Notes by mraabo

Network Mapper (Nmap)

Properties1
tagscomputer-security, computer-networking

Open-source network scanner that can perform:

  • Host discovery
  • Port scanning
  • Service enumeration and detection
  • OS detection
  • Scriptable interaction with the target service (Nmap Scripting Engine)

Defaults

Nmap will only scan the 1000 most common ports by default.

By default ICMP Echo-Request packets (-sn) are used for host discovery. If the target Host is on local Ethernet then it will use ARP.

TCP-syn scan (-sS) is performed by default if we are root, otherwise a TCP-scan (-sT) is default.

A reverse DNS resolution (over UDP port 53) is performed unless otherwise specified.

Ports with state closed are usually not shown in results.

Port Scanning

The possible scan types are:

TCP-SYN(-sS)

The default port scanning method when using nmap as root, as it requires privileges to construct Packets manually rather than going through the OS’s normal networking stack.

It sends one TCP Packet with a SYN-flag and never completes the Three-Way Handshake. This incomplete connection is less likely to be logged on the host making this can more stealthy than the TCP-Connect scan.

The flags in the response can then determine the state of the port:

  • SYN-ACK: the port is open.
  • RST: The packet is rejected meaning that the port is closed.
  • No response: the port is filtered indicating that a firewall might have dropped our SYN or the SYN-ACK from the host.

If a SYN-ACK is received the handshake is interrupted by sending a RST packet.

TCP-Connect(-sT)

The default port scanning method when not running nmap as root.

It works like TCP-SYN but completes the TCP Three-Way Handshake, which makes it less stealthy since a complete connection is more likely to generate a log entry on a host.

TCP-ACK(-sA)

Sends a TCP Packet with only the ACK flag set.

Are harder to filter for firewalls than the other TCP-scans because the firewall cannot determine if the ACK comes from a already established connection from the internal or external network.

UDP(-sU)

Scan UDP ports, which takes longer because the timeout is longer than TCP as there is no Three-Way Handshake.

It has the disadvantage of only receiving a response if the application is configured to respond to the empty Datagrams being send in this scan.

The state of the ports are inferred by the following ICMP response:

  • Error code 3: the port is closed.
  • Other responses: the port is open|filtered.

Scripts

The nmap Scripting Engine (NSE) allows users to run custom or pre-built scripts to perform more advanced tasks like vulnerability detection, service enumeration, and network discovery.

These scripts are build with Lua.

Categories

The scripts are divided into 14 categories:

  • auth: Determination of authentication credentials.
  • broadcast: Scripts, which are used for host discovery by broadcasting and the discovered hosts, can be automatically added to the remaining scans.
  • brute: Executes scripts that try to log in to the respective service by brute-forcing with credentials.
  • default: Default scripts executed by using the -sC option.
  • discovery: Evaluation of accessible services.
  • dos: These scripts are used to check services for denial of service vulnerabilities and are used less as it harms the services.
  • exploit: This category of scripts tries to exploit known vulnerabilities for the scanned port.
  • external: Scripts that use external services for further processing.
  • fuzzer: This uses scripts to identify vulnerabilities and unexpected packet handling by sending different fields, which can take much time.
  • intrusive: Intrusive scripts that could negatively affect the target system.
  • malware: Checks if some malware infects the target system.
  • safe: Defensive scripts that do not perform intrusive and destructive access.
  • version: Extension for service detection.
  • vuln: Identification of specific vulnerabilities.

http-enum

The http-enum script enumerates directories used by popular web applications and servers.

Commands

nmap [options] <IP>

Options

General

  • -sV: service version detection using banners of ports and if this fails it uses a signature-based matching system.
  • -iL <hostlist file>.lst: perform scans on file list of IP-addresses.
  • -O: OS-detection.
  • -A: aggressive option that scans the target with -sV, -O, -sC, and --trace-route.

Scan status

  • <SPACE BAR> during scan: show scan status.
  • --stats-every=<integer><s/m>: show scan status every <integer> seconds if s or minutes for m.

Port scanning

  • -p-: scan all ports (1-65535).
  • -p <port>: specify port(s).
  • -sn: disables port scanning.

Scripts

  • -sC: run default scripts listed here.
  • --script <script name1>, <script name2>: run particular NSE script(s).
  • --script <catagory>: run scripts from a specific category (see section for more detail).

Verbosity

  • --packet-trace: shows all packets sent and received.
  • --reason: displays the reason for specific result, e.g. how nmap determined that a host is up.
  • -v: increase verbosity and display open ports as soon as they are detected.
  • -vv: increase verbosity even more and also display open ports as soon as they are detected.

Bypass security

  • -D: spoof the source IP of its packets by adding one or more decoy addresses.
  • --dns-server: specify DNS server, e.g. one more trusted by the host.
  • --source-port: specify source Port of scanner Packets, e.g. (TCP port 53 used for DNS that a firewall might not filter.

Disable defaults

  • -Pn: disable ICMP echo request.
  • -n: disable DNS resolution.
  • --disable-arp-ping: disable ARP ping scan.

Saving results

  • -oN <filename>: save in normal output format (.nmap) that be displayed with cat.
  • -oG <filename>: save in output that can be searched with grep (.gnmap).
  • -oX <filename>: save as .xml file that can be rendered into HTTP with xsltproc.
  • -oA <filename>: save in all of the above format.

Graph View

Backlinks