Instructor: By now, if you covered all of the Nmap videos
that we did, you should have
an intermediate knowledge of Nmap.
All we are left to do to check out
is just some of the few options that you might find useful
once you're performing your scans,
which we will check out in this video.
And after it, we need to check out two more things.
One of them is running Nmap with scripts,
which part of it we are going to see right now,
with the results of our dash A scan from the previous video.
And the second thing is how we can bypass
firewall IDS and IPS using Nmap.
So for now, we only noticed how we can
perform different scans,
but we never really talked about
what if our target is well secured.
What if they have a firewall?
We want to perform our scans as quietly as possible,
in order for us to not get detected.
But before we jump into all of that,
let us check out the output of our dash A option.
Remember from the previous video,
dash A runs bunch of different things,
such as OS detection, version scan,
and it also runs something called and Nmap scripts.
You will see down here,
that we are getting output that we didn't get before.
So, besides the open port
and the version that the open port is running,
we also get the output of different scripts that are running
on the target, as we execute this scan.
So right now, here we can see that it executed the script
for FTP anonymous login
and it says that it is allowed.
And we will check out what the FTP anonymous login is,
for now on, I can tell you that
it is not really that secure,
even though if we go all the way down,
here it says FTPd 2.3.4,
which is this version that the target has,
is secure, fast and stable.
And I can assure you this is one big lie,
as this FTP version is vulnerable.
And we are going to see in the exploitation section,
how we can exploit this and gain access
to our target machine.
Down here we also get the enumeration of the SSH.
So we get the SSH hostkey, nothing really too useful for us,
the SMTP commands that are allowed,
the SSL ciphers right here,
we also get the HTP servers header, the HTP title.
And these are just some additional information
that we got from running scripts.
If I go all the way down,
we also get information for some other open ports.
And down here, we will see the tower scan
also perform the SMB enumeration.
So we got the computer name, NetBIOS computer name,
domain name, SMB security mode.
Down here we also get the traceroute
to this target's IP address.
And this is the one hop that we have,
since it is in our own network.
It tells us down here that it also performed
the OS and service detection,
and here is the OS detection, but we already saw this.
We got Linux running.
So, this is just some additional information
on top of the information that we already had.
But remember, dash A is an aggressive scan.
It does give us the most output out of any other options,
but it is also pretty aggressive and easily detectable,
if target has some security measures.
Since our metasploitable doesn't have any security measures,
or is not behind any firewall,
this scan is best for targets like that.
So, we got the most information using dash A,
but besides this dash A, let us also check a few more
useful options that Nmap gives us.
And to do that, we're going to run the Nmap manual.
So, type man and then Nmap and it will open up the manual.
Once again, we already know how we can go through it
with upper and lower arrow,
and we're going to just go really quick through it,
and see whether there are any useful options
that we haven't covered but, that you might want to use.
So if you go down here,
this dash SN option is really useful option.
And it is not really useful for discovering vulnerabilities
or open ports.
Matter of fact, this option right here
performs the same thing that our net discover tool did.
Remember?
We use net discover to locate all of the hosts
that are up and running on our network,
and dash SN pretty much does the same thing.
As we can see right here,
this option tells Nmap not do a port scan,
so you will not find out any open ports with this scan.
The only useful thing we get from this
is which hosts are up and running.
So, let's test it out real quick.
And this is a scan that you would use
probably on multiple machines to discover which ones are up
and which ones aren't.
But, you can also use it on one machine if you'd like.
For this scan, I will use my home network, so dash SN,
and then, 192.168.1.1 dash 255.
If I press enter, this should pretty much just a few seconds
and here it is, it'll give us which hosts are currently up.
We get their IP addresses.
So, 192.168.1.10.
This is my laptop.
We get the metasploitable, we get Windows 10 probably
and we get my router.
So instead of net discover, you can use this
to figure out which hosts are up.
But for me personally, I like net discover output
a little bit better than this one.
This right here looks a little bit messy.
Okay so, the second thing that I want to show you
is dash P option,
and this an actual option that you will use a lot.
So for this, we're going to scan our metasploitable.
So change the IP address to the metasploitable IP address,
and what dash P option is, is simply you can specify
what range of port you want to scan with Nmap.
So remember, when we perform any other scan,
its can stop 1000 ports.
But what if we, for example, only wanted to scan one port?
For example, let's say we wanted to scan
port 80 on the metasploitable.
Can we do that?
Well, if you specify dash P, and then 80,
and then the IP address,
here it'll tell us port 80 open,
and service that it is running.
So, we can scan only one port if you want.
This option is useful if you're only attacking one port,
and you don't want to bother really
and let Nmap scan 1000 port,
when you only want to enumerate one single port.
You can also do it on multiple ports, for example,
port 80, port 22, port 100 and let's see what the output is.
And here, we can see port 80 and port 22 are open,
while the port 100 is closed.
We separate different ports with comma,
and instead of separating them with comma,
if you want to scan a range of ports, you can also do this.
You can do port one to port 100.
And, here are the results.
Not shown, 94 closed ports,
and we got six ports that are open in first 100 ports.
And remember when I told you that there are
over 65,000 ports?
Well, this is the option that we can use
in order to scan all 65,000.
If I type the same command,
just I scan from one to 65,535 and press enter.
This scan will take longer than any previous scan
that we did, since it is scanning 65,000 ports.
Here we can see the output, it finished in 7.74 seconds.
And here are all the open ports that it managed to discover.
Here are some of the ports that we never really discovered
with previous scans that we did in last few videos.
So, this is really useful.
If we used regular scans and we only scanned
first 1,000 ports,
We would never really know that these ports are also open.
Now, on the contrary, instead of scanning 1,000 ports
or 65,000 ports, we can use a cool option which is dash F,
and it is capital F.
And, what this option does is instead of scanning
1,000 ports, it scans first 100 ports.
So, in case you want to perform a quicker scan,
and you also want to scan top 100 used ports,
you would use the dash F option.
If I press enter, you can see it finished
in less than one second and it scanned top 100 ports.
Now, this doesn't mean that it's scanned port
from one to 100.
This simply means it's scanned first 100 ports,
that are usually most used.
So, we got 21, 22, 25, 53 and bunch of others, as well.
But, whenever you really want to find out everything you can
about the target, this scan will be more useful.
The one where we scan 65,000 ports,
since you can see there are a lot more ports that are open,
than with this scan.
Okay, cool.
Let me show you one more option
before we proceed to the next video.
And that option is how to output an Nmap scan.
So, there are a few ways that we can do that.
If I run Nmap and then we use the SYN scan,
which we covered.
And let's say with scan metasploitable.
There are two ways that we can do this.
If we want the output to be inside of a file,
we can use two arrows to the right and then,
outputofscan.txt.
Let me see.
You request the scan type which requires root privileges.
So, let us run it with root and press enter,
type in password,
and you will see we get no output to our terminal.
That is because all of the output is stored in this file.
If we use the cat command to output the results,
here is our scan that is being stored inside of this file.
So, this is useful once you want to, for example,
add this to your report.
So, you just save it in a file, and then later on,
copy and paste this on our report.
Another way that you can do this,
in case you want the results to be saved
both in a file and also outputted in your terminal,
we can use the dash oN option, so dash oN.
I'm not sure if it is with capital N or lowercase N.
We're going to check that out with the help menu.
So, let's go to the output settings,
and it is dash oN option.
And we can see right here,
dash oN option is output scan in normal.
So, we can simply just save this in a normal file.
If you want some other file type,
you can use oX for the XML.
And we got some other options here, as well,
that you might find interesting.
For now on, we are just going to check out this one.
So if I go down here,
and type Nmap, dash oN, and then, dash sS.
Of course, we need to run this with sudo,
and we specify 192.168.1.5.
Output file begins with, yeah, we need to specify
the name of the file that we want to save it.
So, let's just call it output.
And here it is, we get the output to our terminal,
but if I also type LS and CAT, the output file,
we also get the results saved inside of this file.
Okay, great.
These are just some of the basic options
that I wanted to mention, since you might find them useful.
And by now, as I already told you,
you can consider yourself an intermediate Nmap scanner.
Now to take this to the advanced level,
we're going to check out, in the next few videos,
how we can bypass Firewall IDS and IPS using Nmap scans.