In this lesson, we're going to start our coverage of Nmap,
which is the world's most popular enumeration tool.
Now, Nmap comes to us from the Nmap project,
which is an open source project that developed this tool
and all the supporting resources that come with it.
When we talk about Nmap, we're talking about
the Nmap Security Scanner.
It is a versatile port scanner that's used
for topology, host, service,
and operating system discovery and enumeration.
Now, in this lesson specifically,
we're going to talk about discovery scans
and an Nmap discovery scan is used to footprint the network.
This is the big overview.
We want to figure out what hosts are sitting
on this network.
We want to figure out what this network looks like
from a topology standpoint,
and that would include things like IP addresses
and things of that nature.
Now, when we start talking about Nmap,
if you want to use it in its most basic form,
it's really easy.
You just type in Nmap, the IP address you want to scan
or Nmap and the IP range you want to scan.
For instance, if I type Nmap 192.168.1.0/24
that's going to scan all 256 IPs in that range.
Now, when you use Nmap in this basic syntax,
this is the default configuration.
It's going to have its default behavior being used,
and that default behavior is to ping
and send a TCP acknowledgement packet to ports 80 and 443.
This will determine whether a host is there
and whether it's present.
If that host is there and detected,
Nmap will then perform a port scan against that host
to determine which services it's actually running
across the 1,000 most commonly used ports.
Now, this port scanning can be time consuming
because there's a thousand ports at checking,
and if you have a very large range,
this can take a lot of time.
The other thing about using Nmap
in this default configuration is it is not very stealthy.
Most of your intrusion detection systems
or intrusion prevention systems
or firewalls will see this activity as scanning
and they will try to block it.
And so you need to make sure
that you know all the different ways to use Nmap
so you're not being blocked by these network devices.
And that brings us into another way of doing things,
which is what's called a host discovery scan.
Now, a host discovery scan uses the flag -sn.
This is what tells us we want to do a host discovery scan
instead of using the default procedures.
If you only want to perform the host discovery part
and not that port scan, you can use nmap -sn
and then the IP range.
This will suppress that 1,000 port scan
that I talked about using the basic syntax,
using that default behavior.
Now there are lots of other scanning options
that you can utilize wing using Nmap,
and they all rely on these things known as switches.
That is that -sn that I just showed you,
but there's lots of different options as well.
For instance, you might have a list scan, which is -sL,
and this will list the IP addresses from the supplied
target range, and it'll perform a reverse DNS query
to discover any host names associated with those IPs.
So think about this as a DNS lookup.
That's essentially what we're doing here
when we're doing a list scan.
Now the list scan is considered more of a passive
because you're not actually sending probes
directed at the host.
Instead, you're taking their IP range
and you're asking the DNS server to do those
reverse lookups for you, so you're never really touching
the host themself.
Now, another option you can use is what's known as -PS,
and this is a TCP SYN ping.
Now what this does is it's going to probe
all the specific ports that you list in the command,
and it's going to do this using a TCP SYN packet.
This is really helpful because
some networks are going to block
ICMP packets from being used for ping,
and if you try to ping something using the ping command,
it's going to come back as host not found or no response,
but by using something like -PS here,
you can actually use a SYN packet to conduct that
because when you send a SYN packet to somebody,
they're going to send back a SYN-ACK
and then normally you'd send back an acknowledgement request
as an ACK packet and that would finish
the three-way handshake.
Well, here what we're going to do is send out the SYN,
we're going to get back the SYN-ACK
and that tells us that host is alive,
and then we're not going to finish the three-way handshake.
We're not going to send back the acknowledgement,
and that way it's less information that can go towards
that host to figure out who we are.
Now the next one we want to talk about
is using sparse scanning.
Now again, if you want to be more stealthy
and you don't want to do a ping sweep
or a port scan really quickly,
you can actually spread out your timing.
And if I do it over a long period of time,
that can make it harder for detection to occur.
So what we do is we use --scan-delay
and the amount of time we want to wait.
This will issue probes with significant delays
to become much more stealthy
and avoid detection by an IDS or an IPS.
The next one we want to talk about is scan timing,
and this uses the flag -Tn.
This is going to issue probes when using a timing pattern
with that n being the timing pattern you want to utilize.
If you use a zero, that's going to be the slowest.
If you use a five, that's going to be the fastest.
If you use a three, it's somewhere in the middle.
The idea here again, is to try to evade detection
by an IDS, IPS or firewall.
The next flag we're going to talk about is dash -sI,
which is used for a TCP idle scan.
This is another stealthy method,
and this is going to allow the scan
to make it appear like it's coming from a another machine,
which we'll call a zombie.
Now this is going to allow that machine
to pretend like it started the scan
to hide the true identity of the scanning machine.
Essentially, it's a redirection.
We're trying to throw the defenders off our tail
and be a little bit more stealthy as we go.
The next thing we can use is fragmentation,
and this can be done using either of two flags,
either -f or --mtu.
This is a technique that splits that TCP header
of each probe being sent through multiple IP datagrams,
and this will make it harder for an IDS or IPS
to detect you.
Notice a trend here.
The last couple of things we've talked about,
were all about trying to be more stealthy
so we can't be detected as an attacker.
Now the results of a discovery scan should be a list
of IP addresses
and whatever they responded to in regards to the probes.
It'll look something like this.
Notice here I have
nmap -A -T4 scanme.nmap.org.
Notice that -T4.
Which type of scan was that?
That's right, it's a scan timing type of scan.
We're using -Tn,
which tells us in this case -T4
which means it's pretty darn fast.
It's not the fastest, but it's pretty fast.
Now notice the results here.
You'll see that we had two clients that were scanned.
We had scanme.nmap.org and d0ze.
Once we scan those, we got a response from them
and they showed us what interesting packets there were.
And this is giving us more information.
We'll talk more about these port states
and the different services and versions in a later lesson
as we go through and learn more about Nmap.
Now, another thing you got to think about is the way output
is given to you in Nmap.
For instance, this output you're seeing right now
is displayed to the screen,
and this is what is known as interactive.
This is the default setting.
Whenever you run a command, by default it will display it
to the screen, but you don't have to do that.
You can actually send data to a file as well.
You can do this in a normal method using the -oN command.
This flag will say, take what I saw on the screen,
and instead of putting on the screen, put it in a file.
You also can use XML using -oX
and this will put it in an XML format to a file,
or you can use something that is grepable using -oG.
This will allow a grepable format being sent to a file
that you can later then use grep upon to find information.
This is really helpful if you have really large data sets.
Let me give you a quick exam tip.
I know I covered a lot of different flags here.
You're going to have to be very comfortable
with scanning networks and hosts using Nmap.
It is a listed objective inside of the PenTest+ exam,
and they go into a lot of depth and all the different flags.
You really need to understand the concept of Nmap
and what you use it for.
You are going to use Nmap a lot to do your job,
so spending some time and gain comfortable
with some basic information is very critical
and that's why we're going to spend
quite a bit of time on it in this course.