Specifying port ranges to make scans more efficient in this video we will review the pros and cons of
doing a full scan of target hosts even if they don't respond to host discovery we'll use and maps tack
capital F Flegg to perform what's called a fast scan and we'll use n maps top Portes option to narrow
down the number of ports that will be scanned on each host.
In our last video we learned about a few different things and mapped those to figure out whether or
not a host is live on the network.
We also learned about how to use the tech capital P lowercase an option to force and map to scan every
target IPN range whether it responds to a host discovery or not.
Just to close out that discussion.
I wanted to show you how long it took nmap to scan a single class C range with just a few hosts being
live this much time to scan a single subnet.
In my opinion is too long if your project requires you to scan and network to this detail I'd recommend
arranging some sort of remote access to the client's site in order to manage your scans remotely.
Either that or invest in a blow up mattress and ask the client if they mind you sleeping in the breakroom
before we look at ways to scan more efficiently.
Let's revisit something we talked about in previous videos when you run and map with no additional flags
by default and map is going to scan the top 1000 ports these top 1000 ports are defined by the map tech
services list and we previously used this nifty command in order to see what those specific top 1000
ports were.
I'm going to pipe this output to the more command to see output one screen at a time.
Let's say that I know my target environment has nothing but web servers a few email servers and maybe
a couple of database servers.
I might then be able to get away with only scanning the top 100 ports in this list and I can do that
a few different ways.
First I can add the TAC capital F Flegg to my scan which is also referred to as a fast scan
or I can do the same thing by specifying the tack tack top tech Portes flag and add a number of my choosing
like 200
We can also do port specification by calling individual ports or groups of ports with the TAC P Flag.
For example I could scan for web servers with port 80 then add a comma and put in four 4 three for secure
web sites.
Then add another comma and add 53 for DNS servers.
And then let's say I've got a proprietary web app that uses range of ports from sixty five thousand
to sixty five thousand one hundred.
So I specify that port range like so.
Now remember when we're doing our top ports scans we're only hitting TCAP ports by default.
So don't forget about UDP ports which can host important services as well.
If we want to look at that and map services file again and see just the top UDP ports we can issue that
sort command again and then pipe the output to a grepped command that will grab any lines with UDP in
them.
I'm also going to pipe that again to the more command so we can see output one screen at a time.
If we want to scan the top 1000 UDP ports we run and map with the TAC s capital you flake like this.
And then if we wanted to throttle that down to just the top 100 ports we add in the top ports qualifier.
How about if we wanted to hit the top TCAP and UDP ports for a given range but do so in a single command
Well we can simply add a t to this flag which essentially tells and map to scan TCAP ports which is
represented by the T as well as UDP ports represented by the capital you.
So as you can see by limiting the number of ports we scan we can reduce the scope of our scan and make
it more efficient.
In our next video we'll start looking at various ways we can export and report on data collected during
our scans.