Throughout the course, we’re going to learn how to use NMAP in detail to scan the networks. NMAP
"Network Mapper" is a free and open source utility for network discovery and security auditing. Many systems
and network administrators also find it useful for tasks such as network inventory, managing service
upgrade schedules, and monitoring host or service uptime. NMAP runs on all major computer operating
systems, and official binary packages are available for Linux, Windows, and Mac OS X. Nmap has been used
to scan huge networks of literally hundreds of thousands of machines. Nmap is usually very good at documentation.
documentation.
Significant effort has been put into comprehensive and up to date man pages, white papers, tutorials and
even a whole book. You can visit nmap.org to find out more about Nmap. While Nmap comes
no warranty.
It is well supported by a vibrant community of developers and user.
It's one of the most well-known tools of the network security domain and indeed with a lot of facilities
it's very powerful.
In addition to the classic command-­line Nmap executable, the Nmap suite includes an advanced GUI
and results viewer Zenmap. A flexible data transfer, redirection, and debugging tool (Ncat), a utility for
comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping). Nmap
uses raw IP packets in novel ways. To determine what hosts are available on the network, which ports
of these hosts are accessible, what services those hosts are offering,
what operating systems are running what type of packet filters / firewalls are in use and dozens of other
characteristics.
Beyond all these, Nmap has its own scripting engine and allows developers to develop new modules.
In the following lectures to discover the network will perform the following with Nmap.
First we'll use Ping's scans to find out the host in the network. Then we'll use different types of port
scan to find the open or accessible ports. We will detect the services running on the port and their versions.
We'll try to learn the operating system is running on the systems.
After that, we’ll see how to use scripts with Nmap scans. And we’ll learn some important scripts as well.
Nmap sends some packets to discover the network. To prevent security devices from blocking our packets,
Here's where we're going to learn some timing tricks.
Then we’ll see what we can do more to bypass security devices such as packet filters,
IDS or IPS.
Here there is an NMAP command example.
Let’s see some basic parameters of the Nmap command. “nmap” is, of course, the command itself.
“-s” is to define the scan type. If you use -­s with T (uppercase T) as seen in the slide, it means, you want to run a TCP scan.
We’ll see the important scan types in detail.
If you don't use this parameter and you have the administrator privileges on the computer where you're
using Nmap, SYN scan is the default scan type. If you don’t have the admin privileges on the computer, TCP
TCP scan will run. Destination IP address is the only required parameter to run this command.
It means, you can run the Nmap command like “nmap 172.16.99.139”.
This is the IP address of the target machine which you want to scan.
You can either give a single IP address or give an IP block or an IP range as a target but we'll see
that soon.
Destination ports are the port number that you want to scan. If the target port numbers are not given
to the command, top 1000 ports will be scanned.
Be careful.
I didn’t say ”first 1000 ports”, I said “top 1000 ports”. That means
That means the most used thousand ports will be scanned.
There are different ways to enter destination ports and we'll see them in detail.