Nmap Cookbook · the Fat-Free Guide to Network Scanning by Marsh, Nicholas -- Read -- Imperial Library of Trantor

Index

Installation Overview Installing Nmap on Windows Installing Nmap on Unix and Linux systems Installing Nmap on Mac OS X

Section 2: Basic Scanning Techniques

Basic Scanning Overview Scan a Single Target Scan Multiple Targets Scan a Range of IP Addresses Scan an Entire Subnet Scan a List of Targets Scan Random Targets Exclude Targets from a Scan Exclude Targets Using a List Perform an Aggressive Scan Scan an IPv6 Target

Section 3: Discovery Options

Discovery Options Overview Don’t Ping Ping Only Scan TCP SYN Ping TCP ACK Ping UDP Ping SCTP INIT Ping ICMP Echo Ping ICMP Timestamp Ping ICMP Address Mask Ping IP Protocol Ping ARP Ping Traceroute Force Reverse DNS Resolution Disable Reverse DNS Resolution Alternative DNS Lookup Method Manually Specify DNS Server(s) Create a Host List

Section 4: Advanced Scanning Options

Advanced Scanning Functions Overview TCP SYN Scan TCP Connect Scan UDP Scan TCP NULL Scan TCP FIN Scan Xmas Scan Custom TCP Scan TCP ACK Scan IP Protocol Scan Send Raw Ethernet Packets Send IP Packets

Section 5: Port Scanning Options

Port Scanning Options Overview Perform a Fast Scan Scan Specific Ports Scan Ports by Name Scan Ports by Protocol Scan All Ports Scan Top Ports Perform a Sequential Port Scan

Section 6: Operating System and Service Detection

Version Detection Overview Operating System Detection Submitting TCP/IP Fingerprints Attempt to Guess an Unknown Operating System Service Version Detection Troubleshooting Version Scans Perform an RPC Scan

Section 7: Timing Options

Timing Options Overview Timing Parameters Timing Templates Minimum Number of Parallel Operations Maximum Number of Parallel Operations Minimum Host Group Size Maximum Host Group Size Initial RTT Timeout Maximum RTT Timeout Maximum Retries Set the Packet TTL Host Timeout Minimum Scan Delay Maximum Scan Delay Minimum Packet Rate Maximum Packet Rate Defeat Reset Rate Limits

Section 8: Evading Firewalls

Firewall Evasion Techniques Overview Fragment Packets Specify a Specific MTU Use a Decoy Idle Zombie Scan Manually Specify a Source Port Number Append Random Data Randomize Target Scan Order Spoof MAC Address Send Bad Checksums

Section 9: Output Options

Output Options Overview Save Output to a Text File Save Output to a XML File Grepable Output Output All Supported File Types Display Scan Statistics 133t Output

Section 10: Troubleshooting and Debugging

Troubleshooting and Debugging Overview Getting Help Display Nmap Version Verbose Output Debugging Display Port State Reason Codes Only Display Open Ports Trace Packets Display Host Networking Configuration Specify Which Network Interface to Use

Section 11: Zenmap

Zenmap Overview Launching Zenmap Basic Zenmap Operations Zenmap Results Scanning Profiles Profile Editor Viewing Open Ports Viewing a Network Map Saving Network Maps Viewing Host Details Viewing Scan History Comparing Scan Results Saving Scans

Section 12: Nmap Scripting Engine (NSE)

Nmap Scripting Engine Overview Execute Individual Scripts Execute Multiple Scripts Script Categories Execute Scripts by Category Execute Multiple Script Categories Troubleshoot Scripts Update the Script Database

Section 13: Ndiff

Ndiff Overview Scan Comparison Using Ndiff Ndiff Verbose Mode XML Output Mode

Section 14: Tips and Tricks

Tips and Tricks Overview Combine Multiple Options Scan Using Interactive Mode Runtime Interaction Remotely Scan Your Network Wireshark Scanme.Insecure.org

Nmap Online Resources Appendix A - Nmap Cheat Sheet Appendix B - Nmap Port States Appendix C - CIDR Cross Reference Appendix D - Common TCP/IP Ports