Nmap

Nmap ↗ (Network Mapper) is a powerful, open-source tool used for network discovery, security auditing, and network inventory. Nmap can be used to scan networks, discover hosts, identify open ports, detect operating systems, and even run scripts to automate tasks.

Usage#

nmap [Scan Type(s)] [Options] {target specification}

there are multiple ways to specify targets

• IP range using -: If you want to scan all the IP addresses from 192.168.0.1 to 192.168.0.10, you can write 192.168.0.1-10
• IP subnet using /: If you want to scan a subnet, you can express it as 192.168.0.1/24, and this would be equivalent to 192.168.0.0-255
• Hostname: You can also specify your target by hostname

Nmap Scan Types#

Host Discovery Scan#

A host discovery scan is one of the most common types of scans used to enumerate hosts on a network because it can use different types of ICMP messages to determine whether a host is online and responding on a network.
It aims to discover live hosts without attempting to discover the services running on them. This scan might be helpful if you want to discover the devices on a network without causing much noise.

NOTE The default for the -sn scan option is to send an ICMP echo request packet to the target (or ARP requests on a local network, if run with sudo), a TCP SYN to port 443, a TCP ACK(or TCP SYN if not run as root) to port 80, and an ICMP timestamp request. This is documented at https://nmap.org/book/man-host-discovery.html ↗. If the target responds to the ICMP echo or the aforementioned packets, then it is considered alive.

Different Host Discovery Types

TCP Connect Scan (-sT)#

A TCP connect scan actually makes use of the underlying operating system’s networking mechanism to establish a full TCP connection with the target device being scanned. Because it creates a full connection, it creates more traffic (and thus takes more time to run). This is the default scan type that is used if no scan type is specified with the nmap command. However, it should typically be used only when a SYN scan is not an option, such as when a user who is running the nmap command does not have raw packet privileges on the operating system because many of the Nmap scan types rely on writing raw packets.
TCP Connect Scan Responses

A full TCP connect scan requires the scanner to send an additional packet per scan, which increases the amount of noise on the network and may trigger alarms that a half-open scan wouldn’t trigger. Security tools and the underlying targeted system are more likely to log a full TCP connection.

TCP SYN scan (-sS)#

Also known as “Half-open” scans, or “Stealth” scans.
With an Nmap SYN scan, the tool sends a TCP SYN packet to the TCP port it is probing. This process is also referred to as half-open scanning because it does not open a full TCP connection since the TCP three-way handshake is never completed.
The advantage is that this is expected to lead to fewer logs as the connection is never established, and hence, it is considered a relatively stealthy scan.
Without having to bother about completing (and disconnecting from) a three-way handshake for every port, SYN scans are significantly faster than a standard TCP Connect scan.
SYN Scan Responses

• They require sudo permissions in order to work correctly in Linux. This is because SYN scans require the ability to create raw packets (as opposed to the full TCP handshake), which is a privilege only the root user has by default.
• Unstable services are sometimes brought down by SYN scans, which could prove problematic if a client has provided a production environment for the test.

For this reason, SYN scans are the default scans used by Nmap if run with sudo permissions. If run without sudo permissions, Nmap defaults to the TCP Connect scan.

UDP Scan ( -sU )#

The majority of the time, you will be scanning for TCP ports, as this is how you connect to most services running on target systems. However, you might encounter some instances in which you need to scan for UDP ports – for example, if you are trying to enumerate a DNS, SNMP, or DHCP server. These services all use UDP for communication between client and server.
To scan UDP ports, Nmap sends a UDP packet to all ports specified in the command-line configuration. It waits to hear back from the target.

• If it receives an ICMP port unreachable message back from a target, that port is marked as closed.
• If it receives no response from the target UDP port, Nmap marks the port as open/filtered. In other words, it suspects that the port is open, but it could be firewalled.
• If it gets a UDP response (which is very unusual), then the port is marked as open.

UDP Scan Responses

Other TCP Scans#

TCP FIN Scan ( -sF )#

There are times when a SYN scan might be picked up by a network filter or firewall. In such a case, you need to employ a different type of packet in a port scan. With the TCP FIN scan, a FIN packet is sent to a target port. If the port is actually closed, the target system sends back an RST packet. If nothing is received from the target port, you can consider the port open because the normal behavior would be to ignore the FIN packet.

NOTE A TCP FIN scan is not useful when scanning Windows-based systems, as they respond with RST packets, regardless of the port state.

TCP FIN Scan Responses

TCP Null Scan ( -sN)#

NULL scans (-sN) are when the TCP request is sent with no flags set at all. As per the RFC, the target host should respond with a RST if the port is closed.

TCP Xmas Scan ( -sX)#

Xmas scans (-sX) send a malformed TCP packet and expects a RST response for closed ports. It’s referred to as an xmas scan as the flags that it sets (PSH, URG and FIN) give it the appearance of a blinking christmas tree when viewed as a packet capture in Wireshark.

If the port is open then there is no response to the malformed packet. Unfortunately (as with open UDP ports), that is also an expected behaviour if the port is protected by a firewall, so NULL, FIN and Xmas scans will only ever identify ports as being open|filtered, closed, or filtered. If a port is identified as filtered with one of these scans then it is usually because the target has responded with an ICMP unreachable packet.

It’s also worth noting that while RFC 793 mandates that network hosts respond to malformed packets with a RST TCP packet for closed ports, and don’t respond at all for open ports; this is not always the case in practice. In particular Microsoft Windows (and a lot of Cisco network devices) are known to respond with a RST to any malformed TCP packet, regardless of whether the port is actually open or not. This results in all ports showing up as being closed.
Many firewalls are configured to drop incoming TCP packets to blocked ports which have the SYN flag set (thus blocking new connection initiation requests). By sending requests which do not contain the SYN flag, we effectively bypass this kind of firewall. Whilst this is good in theory, most modern IDS solutions are savvy to these scan types and can detect them.

Timing Options ( -T 0-5 )#

The Nmap scanner provides six timing templates that can be specified with the -T option and the template number (0 through 5) or name. Nmap timing templates enable you to dictate how aggressive a scan will be, while leaving Nmap to pick the exact timing values. These are the timing options:

• -T0 (Paranoid) : Very slow, used for IDS evasion
• -T1 (Sneaky) : Quite slow, used for IDS evasion
• -T2 (Polite) : Slows down to consume less bandwidth, runs about 10 times slower than the default
• -T3 (Normal) : Default, a dynamic timing model based on target responsiveness
• -T4 (Aggressive) : Assumes a fast and reliable network and may overwhelm targets
• -T5 (Insane) : Very aggressive; will likely overwhelm targets or miss open ports

Saving Scan Report#

Nmap gives us various formats to save the scan results. The three most useful are normal (human-friendly) output, XML output, and grepable output, in reference to the grep command. You can select the scan report format as follows:

• -oN <filename> - Normal output
• -oX <filename> - XML output
• -oG <filename> - grep-able output (useful for grep and awk)
• -oA <basename> - Output in all major formats

Nmap Scripting Engine#

Nmap contains the powerful Nmap Scripting Engine (NSE), which enables the programming of various Nmap options and conditional actions to be taken as a result of the responses.

• NSE Scripts are written in the Lua programming language, and can be used to do a variety of things: from scanning for vulnerabilities, to automating exploits for them.
• NSE has built-in scripts that enumerate users, groups, and network shares.
• In Kali Linux, the NSE scripts are located at /usr/share/nmap/scripts by default.

There are many categories available. Some useful categories include:

• safe:- Won’t affect the target

• intrusive:- Not safe: likely to affect the target

• vuln:- Scan for vulnerabilities

• exploit:- Attempt to exploit a vulnerability

• auth:- Attempt to bypass authentication for running services (e.g. Log into an FTP server anonymously)

• brute:- Attempt to bruteforce credentials for running services

• discovery:- Attempt to query running services for further information about the network (e.g. query an SNMP server).

• To run a specific script, we would use --script=<script-name> or to run a category of scripts, we use --script=<category>.

• Some scripts require arguments (for example, credentials, if they’re exploiting an authenticated vulnerability). These can be given with --script-args. Arguments are separated by commas, and connected to the corresponding script with periods (i.e.  --script-args <script-name>.<argument>=<value>).

• Nmap scripts come with built-in help menus, which can be accessed using nmap --script-help <script-name>.

Eg:

• One of the more commonly used scripts for SMB discovery is the smb-enum-users.nse script.
• You can enumerate the network shares using another NSE script, smb-enum-shares.nse. To discover shared directories on the target computer. nmap --script smb-enum-shares.nse -p445 [ip]
  Examine the output created by the smb-enum-shares script. In the output, share names that end with a “$” character represent hidden shares that include system and administrative shares.

Read more:

• https://nmap.org/book/nse-usage.html ↗
• https://nmap.org/nsedoc/ ↗

Nmap Vulners script to scan for vulnerabilities.#

The Vulners script displays known vulnerabilities and the corresponding CVE. The Vulners script uses the open port and software version information to search for common platform enumeration (CPE) names that relate to the identified service. It then makes a request to a remote server to find out if any known vulnerabilities exist for that CPE.

Use the nmap –script command to launch the vulners script. The syntax for the command is nmap -sV --script vulners [--script-args mincvss=<arg_val>] <target> where the script argument mincvss restricts the output to only those CVEs that have a higher CVSS score than the one specified in the argument.

eg:

1. There are multiple scripts available to find valid usernames using Nmap. One of the most common is the SMB username script. It is a common practice to synchronize OS Users with SMB (Samba or Windows) users. Use the Nmap script smb-brute to find users and to attempt to brute force passwords.
   sudo nmap -sV -p 445 -script smb-brute 172.17.0.2
   • Locate the Host script results section in the command output. Username and password combinations that were uncovered with the Nmap script are listed in this section.

Evasion#

• Your typical Windows host will, with its default firewall, block all ICMP packets. So when nmap pings a target, it will not get any response and will mark this host as dead.-Pn, which tells Nmap to not bother pinging the host before scanning it. This means that Nmap will always treat the target host(s) as being alive, effectively bypassing the ICMP block; however, it comes at the price of potentially taking a very long time to complete the scan (if the host really is dead then Nmap will still be checking and double checking every specified port).

• In this case we can use -Pn, which tells Nmap to not bother pinging the host before scanning it. This means that Nmap will always treat the target host(s) as being alive, effectively bypassing the ICMP block; however, it comes at the price of potentially taking a very long time to complete the scan (if the host really is dead then Nmap will still be checking and double checking every specified port).

• -f:- Used to fragment the packets (i.e. split them into smaller pieces) making it less likely that the packets will be detected by a firewall or IDS.

• An alternative to -f, but providing more control over the size of the packets: --mtu <number>, accepts a maximum transmission unit size to use for the packets sent. This must be a multiple of 8.

• --scan-delay <time>ms:- used to add a delay between packets sent. This is very useful if the network is unstable, but also for evading any time-based firewall/IDS triggers which may be in place.

• --badsum:- this is used to generate in invalid checksum for packets. Any real TCP/IP stack would drop this packet, however, firewalls may potentially respond automatically, without bothering to check the checksum of the packet. As such, this switch can be used to determine the presence of a firewall/IDS.

Scan for ips#

to scan for ip’s in the network, we can use

• arp-scan -l
• netdiscover -r [ip range (eg: 192.168.57.0/24)]