Nmap – Port Scanner

Overview

Nmap is a popular tool used by both beginners and professional penetration testers for information gathering. Nmap is mainly used as a port scanner, finding open and closed ports and what services are running on them. But Nmap also has many scanning features such as identifying the geolocation of the device, scanning for vulnerabilities (like SSL Heartbleed) and more.

Nmap Cheat sheet (Most relevant port scanning commands)

  • -O (OS detection)
  • –sV (returns the version of the applications/service running on the port)
  • -sT (TCP connect port scan, full three-way handshake scan)
  • -p <port number/range> (allows specifying ports to scan)
  • -n (do not resolve the domain name)
  • -sn (Disable port scanning)
  • -sP (ping the hosts only)
  • -f (Request with fragmented packets → Harder for packet filters to detect)
  • –reason (provide reasons for its decision on open or closed ports)
  • –script <script> (Runs a script provided by nmap)
    • For example:
      • –script ssl-heartbleed (Find SSL heartbleed vulnerability)
      • –script ip-geolocation-* (Find the geographical location of the target device)
  • -oX <filename> (Save results to a XML file)
  • -oN <filename> (Save results to a TXT file)
  • -oG <filename> (Save results to a TXT file – in GREPable format)
  • -oS <filename> (Save results to TXT file – in script kiddie format)

How to use Nmap

The target used in the example is a web application hosted locally with an IP address of 192.168.1.128. It is called bWAPP and is a broken web application used for penetration testing.

To use Nmap, the command format is

nmap [options] <IP address/Domain>

For example, the command used for a simple port scan is

nmap 192.168.1.128

As seen above, Nmap found many ports that are open and the services that are running on them. Do note that the service stated may not be accurate. Nmap is merely stating the common/default services that run on that port. For example, the server could use port 80 for SSH but Nmap would not know. Thus, you may need to probe the port further to verify the service that is running on the port.

For a more extensive scan, you can use the command

nmap 192.168.1.128 -sV -O -sT -f --reason --script ip-geolocation-* -oN C:\Users\dexte\Downloads\nmapTest2.txt

This command is more complex so I suggest taking the time to refer back to the Nmap cheat sheet.

In summary, what this command does is:

  • Scan the target using fragmented packets so as to avoid being detected (-f)
  • Scan for the operating system of the target (-O)
  • Scan the ports with a full 3-way handshake (-sT), give a reason for the suggested service running (–reason), and find the version of the service (-sV)
  • Scan for the geo location of the target device (–script ip-geolocation-*)
  • Output the report as a TXT file called “nmapTest2.txt” (-oN <filename>)

With this amount information, you will be able to understand your target quite well and start finding ways to attack and exploit your target.

Report examples produced by Nmap

Here are the examples of the report formats produced by Nmap.

Normal TXT file (-oN <filename>)

GREP TXT file (-oG <filename>)

Script Kiddie TXT file (-oS <filename>)

XML file (-oX <filename>)

Nmap Help Menu

┌──(kali㉿kali)-[~]
└─$ nmap -h                                                           
Nmap 7.92 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
  --traceroute: Trace hop path to each host
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sU: UDP Scan
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idle scan
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b <FTP relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
  --exclude-ports <port ranges>: Exclude the specified ports from scanning
  -F: Fast mode - Scan fewer ports than the default scan
  -r: Scan ports consecutively - don't randomize
  --top-ports <number>: Scan <number> most common ports
  --port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity <level>: Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
  -sC: equivalent to --script=default
  --script=<Lua scripts>: <Lua scripts> is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=<Lua scripts>: Show help about scripts.
           <Lua scripts> is a comma-separated list of script-files or
           script-categories.
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take <time> are in seconds, or append 'ms' (milliseconds),
  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T<0-5>: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <numprobes>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second
FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
  --data <hex string>: Append a custom payload to sent packets
  --data-string <string>: Append a custom ASCII string to sent packets
  --data-length <num>: Append random data to sent packets
  --ip-options <options>: Send packets with specified ip options
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP/SCTP checksum
OUTPUT:
  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --reason: Display the reason a port is in a particular state
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --noninteractive: Disable runtime interactions via keyboard
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Nmap.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  -6: Enable IPv6 scanning
  -A: Enable OS detection, version detection, script scanning, and traceroute
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  --unprivileged: Assume the user lacks raw socket privileges
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  nmap -v -A scanme.nmap.org
  nmap -v -sn 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -Pn -p 80
SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES

Conclusion

Nmap is an awesome information-gathering tool for penetration testing. No matter the penetration test, you can always rely on Nmap to give you baseline information about your target. Nmap has a lot more functions and scripts to find various information about your target so I recommend you to read more about Nmap to fully use its potential and improve your penetration test.

Nmap Resources

Nmap Website: https://nmap.org/

Nmap Kali Linux Page: https://www.kali.org/tools/nmap/

Nmap source Repository (Github): https://github.com/nmap/nmap

Related Articles

5 Popular Open Source Tools for Reconnaissance

Wappalyzer – Website Technology Identifier for Pentesting

How to use OWASP ZAP – Open Source Vulnerability Scanner 

DNSenum – DNS Information Gathering

Nikto – Web Application Vulnerability Scanner

Leave a Reply

Your email address will not be published. Required fields are marked *