One of the very first steps in any network reconnaissance mission is to reduce a set of IP ranges into
a list of active or interesting host scanning every part of every single IP address it's slow and usually
unnecessary.
In No Port Scan option, using -­sn option which was known as -­sP.
In previous releases, you tell Nmap not to do a port scan after host discovery, and only print out
the available hosts that responded to the host discovery probes. This scan type is often known as a “ping scan”.
Systems administrators often find this option valuable as well.
It can easily be used to count available machines on a network or monitor server availability.
This is often called a ping suite and is more reliable than pinging the broadcast address because many
hosts do not reply to broadcast queries.
The default host discovery done with -­sn is executed by a privileged user, it sends
an ICMP echo request, TCP SYN packet to port 443, TCP ACK packet to port 80, and an ICMP timestamp
request by default.
When executed by an unprivileged user, only SYN packets are sent (using a connect call) to ports 80 and 443
443 on the target.
When a privileged user tries to scan targets on a local ethernet network, ARP requests are used unless
send -­IP was specified.
Let’s perform the first Nmap scans of the course using Ping Scan, also known as, no port scan. Nmap
is embedded in Kali and defined in the path,
so you can run Nmap from anywhere by just typing “nmap” in a terminal screen. When you type nmap
and hit enter.
You get the help page of the map.
You can also look at the man page by typing men and map to learn more.
Let’s build an nmap command to perform a ping scan: After the command itself, nmap,
I first add the parameter to define the scan type as ping scan.
Note that the order of the parameters is not important in Nmap. • Now, enter the only mandatory parameter:
IP address. Here I enter 172.16.99.0/24. Network gurus already know what it is.
Keeping it very simple, it means, the IP addresses between 172.16.99.0 and 172.16.99.255
That's enough.
Hit enter and run the command
and the results are in.
These are the hosts which up.
That means these are the systems that responded to our request. Remember from the previous slide,
our requests are ICMP echo, SYN for port 443, ACK for port 80 and ICMP timestamp requests,
if the user is privileged. the IP addresses or the domain names of the systems are spread across a line.
In most cases we want to see the IP addresses of the hosts as a list to use in further scans.
So what can we do to see only the IP addresses of the live systems.
Well we're going to use the power of the Linux command shell. First let's clear some lines of the result
which do not contain IP addresses. So will only have the lines of IP addresses to be able to do this.
I’ll use “grep” command with “pipe”. Copy a static part of the IP lines, for example, “Nmap scan”, and give
it as the parameter of grep command.
Let me give you a little tip here if you're using a mouse.
Select a string in the terminal screen and press the middle button of the mouse to copy and paste the
selected part.
Now we only have the lines which contain the IP addresses.
But wait a second we have a domain name of a host.
Let's get rid of the domain name and see only the IP address of it.
In nmap command, add -­n parameter to avoid the name resolution, so
so nmap will display only the IP address.
Now we have the lines with IP addresses.
Now the second step is to clear the wo rds in the lines to have only the IP address. To do this, we’ll
use the “cut” command of the Linux shell.
Delimiter.
Here is the space character give it with the ­d parameter.
IP is the 5th field of the line, give it with ­f parameter.
Now we have the IP list of live hosts.