Nmap 6 Cookbook · The Fat-Free Guide to Network Security Scanning by Marsh, Nicholas -- Read -- Imperial Library of Trantor

Index

Cover Dedication Copyright About Fat Free Publishing About the Author (Nicholas Marsh) Introduction

A typical Nmap scan Promote Nmap Report Bugs Contribute Code Sponsor Nmap

Conventions Used In This Book Section 0: Internet Protocol Suite

Overview Internet Protocol Suite History How The IP Suite Works

Application Layer Transport Layer Internet Layer Link Layer TCP/IP Model compared to the OSI Model

Components of TCP/IP Anatomy of Segments/Datagrams, Packets, and Frames

TCP Segments and UDP Datagrams TCP segment PDU UDP datagram PDU

IP Packets IP packet

Ethernet frame structure

Putting It All Together Encapsulation of network PDUs

Common Application Protocols and Ports

Section 1: Installing Nmap

Overview Installing Nmap on Windows

Step 1 Step 2

Nmap for Windows installer

Step 3

WinPcap for Windows installer

Step 4

WinPcap options

Step 5 Nmap test scan on Microsoft Windows

Installing Nmap on Linux systems

Installing Precompiled Packages for Linux Nmap version output Compiling Nmap from Source for Unix and Linux

Step 1

Downloading Nmap on Unix and Linux systems via the command line

Step 2

Extracting Nmap source code

Step 3

Compiling Nmap source code

Step 4

Installing Nmap from source code

Step 5

Nmap test scan on Unix/Linux

Installing Nmap on Mac OS X

Step 1 Step 2

Nmap for Mac OS X installer

Step 3

Default installation settings

Step 4

Successful installation of Nmap on Mac OS X

Step 5

Nmap test scan on Mac OS X

Section 2: Basic Scanning Techniques

Overview Scan a Single Target

Single target scan Nmap Port States

Understanding Port States

Nmap scan from a dedicated internet connection Nmap scan from a broadband internet connection

Scan Multiple Targets

Multiple target scan Scan a Range of IP Addresses Scanning a range of IP addresses Scan an Entire Subnet Scanning an entire class C subnet using CIDR notation CIDR Notation Reference Scan a List of Targets Target IP addresses in a text file Nmap scan using a list for target specification Scan Random Targets Scanning three randomly generated IP addresses Exclude Targets from a Scan Excluding a single IP from a scan Excluding a range of IP addresses from a scan Exclude Targets Using a List

Text file with hosts to exclude from a scan

Excluding a list of hosts from a network scan Perform an Aggressive Scan Output of an aggressive scan Scan an IPv6 Target Scanning an IPv6 address

Section 3: Discovery Options

Overview Summary of features covered in this section: Don’t Ping

Results of an Nmap scan where the target system is not pingable Output of a Nmap scan with ping discovery disabled Ping Only Scan Output of a ping only scan Output of a ping only scan (as root) Performing a TCP SYN ping TCP ACK Ping Performing a TCP ACK ping ICMP Echo Ping Performing an ICMP echo ping Performing an ICMP timestamp ping ICMP Address Mask Ping Performing an ICMP address mask ping IP Protocol Ping Performing an IP protocol ping ARP Ping Performing an ARP ping Traceroute Output of a traceroute scan Disable Reverse DNS Resolution Output of an Nmap scan with reverse DNS disabled Alternative DNS Lookup Method Output of an Nmap scan using the system DNS resolver Manually Specify DNS Server(s) Manually specifying DNS servers Create a Host List Output of a host list generated by Nmap

Section 4: Advanced Scanning Options

Overview Summary of features covered in this section:

TCP SYN Scan Performing a TCP SYN scan TCP Connect Scan Performing a TCP connect scan UDP Scan Performing a UDP scan Performing a TCP and UDP scan TCP NULL Scan Performing a TCP NULL scan Xmas Scan Performing a “Christmas” scan Custom TCP Scan Manually specifying TCP flags TCP ACK Scan Performing a TCP ACK scan IP Protocol Scan Output of an IP protocol scan

Section 5: Port Scanning Options

Overview

Summary of features covered in this section: Perform a Fast Scan Output of a “fast” scan Scan Specific Ports Specifying a single port to scan Specifying multiple ports to scan Scan Ports by Name Scanning ports by name Scanning ports by name using wildcards Scan Ports by Protocol Scanning specific ports by protocol Scan All Ports Scanning all ports on a target system Scan Top Ports Performing a top port scan on the ten highest ranked ports Perform a Sequential Port Scan Performing a sequentially ordered port scan Only Display Open Ports Limiting Nmap output to display open ports only

Section 6: Operating System and Service Detection

Overview Summary of features covered in this section: Operating System Detection

The -O parameter enables Nmap’s operating system detection feature. Output of Nmap’s operating system detection feature Submitting TCP/IP Fingerprints TCP/IP fingerprint generated by Nmap Attempt to Guess an Unknown Operating System Nmap operating system guess output Service Version Detection Output of Nmap’s service version detection feature Troubleshooting Version Scans Version scan trace output

Section 7: Timing Options

Overview Summary of features covered in this section:

Timing Parameters Timing Templates Using a timing template Minimum Number of Parallel Operations Specifying the minimum number of parallel operations Maximum Number of Parallel Operations Specifying the maximum number of parallel operations Minimum Host Group Size Specifying a minimum host group size Maximum Host Group Size Specifying a maximum host group size Initial RTT Timeout Specifying the initial RTT timeout value used by Nmap Maximum RTT Timeout Specifying a 400 millisecond maximum RTT timeout Maximum Retries Specifying the maximum number of retries Set the Packet TTL Specifying a TTL parameter of 20 Host Timeout Output of an Nmap scan when specifying a short host timeout Minimum Scan Delay Specifying a 1 second minimum scan delay Maximum Scan Delay Specifying a 50 millisecond maximum scan delay Minimum Packet Rate Specifying a minimum packet transmission rate of 30 Maximum Packet Rate Using a maximum packet transmission rate of 30 Defeat Reset Rate Limits Defeating RST rate limits

Section 8: Evading Firewalls

Overview Summary of features covered in this section:

Fragment Packets Scanning a target using fragmented packets Specify a Specific MTU Specifying a specific MTU Use a Decoy Masking a scan using 10 randomly generated decoy IP addresses Idle Zombie Scan Using an idle “zombie” to scan a target Manually Specify a Source Port Number Manually specifying the packet source port number Append Random Data Padding a scan with random data to avoid detection Randomize Target Scan Order Scanning systems in a random order Spoof MAC Address Using a spoofed MAC address Send Bad Checksums Scanning a target using bad checksums

Section 9: Output Options

Overview Summary of features covered in this section:

Save Output to a Text File Saving Nmap output in a text file Reviewing the contents of the scan.txt file Save Output to a XML File Creating a XML output file Viewing the contents of the XML output file Grepable Output Creating a grepable output file Using the grep utility to review an Nmap output file Output All Supported File Types Creating output files for all available formats Directory listing of the resulting output files 133t Output Creating a “133t” output file

Section 10: Troubleshooting and Debugging

Overview Summary of features covered in this section:

Getting Help Displaying Nmap help information Accessing the Nmap man page on Unix and Linux systems Display Nmap Version Displaying the installed version of Nmap Verbose Output Nmap scan with verbose output enabled Debugging Nmap debugging output Display Port State Reason Codes Nmap scan with port state reason codes enabled Trace Packets Packet trace output Display Host Networking Configuration Interface list output Specify Which Network Interface to Use Manually specifying a network interface

Section 11: Zenmap

Overview

Launching Zenmap

Windows Users Unix and Linux Users Debian/Ubuntu Fedora/Red Hat/CentOS Mac OS X Users

Basic Zenmap Operations Zenmap GUI overview Zenmap Results Zenmap scan output Scanning Profiles Profile Editor Zenmap profile editor Viewing Open Ports Viewing a Network Map Zenmap topology map Saving Network Maps Saving a topology map Viewing Host Details Viewing Scan History Comparing Scan Results Zenmap comparison utility Saving Scans

Section 12: Nmap Scripting Engine (NSE)

Overview Summary of features covered in this section:

Execute Individual Scripts Executing an NSE script Common Scripts Execute Multiple Scripts Executing all SMTP scripts Execute Scripts by Category Executing all scripts in the default category Script Categories Execute Multiple Script Categories Show Script Help Files Displaying NSE script help Troubleshoot Scripts NSE trace output Redirecting the output of an NSE trace Update the Script Database Updating the NSE script database

Section 13: Ndiff

Overview Summary of features covered in this section:

Scan Comparison Using Ndiff Comparison of two Nmap scans Ndiff Verbose Mode Output of a Ndiff scan in verbose mode XML Output Mode Ndiff XML output

Section 14: Nping

Overview Summary of features covered in this section:

Perform a Simple Ping Pinging a system with Nping

Hide Sent Packets

Hiding sent packets Hide All Packets Hiding all packet output with Nping Specify A Ping Count Sending 50 pings Ping Multiple Targets Pinging two hosts at the same time Specify a Ping Rate Specifying a ping rate Flooding a network connection with packets Specify a Ping Delay Specifying a 200ms delay Generate a Payload Sending a 1400-byte payload at a rate of 1,000 packets a second Ping Using TCP or UDP Pinging using the TCP protocol. Ping Specific Ports (TCP or UDP) Performing a TCP ping on port 25 Perform an ARP Ping Performing an ARP ping Miscellaneous Nping Options

Section 15: Ncat

Overview Summary of features covered in this section:

Test a Webserver Output of a webserver test using ncat Test a SMTP Server Testing a SMTP server connection Transfer a File Setting up the receiving system to listen for a file Transferring the file from the sending system Create an Ad Hoc Chat Server Setting up ncat to listen as a host Connecting to the host system and sending messages Create an Ad Hoc Webserver Setting up Ncat to listen on port 80 Creating a simple HTTP response and HTML document

Section 16: Tips and Tricks

Overview Summary of topics discussed in this section:

Display Scan Status Nmap scan status output Runtime Interaction Nmap runtime interaction keys Remotely Scan Your Network Scanme.Nmap.org Wireshark

Nmap Online Resources

Conclusion Credits and References Appendix A - Nmap Cheat Sheet

Basic Scanning Techniques Discovery Options Advanced Scanning Functions Port Scanning Options Operating System Detection Timing Options Firewall Evasion Techniques Output Options Troubleshooting and Debugging

Appendix B - Miscellaneous Nmap Options Ready to learn the command line?

← Prev
Back
Next →

← Prev
Back
Next →