data sent and received
--script-updatedb: Update the script database.
--script-help=<Lua scripts>: Show help about scripts.
<Lua scripts> is a comma-separated list of script-files or
script-categories.
OS DETECTION:
-O: Enable OS detection
--osscan-limit: Limit OS detection to promising targets
--osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
Options which take <time> are in seconds, or append 'ms' (milliseconds),
's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
-T<0-5>: Set timing template (higher is faster)
--min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
--min-parallelism/max-parallelism <numprobes>: Probe parallelization
--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
probe round trip time.
--max-retries <tries>: Caps number of port scan probe retransmissions.
--host-timeout <time>: Give up on target after this long
--scan-delay/--max-scan-delay <time>: Adjust delay between probes
--min-rate <number>: Send packets no slower than <number> per second
--max-rate <number>: Send packets no faster than <number> per second
FIREWALL/IDS EVASION AND SPOOFING:
-f; --mtu <val>: fragment packets (optionally w/given MTU)
-D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
-S <IP_Address>: Spoof source address
-e <iface>: Use specified interface
-g/--source-port <portnum>: Use given port number
--proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
--data <hex string>: Append a custom payload to sent packets
--data-string <string>: Append a custom ASCII string to sent packets
--data-length <num>: Append random data to sent packets
--ip-options <options>: Send packets with specified ip options
--ttl <val>: Set IP time-to-live field
--spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
--badsum: Send packets with a bogus TCP/UDP/SCTP checksum
OUTPUT:
-oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
and Grepable format, respectively, to the given filename.
-oA <basename>: Output in the three major formats at once
-v: Increase verbosity level (use -vv or more for greater effect)
-d: Increase debugging level (use -dd or more for greater effect)
--reason: Display the reason a port is in a particular state
--open: Only show open (or possibly open) ports
--packet-trace: Show all packets sent and received
--iflist: Print host interfaces and routes (for debugging)
--append-output: Append to rather than clobber specified output files
--resume <filename>: Resume an aborted scan
--noninteractive: Disable runtime interactions via keyboard
--stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
--webxml: Reference stylesheet from Nmap.Org for more portable XML
--no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
-6: Enable IPv6 scanning
-A: Enable OS detection, version detection, script scanning, and traceroute
--datadir <dirname>: Specify custom Nmap data file location
--send-eth/--send-ip: Send using raw ethernet frames or IP packets
--privileged: Assume that the user is fully privileged
--unprivileged: Assume the user lacks raw socket privileges
-V: Print version number
-h: Print this help summary page.
EXAMPLES:
nmap -v -A scanme.nmap.org
nmap -v -sn 192.168.0.0/16 10.0.0.0/8
nmap -v -iR 10000 -Pn -p 80
But we will be further expanding only mostly used commands that will help in your day to day life.
Nmap has a built-in help command that lists all the flags and options you can use. It is often handy given the number of command-line arguments Nmap comes with.
> nmap -hIf you don’t have Nmap installed, you can get it from here.
#For Ubuntu
>sudo apt update
>sudo apt install nmap
# For arch linux
>bash sudo pacman -S nmap
#Using dnf or yum for fedora, CentOs and RHEL
>bash sudo dnf install nmap
(or "sudo yum install nmap" on older system)
#For verification of installation
>nmap --version- Basic Scan: Scanning the list of active devices on a network is the first step in network mapping.
There are two types of scans you can use for that:
- Ping scan:- Scans the list of devices up and running on a given subnet.
> nmap -sP 192.168.1.1/24
For subnet on your modern linux command use “ip -o -f inet addr show”. Then look for section with eth0 or wlan0.
- Scan a single host:- Scans a single host for 1000 well-known ports. These ports are the ones used by popular services like SQL, SNTP, apache, and others.
> nmap scanme.nmap.org
Remember:
open→ A service is accepting connections.closed→ The host is reachable, but no service is listening on that port.filtered→ Nmap cannot determine the port's state because packet filtering or another network obstacle prevents a conclusive result.
2. Stealth scan:-
Stealth scanning is performed by sending an SYN packet and analyzing the response. If SYN/ACK is received, it means the port is open, and you can open a TCP connection.
However, a stealth scan never completes the 3-way handshake, which makes it hard for the target to determine the scanning system.
> nmap -sS scanme.nmap.orgStealth scanning is slower and not as aggressive as the other types of scanning, so you might have to wait a while to get a response
If your command line give o/p “You requested a scan type which requires root privileges. QUITTING!” the use command “ sudo !!” as it will run the previous command as super user command
3. Version Scanning:
Finding application versions is a crucial part in penetration testing as it makes your life easier since you can find an existing vulnerability from the Common Vulnerabilities and Exploits (CVE) database for a particular version of the service. You can then use it to attack a machine using an exploitation tool like Metasploit.
> nmap -sV scanme.nmap.orgDo keep in mind that version scans are not always 100% accurate, but it does take you one step closer to successfully getting into a system.
4. OS Scanning:-
Nmap can provide information about the underlying operating system using TCP/IP fingerprinting.
Get sufal kc’s stories in your inbox
Join Medium for free to get updates from this writer.
Nmap will also try to find the system uptime during an OS scan. It will display the confidence percentage for each OS guess.
> nmap -O scanme.nmap.orgOS detection is not always accurate, but it goes a long way towards helping a pen tester get closer to their target.
5. Aggressive Scanning
Nmap has an aggressive mode that enables OS detection, version detection, script scanning, and traceroute. You can use the -A argument to perform an aggressive scan.
> nmap -A scanme.nmap.orgAggressive scans provide far better information than regular scans.
Scanning Multiple Hosts
Nmap has the capability of scanning multiple hosts simultaneously. This feature comes in real handy when you are managing vast network infrastructure.
You can scan multiple hosts through numerous approaches:
- Write all the IP addresses in a single row to scan all of the hosts at the same time.
> nmap 192.164.1.1 192.164.0.2 192.164.0.2- Use the asterisk (*) to scan all of the subnets at once.
> nmap 192.164.1.*- Add commas to separate the addresses endings instead of typing the entire domains.
> nmap 192.164.0.1,2,3,4- Use a hyphen to specify a range of IP addresses
> nmap 192.164.0.0–255Port Scanning
Port scanning is one of the most fundamental features of Nmap. You can scan for ports in several ways.
- Using the -p param to scan for a single port
> nmap -p 973 192.164.0.1- If you specify the type of port, you can scan for information about a particular type of connection, for example for a TCP connection.
> nmap -p T:7777, 973 192.164.0.1For UDP connection replace T:7777 with U:port_no
- A range of ports can be scanned by separating them with a hyphen.
> nmap -p 76–973 192.164.0.1- You can also use the -top-ports flag to specify the top n ports to scan.
> nmap --top-ports 10 scanme.nmap.org
Scanning from a File
If you want to scan a large list of IP addresses, you can do it by importing a file with the list of IP addresses.
> nmap -iL /input.txtThe above command will produce the scan results of all the given domains in the “input.txt” file.
Exporting to file:
Nmap scans can also be exported to a text file. It will be slightly different from the original command line output, but it will capture all the essential scan results.
> nmap -oN output.txt scanme.nmap.orgFor exporting to XML.
> nmap -oX output.xml scanme.nmap.orgZenmap
Zenmap is a graphical user interface for Nmap. It is a free and open-source software that helps you get up and running with Nmap.
Source: https://maketecheasier.com/using-zenmap-on-linux/
In addition to providing visual network mappings, Zenmap also allows you to save and search your scans for future use.
Zenmap is great for beginners who want to test the capabilities of Nmap without going through a command-line interface.
Defending nmap scan
Source: https://maharjanurmila.com.np/tools/nmap/#defending-nmap-scan
- Open-source Intrusion Detection System(IDS) and Intrusion Prevention System(IPS) such as Snort and Suricata can be used to detect and block nmap scan.
- When multiple request packets to different ports of the server, from the same machine are detected, they block the IP address of the machine.
