Scribd
Upload
20 views

Understanding NMAP Commands

Uploaded by

Raihan Patel
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
20 views

Understanding NMAP Commands

Uploaded by

Raihan Patel
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 28

Network Scanning with Nmap

Introduction
⚫ The first step is Information Gathering in
Penetration Testing

⚫ Discover the services which are open or closed


⚫ Version label
⚫ Operation System and its types
Pre Study
⚫TCP Packet
Header
Cont..
⚫ Source and Destination Ports
⚫ Sequence Number and Acknowledgment Number
⚫ Data Offset ,Reserve , Control flag, Window
⚫ Checksum, Urgent Pointer
⚫ Options, Padding
⚫ Data
TCP Flag Definitions

Flag
SYN The beginning of a connection

ACK Acknowledge receipt of a previous packet


or transmission

FIN Close a TCP connection

RST Abort a TCP connection


TCP conversation
Connect Disconnect
Client Server Client Server

SYN FIN

SYN/ACK ACK/FIN

ACK ACK

Connection Established Connection Closed

Three-way handshake
What is nmap?

⚫NMAP is a free and open source utility for network


discovery and security auditing. Like there are too many
devices connected to the network and a pentester or
network administrators will gather a information like
which type of devices, their services uptimes, live
systems, which kind of services are running their with
the help of this utility.
Quick Start Cheat-sheet

⚫ Switch Description Example

⚫ -sS TCP SYN port scan. nmap -sS 192.168.1.1

⚫ -sT TCP Connect port scan nmap -sT 192.168.1.1

⚫ -sU UDP port scan. nmap -sU 192.168.1.1

⚫ -sA TCP ACK port scan. nmap -sA 192.168.1.1


Conti......
⚫Switch Description Example

⚫ -Pn Only port scan. nmap -Pn 192.168.1.1


⚫ -sn Only host discovery. nmap -sn 192.168.1.1
⚫ -PR ARP discovery nmap -PR 192.168.1.1
⚫ -n Disable DNS resolution. nmap -n 192.168.1.1
HOST Scan
This Scan is used to find or identify active host in the
network by sending ARP request packets to all system
in that network. And in result it will show a message
“Host is up” by Receiving MAC address from Each
active host.

Syntax: - nmap -sP target_ip_range


nmap -sn target_ip_range
Port Scan/TCP Scan/Stealth Scan
⚫With the help of this scan, User can Identify open
or close state of a particular port on target machine.

Six Types of Port status


⚫Open
⚫Closed
⚫Filtered
⚫Unfiltered
⚫Open/Filtered
⚫Closed/Filtered
⚫Syntax :-
nmap -p port_number or service_name
target_IP_range
nmap -sT port_number target_IP_range
UDP Scan
⚫This method is used to list all open UDP ports on a
host.With the help of this scan penetration testers
know that they often expose host essential information
or can even be vulnerable moreover used to
compromise a host.

⚫Syntax:- nmap -sU target_IP


XMAS SCAN
⚫This scan is accomplished by sending packets with the
FIN, URG and PUSH flags, if the server sends RST’s
regardless of the port state, then that is not vulnerable to
this type of scan. If the client didn’t get any response,
then the port is considered as open.
⚫Xmas Scan is only workable in Linux machines and
does not work on the latest version of windows
Syntax :- nmap -sX target_IP
NULL Scan
⚫Null scan sends a packet with no flags switched on, if
the server sends RST’S regardless of the port state,
them that is not vulnerable to this type of scan. If the
client didn’t get any response, them the port is
considered as open.

⚫Syntax :- nmap -nS target_IP


FIN Scan

⚫A FIN packet is used to terminate the tcp connection


between source and destination port typically after the
data transfer is complete. In the place of SYN packet,
Nmap starts a FIN scan by using a FIN packet. If the port
is open then no response will come from destination port
when FIN packet is send through source port.

⚫Syntax: - nmap -sF target_IP


OS Detection Scan
⚫Apart from open port enumeration nmap is quite
useful in OS fingerprinting. This scan very helpful to
penetration tester in order to conclude possible
security vulnerabilities and determining the available
system calls to set the specific exploit payloads.

⚫Device type
⚫Running
⚫OS CPE
⚫OS details
Cont..
⚫Syntax: nmap -O target_ip
⚫Syntax: nmap -O -p- –osscan-guess <target>
⚫Syntax: nmap -O –osscan-limit <target>

You might also like