NMAP (Network Mapper) Host Discovery#

  • Nmap was created by Gordon Lyon (Fyodor), a network security expert and open source programmer. It was released in 1997. Nmap, short for Network Mapper, is free, open-source software released under GPL license. Nmap is an industry-standard tool for mapping networks, identifying live hosts, and discovering running services. Nmap’s scripting engine can further extend its functionality, from fingerprinting services to exploiting vulnerabilities.

Host Discovery Using ARP :#

  • If you want to use Nmap to discover online hosts without port-scanning the live systems, you can issue nmap -sn TARGETS.
  • If you want Nmap only to perform an ARP scan without port-scanning, you can use nmap -PR -sn TARGETS, where -PR indicates that you only want an ARP scan.
  • Mentioning the scanner built around ARP queries: arp-scan. Lets say to san the all the valid ip addresses on the local network, we can use arp-scan --localnet or simply arp-scan -l. Or if we have multiple interfaces on machine and we are interested in one of them, we do sudo arp-scan -I eth0 -l.
  • Plese note that we can yield same ARP Traffic (observed by tcpdump, wireshark or any similar tool) with both of nmap -PR -sn TARGETS and arp-scan TARGETS.

Host Discovery Using ICMP:#

  • Remember that an ARP query will precede the ICMP request if your target is on the same subnet.
  • To use ICMP echo request to discover live hosts, add the option -PE. (Remember to add -sn if you don’t want to follow that with a port scan.)
  • an ICMP echo scan works by sending an ICMP echo request and expects the target to reply with an ICMP echo reply if it is online.
  • Commnd sudo nmap -PE -sn TARGETS can scan with ARP ICMP ping on targets
  • Adding the -PP option tells Nmap to use timestamp request (ICMP Type 13) and checks whether it will get a Timestamp reply (ICMP Type 14). Fr example: sudo nmap -PP -sn TARGETS
  • Similarly, Nmap uses address mask queries (ICMP Type 17) and checks whether it gets an address mask reply (ICMP Type 18). This scan can be enabled with the option -PM. For Example: sudo nmap -PM -sn TARGETS

Host Discovery Using TCP and UDP:#

  • TCP SYN PING: We can send a packet with the SYN (Synchronize) flag set to a TCP port, 80 by default, and wait for a response. An open port should reply with a SYN/ACK (Acknowledge); a closed port would result in an RST (Reset). We dont really care about the state of port in this case.
  • If you want Nmap to use TCP SYN ping, you can do so via the option -PS followed by the port number, range, list, or a combination of them. For example, -PS21 will target port 21
  • Privileged users (root and sudoers) can send TCP SYN packets and don’t need to complete the TCP 3-way handshake even if the port is open. . Unprivileged users have no choice but to complete the 3-way handshake if the port is open.
  • TCP ACK Ping: Sends a packet with an ACK flag set. You must be running Nmap as a privileged user to be able to accomplish this. If you try it as an unprivileged user, Nmap will attempt a 3-way handshake.
  • Here, We are sending TCP packet with an ACK flag set to all the targets. So, targets which are up should reply with TCP packet with an RST flag set.
  • To use TCP ACK ping with nmap, we use flag -PA. For example sudo nmap -PA -sn TARGETS to discover the online hosts on targtet’s network.
  • UDP PIng:Contrary to TCP SYN ping, sending a UDP packet to an open port is not expected to lead to any reply. However, if we send a UDP packet to a closed UDP port, we expect to get an ICMP port unreachable packet; this indicates that the target system is up and available.
  • Nmap uses -PU for UDP ping. For example: sudo nmap -PU -sn TARGETS

Reverse DNS Lookup:#

  • Nmap’s default behaviour is to use reverse-DNS online hosts. Because the hostnames can reveal a lot, this can be a helpful step. However, if you don’t want to send such DNS queries, you use -n to skip this step.
  • By default, Nmap will look up online hosts; however, you can use the option -R to query the DNS server even for offline hosts. If you want to use a specific DNS server, you can add the --dns-servers DNS_SERVER option.

Nmap Basic Port Scans#

  • TCP Connect Scan: TCP connect scan works by completing the TCP 3-way handshake. In standard TCP connection establishment, the client sends a TCP packet with SYN flag set, and the server responds with SYN/ACK if the port is open; finally, the client completes the 3-way handshake by sending an ACK. A closed TCP port responds to a SYN packet with RST/ACK to indicate that it is not open.
  • You can choose to run TCP connect scan using -sT with nmap. For example: nmap -sT 10.49.140.143
  • We can use -F to enable fast mode and decrease the number of scanned ports from 1000 (default) to 100 most common ports.
  • TCP SYN SCan: Default scan mode is SYN scan, and it requires a privileged (root or sudoer) user to run it.
  • We are interested in learning whether the TCP port is open, not establishing a TCP connection. Hence the connection is torn as soon as its state is confirmed by sending a RST/ACK (closed) or SYS/ACK (open) (only privilaged users allowed) by sending the RST flag. We can select this scan type by using the -sS option.
  • UDP Scan: UDP is a connectionless protocol, and hence it does not require any handshake for connection establishment. We cannot guarantee that a service listening on a UDP port would respond to our packets. However, if a UDP packet is sent to a closed port, an ICMP port unreachable error (type 3, code 3) is returned.
  • We can select UDP scan using the -sU option; For example: sudo nmap -sU 10.48.177.222

Fine-Tuning Scope and Performance#

  • We can choose to control the packet rate using --min-rate <number> and --max-rate <number>. For example, --max-rate 10 or --max-rate=10 ensures that your scanner is not sending more than ten packets per second.
  • We can control probing parallelization using --min-parallelism <numprobes> and --max-parallelism <numprobes>

Ports#

  • We can specify the ports you want to scan instead of the default 1000 ports.
  • port list: -p22,80,443
  • port range: -p1-1023
  • all ports (0 - 65535): -p-
  • Top 100 ports: -F
  • Top 10 ports: --top-ports 10

scan timing#

  • We can control the scan timing using -T<0-5>. -T0 is the slowest (paranoid), while -T5 is the fastest.
  • paranoid (T0), sneaky (T1), polite (T2), normal (T3), aggressive (T4), insane (T5)

NMAP Advanced Port-scans:#

  • For instance, an ACK flag is set when you want to acknowledge received data. An ACK scan is like trying to acknowledge data that was neither sent nor received in the first place. Consider this simple analogy, someone coming to you out of nowhere to tell you, “yes, I hear you, please continue.” when you haven’t said anything.
  • Null Scan (tcp segment with no flag set, -sN , respond with RST-ACK if the port is closed port)
  • FIN Scan (only FIN Flag is set, sF, respond with RST-ACK if the port is closed port)
  • Xmas Scan (FIN, PSH, URG flags are set, -sX, respond with RST-ACK if the port is closed port)
  • Maimon Scan (FIN and ACK bits are set, -sM, send an RST packet as a response on closed port )
  • ACK Scan (Send a TCP packet with the ACK flag set, -sA, respond with the RST regardless of the state of the port without firewall, reveal unblocking ports with firewall)
  • Window Scan (Same as the ACK scan; however, it examines the TCP Window field of the RST packets returned -sW, )
  • Custom Scan (we can experiment with providing customized flags in tcp segment, using --scanflag RSTSYSFIN –> proving the three flags: reset, sys, fin )

Spoofed IP Address:#

  • Sometimes we supposed to scan target with spoofed Ip or even a spoofed MAC. We can make use of nmap -S SPOOFED_IP TARGETS. The target machine will respond to the incoming packets sending the replies to the SPOOFED_IP.
  • We will need to issue nmap -e NET_INTERFACE -Pn -S SPOOFED_IP TARGETS to tell Nmap explicitly which network interface to use and not to expect to receive a ping reply. It is worth noting that this scan will be useless if the attacker system cannot monitor the network for responses.
  • When you are on the same subnet as the target machine, you would be able to spoof your MAC address as well. You can specify the source MAC address using --spoof-mac SPOOFED_MAC
  • Why dont we make the scan appear to be coming from many IP addresses so that the attacker’s IP address would be lost among them. Lets say nmap -D 10.10.0.1,10.10.0.2,RND,RND,ME MACHINE_IP, where the third and fourth source IP addresses are assigned randomly, while the fifth source is going to be the attacker’s IP address.

Fragmented Packets:#

  • Nmap provides the option -f to fragment packets. Once chosen, the IP data will be divided into 8 bytes or less. Adding another -f (-f -f or -ff) will split the data into 16 byte-fragments instead of 8.
  • You can change the default value by using the –mtu; however, you should always choose a multiple of 8.
  • For example: sudo nmap -sS -p80 -f 10.20.30.144.

Idle/Zombie Scan:#

  • It requires an idle system connected to the network that you can communicate with. Practically, Nmap will make each probe appear as if coming from the idle (zombie) host, then it will check for indicators whether the idle (zombie) host received any response to the spoofed probe. This is accomplished by checking the IP identification (IP ID) value in the IP header. You can run an idle scan using nmap -sI ZOMBIE_IP MACHINE_IP, where ZOMBIE_IP is the IP address of the idle host (zombie).

Getting more details:#

  • You might consider adding --reason if you want Nmap to provide more details regarding its reasoning and conclusions (i mean why Nmap concluded that the system is up or a particular port is open.). For example: sudo nmap -sS --reason 10.10.252.27
  • For more detailed output, you can consider using -v for verbose output or -vv for even more verbosity.
  • We can use -d for debugging details or -dd for even more details.

NMAP Post port scans#

Service Detection:#

  • Adding -sV to nmap will collect and determine service and version information for the open ports. We can control the intensity with the --version-intensity LEVEL where level ranges from 0 (lightest) to 9. -sV --version-light has an intensity of 2, while -sV --version-all has an intensity of 9.
  • Its important to understand that -sV will force the nmap to use tcp 3-way handshake and establish the connection. In otherwords -sS is not possible when -sV option is used.
  • Example: sudo nmap -sV TARGET

OS Detection and traceroute:#

  • Nmap can detect the OS based on its behaviour and any telltale signs in its responses. Its enabled by using -O. For example, namp -sS -O TARGET.
  • If we want the nmap to find the routers between the you and target, we can make use of --traceroute. Please note nmap results slightly different from traceroute command as its starts with a packet of low TTL and keeps incresing until it reaches the target. Nmap’s traceroute starts with a packet of high TTL and keeps decreasing it. For example: nmap -sS --traceroute TARGET

Nmap scripting engine#

  • Nmap provides support for scripts using the Lua language. A part of Nmap, Nmap Scripting engine (NSE) is a Lua interpreter that allows Nmap to execute scripts written in the Lua language.
  • Default Nmap installation may easily contain around 600 scripts. Take a look at the nmap installation folder ls -la /usr/share/nmap/scripts for scripts conventiently named starting with protocol they target.
  • We can specify to use any or a group of these installed scripts, moreover we can install other user’s scripts and use them for our scans.
  • Lets begin with defaults, we can use --script=default or -sC to run the scripts in the default catogory. For example: sudo nmap -sS -sC TARGET will do a syn scan with executing the defautl scripts.
  • In addition to default, we have other catagories, please have a look here
    	auth		- Authentication related scripts
	broadcast	- Discover hosts by sending broadcast messages
	brute		- Performs brute-force password auditing against logins
	default		- Default scripts, same as -sC
	discovery	- Retrieve accessible information, such as database tables and DNS names
	dos			- Detects servers vulnerable to Denial of Service (DoS)
	exploit 	- Attempts to exploit various vulnerable services
	external	- Checks using a third-party service, such as Geoplugin and Virustotal
	fuzzer		- Launch fuzzing attacks
	intrusive	- Intrusive scripts such as brute-force attacks and exploitation
	malware		- Scans for backdoors
	safe		- Safe scripts that won’t crash the target
	version		- Retrieve service versions
	vuln		- Checks for vulnerabilities or exploit vulnerable services
  • We can specify the script by name using --script "SCRIPT-NAME" or a pattern such as --script "ftp" which would includ ftp related scripts.
  • For example: sudo nmap -sS -n --script "http-date" TARGET runs the script http-date which retrieve the http-server date and time.

Saving the Output:#

  • Normal Format: We can save the scan results in Normal format using -oN FILENAME
  • Greppable Format: grep stands for Global Regular Expression Printer. It makes filtering scan output for specific keywords or terms efficient. We can save output in this format using -oG FILENAME.
  • XML Format: lets use -oX FILENAME.
  • why dont we do all at a time?: nmap -sS TARGET -A FILENAME, its give three files: FILENAME.gnmap, FILENAME.nmap, FILENAME.xml
  • script kiddie: You can see this format is useless if you want to search the output for any interesting keywords or keep the results for future reference. However you can use it to save the output of scan nmap -sS 127.0.0.1 -oS FILENAME, display the output filename and look 31337 in font of friends who are non-tech savy.