NMAP Learning

Introduction : Nmap Tutorial For Beginners
Tuesday, June 25, 2024 4:11 PM
But the VMs in NAT mode and not in Host only mode.
New Section 1 Page 1

What is passive vulnerability scanning?
Passive vulnerability scanning captures traffic transversing the network and analyzes that traffic, looking for known vulnerabilities. Examples of passive vulnerability
scanning include capturing traffic over the air, looking for rogue WiFi Access Points, or capturing traffic over the wired network, checking only the latest TLS version
is in use.
Passive vulnerability scans detect network weaknesses without disrupting normal network operations.
What is active vulnerability scanning?

Active vulnerability scanning sends out packets in an attempt to get the network to respond. It analyzes the network responses, looking for known vulnerabilities. An
example of active vulnerability scanning is sending an ICMP message with the IP address of a firewall and seeing if the firewall responds.
Active vulnerability scans look for a weakness rather than wait for the weakness to appear. Therefore, active scanning is more effective at finding vulnerabilities than
passive scanning. Active vulnerability scans can also be used to simulate a network attack or to help assess how a hacker penetrated the network after a breach has
occurred.
Passive Scan : Wireshark

Passive Scan : ARP Tables
Active Scan : Nmap Tutorial

Scanning SYN packet on port range 0 to 500
-S = Syn scan
Xmas scans derive their name from the set of flags that are turned on within a packet. These scans are designed to manipulate the PSH, URG and FIN flags of the TCP header.
-X = Xmas scan
SYN flood attack done via hping
First check the response time on www.owaspbwa.com using ping and HTTP access browsing through pages.
--flood (send packets as fast as possible. Don show replies)

-S (Send SYN packets)

-S (Send SYN packets)
-V (verbose mode)
--rand-source (random source address mode). [Distributed attack]
During attack we will experience slowness in speed.

Wednesday, June 26, 2024 12:35 PM
By default if the destination port is not mentioned, NMAP will scan top 1000 ports (note: top not the first 1000)

Fast Scan scans top 100 ports. Fast Scan is same as
To scan all the ports open on a system:

TCP Scan (TCP Connect Scan)
Wednesday, June 26, 2024 5:44 PM
TCP Scan (TCP Connect Scan)

• Also known as TCP Connect Scan, it's the default TCP scan type when SYN scan is not an option.
> Syn scan requires privilege user (to interrupt TCP handshake)
• Uses the underlying operating system to establish a connection with the target machine and port
• Does not require privileged user access
• Less efficient than SYN scan and may take longer to obtain the same information
• Target machines are more likely to log the connection
How TCP Connect Scan Works

• Sends a SYN packet to open a real connection
• Waits for a response (SYN-ACK indicates an open port, RST indicates a closed port)
• If no response is received, the port is marked as filtered
• If a SYN-ACK is received, an ACK packet is sent to complete the three-way handshake
• A RST packet is sent to end the conversation
Comparison with SYN Scan

• SYN scan interrupts the three-way handshake, while TCP Connect Scan completes it
• SYN scan does not establish a connection, while TCP Connect Scan does
• SYN scan requires privileged user access, while TCP Connect Scan does not
• SYN scan is more stealthy, while TCP Connect Scan is more likely to be logged by the target machine
Nmap TCP Scan Example

• Uses the nmap command with the -t option for TCP scan
• Can be used to scan a single system or a range of systems
• Can be filtered to show only open or closed ports
• Can be used to scan specific ports or a range of ports

UDP Scan
Thursday, June 27, 2024 3:29 PM
UDP Scan is slower than SYN scan or TCP scan.

Version Detection (Detection & Management)
Thursday, June 27, 2024 8:49 PM
Without Version Detection
With Version Detection (Takes Longer)

Operating System Detection (Detection & Management)
Friday, June 28, 2024 12:24 PM
One of the NMAP's best known features is remote OS detection using TCP IP stack fingerprinting.
NMAP sends a series of TCP and UDP packets to the remote host and examines practically every bit of the responses after performing dozens of tests such as TCP ISN sampling,
TCP option support and ordering IPID sampling and the initial window size check.
NMAP compares the results to its NMAP OS db database of more than 2600 known OS fingerprints and prints out the OS details if there's a match.
Each fingerprint includes a free-form textual description of the OS and a classification which provides the vendor name, OS generation, and device type
• Nmap sends TCP and UDP packets to a remote host and examines the responses to detect the operating system (OS)
• Nmap compares the results to its database of over 2600 known OS fingerprints
• Each fingerprint includes a free-form textual description of the OS and a classification with vendor name, OS generation, and device type
• Using the --os-scan-guess parameter with OS detection can provide more accurate results

Scanning a Windows System

Input Output Management (Detection & Management)

-iL <inputfilename> (Input from list)

-sn (No port scan)
This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to t he host discovery probes. This is often known as a “ping scan”
-Pn (No ping)
This option skips the host discovery stage altogether. Normally, Nmap uses this stage to determine active machines for heavier scanning and to gauge the speed of the network.

Script Scanning
NMAP Scripting Engine (NSE)
First Script Scanning

Second Script Scanning

Third Script Scanning

Bypassing IPSIDS Device
Monday, July 1, 2024 9:20 PM
Coping with Network Security Devices

• Firewalls and packet filtering can make network mapping and scanning difficult
• Nmap offers features to help understand complex networks and verify filter effectiveness.
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)

• IDS and IPS can detect Nmap scans, but attackers can bypass them with patience, skill, and certain Nmap options.
• IDS and IPS can produce false positive results, making it a challenging problem for administrators.
Bypassing Security Measures

• Timing techniques can improve scan times and make them less detectable by security devices
• Fragmentation ( -f option) can split TCP headers into smaller packets to evade detection
• Using well-known ports as source ports can exploit misconfigured firewalls
• Randomizing hosts ( --randomize-hosts option) can make scans less obvious to network monitoring systems
• Spoofing scans ( -S option) can make targets think someone else is scanning them
• Analyzing TTL values can help identify security measures
• Using invalid TCP or UDP checksums ( --badsum option) can identify firewalls or IDS that don't verify checksums

Timing
Tuesday, July 2, 2024 10:19 AM
Correct Timing in Nmap Scans

• Importance of correct timing for accuracy and effectiveness of scans
• Different timing approaches for outside scans (slow) and internal network scans (quick)
Timing Templates
• Nmap offers six timing templates: paranoid, sneaky, polite, normal, aggressive, and insane
• Templates can be specified with the uppercase T option and a number (0-5) or name
• Each template has a different impact on scan speed and accuracy
Max Retries Option

• Specifies the maximum number of port scan probe re-transmissions
• Default is 10 re-transmissions, but can be limited or set to 0 for informal surveys
Host Timeout
• Used to give up on slow targets and prevent scan time waste
• Specifies a maximum amount of time to wait for a host (e.g., 30 minutes)
Parallel Scanning
• Nmap utilizes parallelism and advanced algorithms to accelerate scans
• Can be closed using certain timing templates (paranoid, sneaky, or polite)
• Scan delay option can be used to wait between each probe sent to a host
Max Parallelism and Max Host Group Options

• Max parallelism option sets the maximum number of probes sent to hosts at a time
• Max host group option sets the maximum number of hosts in a group to be scanned at a time
• Setting max parallelism to 1 sends only one packet to a host at a time, while setting max host group to
1 scans only one host at a time

Null, Fin, Xmas And ACK Scan
Tuesday, July 2, 2024 12:35 PM
Three Advanced Nmap Scanning Techniques

• Null Scan: Sends packets with no TCP flags set (TCP flag header is zero)
• Fin Scan: Sends packets with only the TCP FIN flag set
• Christmas Scan: Sends packets with FIN, PSH, and URG flags set
Common Behavior
• These scans send packets with no SYN, ACK, or RST flags set
• If a RST packet is received, the port is considered closed
• No response means the port is open or filtered
• ICMP unreachable error type 3 code 0, 1, 2, 3, 9, 10, or 13 means the port is filtered
Key Differences
• These scans do not determine open or open/filtered ports
• Used to map out firewall rule sets and determine if they are stateful or not
• Can determine which ports are filtered
ACK Scan
• Probe packet has only the ACK flag set
• Open and closed ports will both return a RST packet, labeled as "unfiltered" (reachable
by the ACK packet)
• Ports that don't respond or send certain ICMP error messages are labeled "filtered"

IDLE Scan
Idle Scan Overview
An advanced scan method that allows for a truly blind TCP port scan of a target
No packets are sent to the target from the attacker's real IP address
Exploits predictable IP fragmentation ID sequence generation on a zombie host to gather information about open ports on the target
How Idle Scan Works
Based on three facts:

• Sending a SYN packet to a port to determine if it's open
• IP packets have a fragment identification number (IPID) that increments for each packet sent
• Probing for IPID can tell an attacker how many packets have been sent since the last probe
Idle Scan Steps
If the target port is open:

Probe the IPID of the zombie system
Forge a SYN packet from the zombie to the target system
Probe the zombie's IPID again, which will have increased by two

If the target port is closed:
Probe the zombie's IPID again, which will have increased by one
If the target port is filtered:

Probe the zombie's IPID again, which will have increased by one (indistinguishable from a closed port)
Performing an Idle Scan
Need a zombie computer on the network with incremental IPID sequencing

Use an Nmap script (ipidseq.nse) to find a suitable zombie system
Example scan results:
99.2 (gateway) has incremental ID sequencing and can be used as a zombie system
99.222 (Kali machine) has incremental ID sequencing but is the attacker itself, so not suitable as a zombie

Idle Scan Query
Use Nmap idle scan query with the IP address of the zombie system
Example results:
Ports 23 and 80 are open
Port 443 is closed or filtered (cannot be distinguished)

Introduction To Vulnerability Scan

Vulnerability Scanning
Vulnerability scanning is an inspection of potential points of compromise on a computer or network to

identify security holes.
It detects and classifies system weaknesses and predicts the effectiveness of countermeasures.
Vulnerability Definitions
ISO 27005: A weakness of an asset or group of assets that can be exploited by one or more threats.
NIST: A flaw or weakness in a system, security procedures, design, implementation, or internal controls
that could be exercised, accidentally triggered, or intentionally exploited, resulting in a security breach
or violation of the system's security policy.
Vulnerability Detection Methods
Looking at an application's banner information or obtaining version information to know about potential
weaknesses.
Using vulnerability databases to identify weaknesses in certain versions of applications.
Examining protocols used by the application in communication with a client for vulnerabilities.
Sending different types of packets over the network to examine the behavior of the service against
these packets.
Vulnerability Scanners
Software programs designed to assess computers, computer systems, networks, or applications for
known weaknesses.
Examples: Nmap, Nessus, Microsoft Baseline Security Analyzer, Nexpose, OpenVAS, Saint, GFI LanGuard,
Qualys Guard, Secunia PSI.
Vulnerability Databases
Platforms aimed at collecting, maintaining, and disseminating information about discovered

vulnerabilities.
Examples: Open Sourced Vulnerability Database (OSVDB), National Vulnerability Database (NVD), CVE
Details.com, CVE (Common Vulnerabilities and Exposures).


NMAP Learning

Uploaded by

Copyright:

Available Formats

NMAP Learning

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

NMAP Learning

Uploaded by

Copyright:

Available Formats

Introduction : Nmap Tutorial For Beginners

Tuesday, June 25, 2024 4:11 PM

New Section 1 Page 1

What is active vulnerability scanning?

Passive Scan : Wireshark

Active Scan : Nmap Tutorial

New Section 1 Page 2

SYN flood attack done via hping

--flood (send packets as fast as possible. Don show replies)

New Section 1 Page 3

During attack we will experience slowness in speed.

New Section 1 Page 4

New Section 1 Page 5

To scan all the ports open on a system:

New Section 1 Page 12

TCP Scan (TCP Connect Scan)

How TCP Connect Scan Works

Comparison with SYN Scan

Nmap TCP Scan Example

New Section 1 Page 15

UDP Scan is slower than SYN scan or TCP scan.

New Section 1 Page 18

Without Version Detection

With Version Detection (Takes Longer)

New Section 1 Page 19

New Section 1 Page 21

New Section 1 Page 22

New Section 1 Page 25

New Section 1 Page 27

-sn (No port scan)

-Pn (No ping)

New Section 1 Page 30

NMAP Scripting Engine (NSE)

First Script Scanning

New Section 1 Page 31

New Section 1 Page 33

New Section 1 Page 35

Coping with Network Security Devices

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)

Bypassing Security Measures

New Section 1 Page 36

Correct Timing in Nmap Scans

Max Retries Option

Max Parallelism and Max Host Group Options

New Section 1 Page 37

Three Advanced Nmap Scanning Techniques

New Section 1 Page 39

Idle Scan Overview

How Idle Scan Works

Based on three facts:

Idle Scan Steps

If the target port is open:

New Section 1 Page 40

If the target port is filtered:

Need a zombie computer on the network with incremental IPID sequencing

New Section 1 Page 41

New Section 1 Page 42

New Section 1 Page 44

Vulnerability scanning is an inspection of potential points of compromise on a computer or network to