In this lesson, I want to show you hands-on
how we use Nmap
by combining some of those commands we learned about
into a real scan and real information gathering techniques.
Now this is really important, come test day
because I guarantee you're going to get some Nmap questions.
I want you to play with Nmap before the exam.
I want you to be comfortable with it
because these are going to be easy points for you
if you've gotten used to doing these scans.
Now for this demonstration,
I've put together this lab.
On the left side, this is where I'm
going to be attacking from,
which is going to be simulating the Internet.
I'm coming in from outside the network
and the router has certain things
in place to try to keep me out.
I'm going to attack from my Kali Linux command-line
environment, which you can see highlighted
with the red dash lines going to come in through the router,
which is separating the Internet,
the outside versus the target network, which is the inside.
And so with our scans, we're going to try
to discover those three servers on the right,
the Lamp-Server, the Metasploitable2,
and the Damn Vulnerable Web App or DVWA.
Now those all reside inside the 10.10.10.0/24
network. Now that we are in the command line environment,
what are we going to do?
Well, we first are going to want to find out which things
on the 10.10.10.0 network are up
and which ones are down.
So we want to use that ping scan.
Now, do you remember what the command is for a ping scan?
That's right. It's mmap dash sn, and then the IP address.
So for us that's 10.10.10.0/24.
It's going to go through and scan all 254 possible IPs
and find which ones are up and which ones are down.
Now it came back with four hosts. What are those four hosts?
Well, the .1 is the router itself,
it's the internal interface of the router.
There is the .10, which is one of our servers, the .11
and the .12, which is the other two servers.
So the dot 10 is going to represent the Lamp-Server.
The dot 11 is our Metasploitable2 Server
and the dot 12 is going to be our DVWA
or Damn Vulnerable Web App.
Now, all we have at this point is knowing
that those three servers are up and responding to pings.
We have no other information.
So we're going to want to take it a step further.
Let's go ahead and do a SYN scan, which if you remember
of the command is nmap -ss,
and then the IP address that we want to look at.
But I'm going to combine that with port 80.
So I want to figure out what web servers are being run
out of this network.
And then we're going to use the 10.10.10.0/24.
Now as I scan away, it's going to check all
of the 254 IPs again.
And in this case we found there are four
web servers responding.
There's 480 responding up as closed on the router,
it is open on the Lamp-Server, the .10,
it is open on the .11, which is Metasploitable2,
and it is open on .12,
which is the Damn Vulnerable Web App.
So all three of my servers are running at least port 80.
Now let's dig in deeper on one of those servers
as we go further in our information gathering,
let's go ahead and do a SYN scan against the Lamp-Server,
which is the .10.
So we're going to do nmap -sS
and then 10.10.10.10
and we'll go ahead and search that.
And you can see now
that there are more than just the web server running, right?
There are three services running on this server.
There's an SSH server on port 22,
there's the web server on port 80,
and the web proxy on port 8080.
Now that we found those, what about the versions?
What if I wanted to figure out what version
of web server it was running on port 80?
Well, how would we do that?
Well, we're going to use nmap -sV
and then the 10.10.10.10.
And now if we run it,
you're going to see a little bit of a difference here.
So you're going to see it takes a little bit longer
to run this, but instead of half a second,
it's taking almost seven seconds.
The difference here is that I get the versioning
associated with each of those services.
So the same three services are up,
but I found out that it's running some form of Linux
and it's running Apache 2.4.18, which tells me
that I could start associating vulnerabilities associated
with that and attack this machine.
Now it tells me it's Ubuntu Linux,
but it doesn't tell me what version.
What if I wanted to go deeper
and figure out the version
of this operating system, how would I do that?
Well, it's not sV
because that's the version for the service.
Instead, it's -O because it's for the operating system.
So it's nmap -O and then 10.10.10.10.
And then we'll go ahead and hit enter and away it goes.
And it comes back in less than two seconds
and tells me that it is Linux,
somewhere between version 3.2 and 4.6.
So let's go ahead and take it a step further.
Let's combine some commands.
Let's go ahead and do an nmap scan for -sS.
We're also going to do -sV for the versioning
and we're going to go ahead
and add the -O to get the operating system.
I'm going to do that against 10.10.10.10
through 10.10.10.12, those three machines
and see what comes back.
Now you may have noticed that it keeps saying it's unable
to determine any DNS servers.
That's an error
because I don't have this lab environment connected
to the Internet, so there's no DNS being resolved.
It's not an issue because we're using IP addresses,
but if I tried to do something like scanning google.com
right now, it wouldn't be able to give me that answer back
because it doesn't know what the IP address is for Google.
Now this scan is going to take a little bit longer,
so I'm going to fast forward
to when the scan comes back with the results.
Now the results have come back. It took 140 seconds.
So this has come back with a ton of information.
So much so it actually scrolled off my screen.
So we're going to scroll back up to where
I put in the command.
So there we go.
There's the command we put in,
nmap -sS, a SYN scan,
sV, versioning for the services,
O, for operating system versioning,
and then 10.10.10.10 through 10.10.10.12.
Now the first one it comes back with is the results
for 10.10.10.10, which shows
that there are 997 closed ports 'cause by default,
nmap is going to scan the top 1000 commonly open ports.
You'll notice here there was those same three ports
that we found earlier: port 22, port 80, and port 8080.
And you'll notice it tells us what version of SSH
and what version of Apache is being run.
And again, the version of Linux was somewhere
between 3.2 and 4.6, not very accurate.
Now if we look at the bottom of the screen,
I'm going to scroll it up to the top here.
This is the scan report for 10.10.10.11.
Notice this one has a ton of open stuff.
It only has 979 closed ports,
which means that there are 21 open ports
and you'll see them all shown on the screen there.
Things like FTP, and SSH, and Telnet, and HTTP,
and RPC bind, and port 139, and 445
for NetBIOS SSN,
which is Samba
for Windows file sharing between a Linux machine
and a Windows machine.
All of these different things
with all of these different versions.
Now this is a great machine that we can target
because we have a lot of vulnerable apps on it.
Things like Apache 2.2.8,
there's exploits that exist for that.
There's VS FTPD 2.3.4 for the FTP service.
That's a vulnerable version we can attack.
There's pro FTPD 1.3.1,
there's my SQL version 5.0.51, right?
Lots of different pieces of information
that we can use to then later exploit it.
Now, it does say
that one service was unrecognized even though it gave back
data and they weren't really sure what it was
because there wasn't a valid fingerprint,
and you can submit it to nmap for them
to try to figure it out better.
If you know what the service is, you could tell it
and then they can add that to the next version of nmap.
Now, as we scroll down a little bit further,
we'll go through that signature that they gave us
and you can see that the version
of Linux here was again version 3.2 to version 4.6.
And so that again, wasn't real helpful.
And the reason why we're getting that wide range
of operating systems
is because this is all actually being run
in a Docker environment,
so they're all sharing the same operating system.
This is a container-based virtualization.
Now as I scroll on down, we're going to see the results
for 10.10.10.12,
and this one only has one port that's open
and it's running Apache version 2.4.10.
So again, we can go
and look for something that would be able to be exploited
and go after that server using that.
So that's the idea here as we start scanning
and figuring out all this information.
Now all that was a lot of information to put on the screen.
Wouldn't it have been helpful if I output
that into a grepable file?
Well, certainly it would.
For any of these commands,
we could have output this to a file
and that way we'd have it for our reference later on.
Because when you go back a couple days from now,
you're not going to remember what ports were open
on any of these machines, right?
That's why having these files will be helpful.
So instead I'm going to use nmap -sS
p port 80, and I want to get the versioning of that
and I'm going to look at that on 10.10.10.10
through 10.10.10.12
and I want to output that to grepable format
and I'll just call that
outputnmap.txt.
We'll go ahead and enter, it will run that scan.
And in addition to putting it to the screen
that I can see it,
it will also save it into that grepable file.
Now, how do I find that grepable file?
Well, let me go ahead and clear my screen here.
And if we do ls in Linux, that will list our directory.
And you'll see here output nmap is listed right there.
And so I can just use Pico, which is an editor,
and just type in outputnmap.txt
and hit Enter.
And there it is to the screen.
Notice it looks different here because it's grepable,
they removed a lot of those new lines,
they removed a lot of the special formatting
and they made it really easy for us
to find the information we want.
For example, we have the hosts on the left,
very clean, status was up or status was down.
And then we have the ports that were open, right?
Port 80, it's open, it's TCP,
and it was an HTP service running this version of Apache.
So you can see why this grepable format
is very, very useful.
Now, from here I want you to download nmap.
I want you to play with it.
Scan things inside your home network,
scan authorized websites like scanme.nmap.org,
and get used to using nmap
because it's going to be essential
to your success on the exam.
I promise you,
you're going to get some questions about nmap,
including which syntax options you need to use
to create certain types of output.
Or they might even ask you to read the output
of an nmap scan and determine
what services are most vulnerable to an attack.
nmap is a huge part of conducting information gathering
and performing basic vulnerability scanning
of operating systems, servers, and network devices.
So make sure you're comfortable with using it
before you take the exam.