NMAP COMMANDS

NMAP

At its core, Nmap is a network scanning tool that uses IP packets to identify all the devices connected to a network and to provide information on the services and operating systems they are running.

The program is most commonly used via a command-line interface (though GUI front-ends are also available) and is available for many different operating systems such as Linux, Free BSD, and Gentoo. Its popularity has also been bolstered by an active and enthusiastic user support community.

Nmap was developed for enterprise-scale networks and can scan through thousands of connected devices. However, in recent years Nmap is being increasingly used by smaller companies. The rise of the IoT, in particular, now means that the networks used by these companies have become more complex

Nmap (“Network Mapper”) is a free and open-source utility for network discovery and security auditing. It is a globally recognized tool mostly used by networking experts and penetration testers to find services, hosts, and open ports on a computer network. Network mapper allows its users to discover which devices are running on the network, find vulnerabilities, and detect installed services. 

But before we move ahead, a brief history about Nmap. It was first introduced by network security expert Gordon Lyon in Phrack magazine in September 1997. With its latest release in August 2021, it has evolved very much.

Nmap was originally written in C, C++, Python, and Lua programming languages. It is a widely acknowledged open-source networking tool. Network mapper can run on Windows, Mac OS, Gentoo, and BSD but it is highly popular in Linux. 

But before we move ahead, a brief history about Nmap. It was first introduced by network security expert Gordon Lyon in Phrack magazine in September 1997. With its latest release in August 2021, it has evolved very much.

Nmap was originally written in C, C++, Python, and Lua programming languages. It is a widely acknowledged open-source networking tool. Network mapper can run on Windows, Mac OS, Gentoo, and BSD but it is highly popular in Linux. 

But why should YOU learn about NMAP? 

So, if you are planning to launch your career in hacking, this revolutionary tool can be super useful to you. And even if your aim is just to expand your cyber security and networks knowledge, knowing the basics of Nmap can be a good idea. 

“Fixing a hole is far more effective than trying to hide it. That approach is also less stressful than constantly worrying that attackers may find the vulnerabilities.” But, now the question arises how you can scan your network using Nmap?

To scan your network using Nmap, you have to first install it on your computer. Visit nmap.org and download Nmap for your operating system. And then you can use the appropriate Nmap command to perform the required task. 

However, if you are using Kali Linux or parrot OS, it comes pre-installed.

What Does Nmap Do?

At a practical level, Nmap is used to provide detailed, real-time information on your networks, and on the devices connected to them.

The primary uses of Nmap can be broken into three core processes. First, the program gives you detailed information on every IP active on your networks, and each IP can then be scanned. This allows administrators to check whether an IP is being used by a legitimate service, or by an external attacker.

Secondly, Nmap provides information on your network as a whole. It can be used to provide a list of live hosts and open ports, as well as identifying the OS of every connected device. This makes it a valuable tool in ongoing system monitoring, as well as a critical part of pentesting.

Thirdly, Nmap has also become a valuable tool for users looking to protect personal and business websites. Using Nmap to scan your own web server, particularly if you are hosting your website from home, is essentially simulating the process that a hacker would use to attack your site. “Attacking” your own site in this way is a powerful way of identifying security vulnerabilities.

How To Install Nmap

The process for installing Nmap is easy but varies according to your operating system.

  • For Windows, Nmap comes with a custom installer (namp<version>setup.exe). Download and run this installer, and it automatically configures Nmap on your system.
  • On Mac, Nmap also comes with a dedicated installer. Run the Nmap-<version>mpkg file to start this installer. On some recent versions of macOS, you might see a warning that Nmap is an “unidentified developer”, but you can ignore this warning.
  • Linux users can either compile Nmap from source or use their chosen package manager. To use apt, for instance, you can run Nmap –version to check if Nmap is installed, and sudo apt-get install Nmap to install it.

Nmap is straightforward to use, and most of the tools it provides are familiar to system admins from other programs. The advantage of Nmap is that it brings a wide range of these tools into one program, rather than forcing you to skip between separate and discrete network monitoring tools.

In order to use Nmap, you need to be familiar with command-line interfaces. Most advanced users are able to write scripts to automate common tasks, but this is not necessary for basic network monitoring.

Features of Nmap

  1. Find security issues – It warns users against external attackers. Nmap scans the server and finds out the path that hackers might use to attack their server.
  2. Identify open ports– port scanning of target hosts is very easy with the help of Nmap.
  3. Detect Vulnerabilities – To detect security vulnerabilities in the network, Nmap is the best choice.
  4. Host discovery – Live hosts in the network can be discovered using Nmap.
  5. OS Version Detection – Operating system and version detection are also possible through this network mapper.
  6. Provide crucial information – Nmap also provides additional information such as devices types, reverse DNS (Domain Name System) names, MAC addresses, and IP addresses of all active hosts.

1) WHAT IS AN NMAP COMMAND?

Before we try and explore the various Nmap commands, we should get acquainted with the term first. It is an open-source monitoring tool that can help scan and discover networks and network problems, respectively.

2) NMAP COMMAND IN LINUX

Linux being an integral part of the designing and digital world, many coders still use this platform to perform various tasks. Some Nmap commands can make operations easier on this platform. Here is the Nmap command in Linux that can help you in installation.

  • CentOS/Fedora: sudo dnf install nmap
  • Ubuntu/Debian: sudo apt-get install nmap

The Nmap commands for Windows are slightly different, but they are not as complex as this one because of the automated downloader that helps install Nmap within seconds. 

3) NMAP COMMANDS FOR SYSTEM ADMINISTRATORS WITH EXAMPLES

We have established an understanding of what Nmap is and how we can use it. Here are some basic Nmap commands that administrators can use to their advantage. 

1. NMAP PORT SCAN COMMAND

If you wish to scan a port or even an entire port range on remote or local servers, you will have to execute the Nmap port scan command. Here is what the Nmap port scan command will be:

nmap -p 1-65535 localhost

Now, in this example, you scanned 65535 ports on the local host computer. You can change the values according to your need, and the number of ports getting scanned will also change completely. Nmap command to scan all ports can also help execute the process better and in an easy way.

2. NMAP SCAN AGAINST HOST AND IP ADDRESS

While this is included in the Nmap basic commands, the scan against the host or IP address can come in handy. The command that can help in executing this process is:

nmap 1.1.1.1

The above example is for the host’s IP address, but you will just have to replace the address with the name when you wish to scan the hostname. 

For, e.g., 

nmap cloudflare.com

3. PING SCAN USING NMAP

The Nmap command list is vast and extensive. Several examples can be listed, but if you wish to ping scan using Nmap, here is what you need to do: 

nmap -sp 192.168.5.0/24

This is probably one of the most used and popular Nmap commands to help host detection on any network. 

4. MULTIPLE IP ADDRESS SCAN

The list of Nmap commands also includes the IP address scanner. If you wish to scan one IP address, follow the code given in point number 2, but if you have multiple IP addresses to scan, you need to follow the steps listed below. 

nmap 1.1.1.1 8.8.8.8

This syntax will help in scanning multiple addresses. You do have other syntaxes for consecutive IP addresses. 

5. SCANNING IP RANGE

A Nmap scan command helps in scanning the entire IP range. This syntax will help in knowing the entire CIDR range of IP addresses. Example:

nmap -p 8.8.8.0/28

Like the other syntaxes, even in IP range scanning, you will have to select the random ranges. Several syntaxes can help scan alternate IPs in the range, and some others can scan consecutive IPs. 

6. POPULAR PORTS SCANNING

There is a syntax for everything in Nmap, but you will have to use the one given below for popular ports scanning. 

nmap –top-ports 20 192.168.1.106

Using top ports with specific numbers can help the user scan the top ‘X’ number of the common ports in the given example. You can replace the number 20 from the above syntax, and here are the outputs that can be expected.

[root@securitytrails:~]nmap –top-ports 20 localhost

Starting Nmap 6.40 ( http://nmap.org ) at 2018-10-01 10:02 EDT

Nmap scan report for localhost (127.0.0.1)

Host is up (0.000016s latency).

Other addresses for localhost (not scanned): 127.0.0.1

PORT     STATE    SERVICE

21/tcp   closed   ftp

22/tcp   closed   ssh

23/tcp   closed   telnet

25/tcp   closed   smtp

53/tcp   closed   domain

80/tcp   filtered http

110/tcp  closed   pop3

111/tcp  closed   rpcbind

135/tcp  closed   msrpc

139/tcp  closed   netbios-ssn

143/tcp  closed   imap

443/tcp  filtered https

445/tcp  closed   microsoft-ds

993/tcp  closed   imaps

995/tcp  closed   pop3s

1723/tcp closed   pptp

3306/tcp closed   mysql

3389/tcp closed   ms-wbt-server

5900/tcp closed   vnc

8080/tcp closed   http-proxy

7. SCANNING IP ADDRESSES AND SCAN HOST FROM A TEXT FILE

Nmap is proficient in the scanning process; one can use a few of its syntaxes to read text files. The only thing that you need to keep in mind is that it contains IPs and hosts inside. To use this Nmap command, you need first to create a list.txt file and ensure that the file contains this syntax:

192.168.1.106

cloudflare.com

microsoft.com

securitytrails.com

The iL parameter in the syntax will help you read the file and scan the host simultaneously. The syntax is:

nmap -iL list.txt

8. DISABLING DNS NAME RESOLUTION

If you have a lot of scans to perform, you will need to speed up your scans. To speed your scans up, you will have to disable the reverse DNS for the scans you do. Make sure to include the “-n” parameter. Here is the syntax that can be used:

[root@securitytrails:~]nmap -p 80 -n 8.8.8.8

Starting Nmap 7.60 ( https://nmap.org ) at 2018-10-01 09:15 -03

Nmap scan report for 8.8.8.8

Host is up (0.014s latency).

PORT   STATE    SERVICE

80/tcp filtered http

If you want to see the difference between the scan speeds of disabled and enabled DNS-resolution then here it is: 

[root@securitytrails:~]nmap -p 80 8.8.8.8

Starting Nmap 7.60 ( https://nmap.org ) at 2018-10-01 09:15 -03

Nmap scan report for google-public-dns-a.google.com (8.8.8.8)

Host is up (0.014s latency).

PORT   STATE    SERVICE

80/tcp filtered http

9. SAVING THE RESULT TO A FILE

Nmap command use has become a crucial part of the coding world. If you want to save the results, here is how you can do it:

nmap -oN output.txt securitytrails.com

This command will help you in exporting or saving the result from a file and not reading it. 

10. DETECTION OF SERVICES

From the Nmap full scan command to the Nmap help command, there is something for everything you want. Similarly, detection of services is also a command that people extensively use. You can easily execute the detecting services by using the -sV parameters. The syntax for the same is: 

nmap -sV localhost

A good and an expressive example for this syntax is given below:

[root@securitytrails:~]nmap -sV localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2018-10-01 09:28 -03

Nmap scan report for localhost (127.0.0.1)

Host is up (0.000020s latency).

Other addresses for localhost (not scanned): ::1

Not shown: 997 closed ports

PORT STATE SERVICE VERSION

111/tcp open rpcbind 2-4 (RPC #100000)

631/tcp open ipp CUPS 2.2

902/tcp open ssl/vmware-auth VMware Authentication Daemon 1.10 (Uses VNC, SOAP)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/.

Nmap done: 1 IP address (1 host up) scanned in 7.96 seconds.

You can use this code as a Nmap os detection command.

11. SCANNING USING UDP AND TCP

One of the best things is the Nmap command to check open ports, and the second-best thing about Nmap is its power to work with TCP and UDP without any hiccups. Several services are limited to just TCP, but people understand the advantage of scanning UDP-based services. Here are the examples of both these services that are allowed by Nmap.

The output you get when you scan using standard TCP:

[root@securitytrails:~]nmap -sT 192.168.1.1

Starting Nmap 7.60 ( https://nmap.org ) at 2018-10-01 09:33 -03

Nmap scan report for 192.168.1.1

Host is up (0.58s latency).

Not shown: 995 closed ports

PORT STATE SERVICE

80/tcp open http

1900/tcp open upnp

20005/tcp open btx

49152/tcp open unknown

49153/tcp open unknown

Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds.

Now, when you do the same process using UDP:

[root@securitytrails:~]nmap -sU localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2018-10-01 09:37 -03

Nmap scan report for localhost (127.0.0.1)

Host is up (0.000021s latency).

Other addresses for localhost (not scanned): ::1

Not shown: 997 closed ports

PORT STATE SERVICE

68/udp open|filtered dhcpc

111/udp open rpcbind

5353/udp open|filtered zeroconf

12. USING NMAP FOR CVE DETECTION

Many system administrators are unaware of this feature offered by Nmap — detection of CVE. It is one of the best features that is under-utilized by people. There is a predefined script present in the command in Nmap that allows users to execute this process. One can use these predefined scripts or own their Lua programming language to derive a specific functionality that can help in CVE detection. Listed below is the command that you need to use:

nmap -Pn –script vuln 192.168.1.105

The best example to understand the command is listed below:

[root@securitytrails:~]nmap -Pn –script vuln 192.168.1.105

Starting Nmap 7.60 ( https://nmap.org ) at 2018-10-01 09:46 -03

Pre-scan script results:

| broadcast-avahi-dos:

| Discovered hosts:

| 224.0.0.251

| After NULL UDP avahi packet DoS (CVE-2011-1002).

|_ Hosts are all up (not vulnerable).

Nmap scan report for 192.168.1.105

Host is up (0.00032s latency).

Not shown: 995 closed ports

PORT STATE SERVICE

80/tcp open http

|_http-csrf: Couldn’t find any CSRF vulnerabilities.

|_http-dombased-xss: Couldn’t find any DOM based XSS.

| http-slowloris-check:

| VULNERABLE:

| Slowloris DOS attack

| State: LIKELY VULNERABLE

| IDs: CVE:CVE-2007-6750

| Slowloris tries to keep many connections to the target web server open and hold

| them open as long as possible. It accomplishes this by opening connections to

| the target web server and sending a partial request. By doing so, it starves

| the http server’s resources causing Denial Of Service.

|

| Disclosure date: 2009-09-17

| References:

| http://ha.ckers.org/slowloris/

|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750

|_http-stored-xss: Couldn’t find any stored XSS vulnerabilities.

|_http-vuln-cve2014-3704: ERROR: Script execution failed (use -d to debug)

1900/tcp open upnp

20005/tcp open btx

49152/tcp open unknown

49153/tcp open unknown

13. HOW TO LAUNCH DOS WITH NMAP

One thing that Nmap will never have a shortage of is the number of features. From Nmap commands cheat sheet to termux Nmap commands, there are several features on all the platforms available on Nmap. Apart from every other command that is executed on Nmap, you get a chance to launch DOS files on this platform. This can be done against the network testing. 

The command that you will have to follow to get this done is:

nmap 192.168.1.105 -max-parallelism 800 -Pn –script http-slowloris –script-args http-slowloris.runforever=true

14. BRUTE FORCE ATTACKS LAUNCHING

You can also use Nmap to launch a brute force attack. Its command is different on different browsers.

For doing this process on wordpress you will have to use command: 

nmap -sV –script http-wordpress-brute –script-args ‘userdb=users.txt,passdb=passwds.txt,http-wordpress-brute.hostname=domain.com, http-wordpress-brute.threads=3,brute.firstonly=true’ 192.168.1.105

Brute force attack against MS-SQL:

nmap -p 1433 –script ms-sql-brute –script-args userdb=customuser.txt,passdb=custompass.txt 192.168.1.105

Brute force attack against FTP:

nmap –script ftp-brute -p 21 192.168.1.105

Drop your comment

Related Post

Leave a Reply

Your email address will not be published.