Nmap: Getting Started Guide

Nmap is a free utility tool for network discovery, port scanning and security auditing, even though we can use it for more than that but in this article we will learn how to do these three things with nmap.

The original author of nmap is Gordon Lyon (Fyodor). Nmap is licensed under GPL v2 and has available ports in many different languages. Nmap is available for Linux, Windows, and Mac OS X. You can download your copy of nmap from their website.

Lets get started with nmap.

When performing pentests we always look for networks we are going to attack. We need to identify live hosts on the network so that we can attack them. There are plenty of tools available for finding live hosts on a network but nmap is one of the best tools for doing this job.

Lets start with simple host (target) discovery scans i,e scans that will tell us which ip address is up on our target network. Those ip addresses which are up on our target network are the ones that are assigned to a device connected on our target network. Every device on the network is going to have a unique ip address.
To perform a simple host discovery scan we use the following command

nmap -v -sn

flags we used in the above command are
-v for verbose output
-sn to disable port scan (we don't want to scan for ports right now)

Following the flags is the ip address of the target network on which we want to look for live hosts. The /24 at the end of the ip address is the CIDR that specifies the subnet of the network on which we are looking for live hosts.

After running the above command you should get a list of live hosts on your target network.
If you just want to know the list of ip addresses your command is going to scan, you can use the -sL flag of the nmap like this.

nmap -sL

this command will simply output the list of ip addresses to scan.

We sometimes want to do dns resolution (resolving ip addresses to domain names) when performing our network scans and sometimes we don't want dns resolution. While performing a host discovery scan with nmap if we want to perform dns resolution we use -R flag in our command like this:

nmap -v -sn -R

And if we don't want to perform dns resolution of hosts during our scan we add the -n flag to our command like this:

nmap -v -sn -n

After we have discovered the hosts that are up on our target network, we usually put the ip addresses of these hosts into a file for further enumeration.

Next step in our enumeration would be to detect which operating system and which ports are running on these live hosts, for that we run this command:

nmap -O -v

here we use -O (capital o not zero) for operating system detection and by default nmap performs SYN Scan for port discovery. However nmap scans for 1000 ports only by default of a particular host.

To make nmap go over a list of ip addresses in a file we use -iL flag like this:

nmap -O -v -iL targetlist

where targetlist is the name of the file which contains ip addresses that we want to perform port scan on.

To make nmap scan all the ports of a target we use the -p flag like this:

nmap -p- -v

We can also specify a range of ports using the -p flag like this:

nmap -p1-500 -v

here 1-500 means scan all the ports from 1 to 500.

We can use a number of scan techniques to discover open ports on our network but I will only discuss some of them for brevity.

We can perform a TCP SYN scan using nmap with -sS flag like this:

nmap -sS -v

We have also flags for TCP connect and ACK scans which are -sT -sA

nmap -sT -v

nmap -sA -v

We can also perform UDP scan as well instead of TCP scan using -sU flag

nmap -sU -v

We can perform TCP Null, FIN, and Xmas scans using the flags -sN, -sF, -sX

nmap -sN -v

nmap -sF -v

nmap -sX -v

If you don't know what these scans are then please visit Port Scanning Techniques and Algorithms for explanation.

After discovering the open ports on our target host, we want to enumerate what services are running on those open ports. To enumerate services and versions information on open ports we use the -sV flag like this:

nmap -sV -v

This should give us information about what services are running on what ports and what versions of those services are running on the target host.

nmap has an interesting feature called NSE nmap scripting engine. It allows users to write their own scripts, using the Lua programming language, to automate a wide variety of networking tasks. nmap ships with a diverse set of scripts which are very helpful to enumerate a target. To use the nmap default set of scripts while enumerating the target, we use the -sC flag like this:

nmap -sC -sV -v

We can also save the results of our nmap scans to a file using the -o flag like this

nmap -sC -sV -v -oA defaultscan

here -oA tells the nmap to output results in the three major formats at once and defaultscan is the name of the file that will be prepended to all the three output files.

This is the end of this short tutorial see you next time.


Related articles

  1. Top Pentest Tools
  2. Hack Website Online Tool
  3. Best Hacking Tools 2019
  4. How To Hack
  5. Hacker Tools Windows
  6. Black Hat Hacker Tools
  7. Hacker Tools 2020
  8. Hack Tools 2019
  9. Hacking Tools For Kali Linux
  10. Hacking Tools Download
  11. Pentest Tools For Mac
  12. Nsa Hack Tools Download
  13. Pentest Tools Free
  14. Hack Tools Pc
  15. Kik Hack Tools
  16. Hack Tools
  17. Hackrf Tools
  18. Pentest Tools Bluekeep
  19. Pentest Tools List
  20. Hacking Tools For Games
  21. Pentest Tools For Mac
  22. Computer Hacker
  23. Hacker Tools Online
  24. Top Pentest Tools
  25. New Hack Tools
  26. Kik Hack Tools
  27. Pentest Tools Alternative
  28. Hacking Tools For Kali Linux
  29. Hack Tools For Mac
  30. World No 1 Hacker Software
  31. Pentest Tools Android
  32. Pentest Tools Nmap
  33. Best Hacking Tools 2019
  34. Hack Tools For Mac
  35. Ethical Hacker Tools
  36. Pentest Tools Android
  37. Best Hacking Tools 2019
  38. Pentest Recon Tools
  39. Hacking Tools Online
  40. Easy Hack Tools
  41. Easy Hack Tools
  42. Hacker Tool Kit
  43. Hak5 Tools
  44. Pentest Automation Tools
  45. Pentest Box Tools Download
  46. Pentest Tools Url Fuzzer
  47. Hacking Tools For Windows 7
  48. Hacker Tools 2019
  49. Hacking Tools For Kali Linux
  50. Pentest Tools Port Scanner
  51. Blackhat Hacker Tools
  52. Best Hacking Tools 2020
  53. Pentest Tools Download
  54. Underground Hacker Sites
  55. Tools For Hacker
  56. Pentest Tools Alternative
  57. Hacking Tools Mac
  58. Hack Tool Apk No Root
  59. Hacking Tools For Windows 7
  60. New Hack Tools
  61. Install Pentest Tools Ubuntu
  62. Hack Apps
  63. Hacking Tools Mac
  64. Black Hat Hacker Tools
  65. Hacker Tools Online
  66. Top Pentest Tools
  67. How To Hack
  68. Pentest Tools For Ubuntu
  69. Pentest Tools Android
  70. Usb Pentest Tools
  71. Hacker Tools Software
  72. Pentest Tools Review
  73. Hacking Tools For Mac
  74. Hack Tools Mac
  75. Top Pentest Tools
  76. Pentest Tools Kali Linux
  77. Best Hacking Tools 2019
  78. Hacker Tools List
  79. Pentest Recon Tools
  80. Nsa Hacker Tools
  81. Hacker Tools Apk Download
  82. Hack Tools For Windows
  83. Android Hack Tools Github
  84. Hacker Tools Windows
  85. Black Hat Hacker Tools
  86. Computer Hacker
  87. Easy Hack Tools
  88. Pentest Tools Apk
  89. Hacking Tools For Mac
  90. Hacker Tools For Windows
  91. Underground Hacker Sites
  92. Hacking Tools Software
  93. Hacking Tools Kit
  94. Hacker Tools Free Download
  95. Hacker Tools Free Download
  96. Free Pentest Tools For Windows
  97. Pentest Automation Tools
  98. Hacker
  99. Pentest Tools Linux
  100. Hacking Tools
  101. Hacking Tools For Windows 7
  102. Hacking Tools Mac
  103. Pentest Tools Subdomain
  104. Pentest Tools Url Fuzzer
  105. Hacker Search Tools
  106. Hackrf Tools
  107. Hack Rom Tools
  108. Hacking Tools Usb
  109. Physical Pentest Tools
  110. Blackhat Hacker Tools
  111. Tools 4 Hack
  112. Hacking Tools Software
  113. Hack Tools Online

Post a Comment

Previous Post Next Post