NMAP | How To Use Nmap From Basic To Advanced

Tutorials & Methods
, ,
1

What is Nmap ?

Nmap (“Network Mapper”) is a free and open source utility for security evaluating. Nmap utilizes raw IP packets in novel approaches to figure out what are accessible on the system, what administrations (application name and form) those hosts are putting forth, what working OS (and OS variants) they are running, what sort of bundle channels/firewalls are being used, and many different qualities.

Nmap commands:

Scan a range of IP Address

This is the command to scan a range of IPs. Scanning a range of IPs is useful when trying to determine where a network attack may be occurring. Being able to scan multiple IPs also saves valuable time when tracing a network attack:

nmap 192.168.10.1-20

Scan a subnet

This command scans a subnet. Scanning a subnet will allow the scan to monitor multiple hosts. This command is useful when checking on multiple networks as well.

nmap 192.168.10.1/24

Nmap port selection

To utilize Nmap effectively, you will need to understand how to use the port selection options. The port selection options determine what ports will be scanned and whether the scan order is random or in a sequential order.

nmap -p 80 192.168.10.20

Scan Multiple Ports:

nmap -p 1-100 192.168.10.20

Nmap Port Scan types:

Privileged access is required to play out the default SYN examines. If privileges are inadequate a TCP connect scan will be used.

A TCP connect requires a full TCP connection with be set up and in this way is a slower examine.Disregarding revelation is regularly required the same number of firewalls or hosts won’t react to PING, so could be missed except if you select the - Pn parameter.

Obviously this can make examine times any longer as you could end up sending filter tests to hosts that are not there.

1. Scan using TCP connect : nmap -sT 192.168.10.20

2. Scan using TCP SYN scan (default) : nmap -sS 192.168.10.20

3. Scan UDP ports : nmap -sU -p 123,161,162 192.168.10.20

4. Scan selected ports - ignore discovery : nmap -Pn -F 192.168.10.20

Service and NMAP OS Detection

Service and nmap OS detection depend on various strategies to decide the working framework or service running on a specific port.

The more forceful service identification is frequently useful if there are services running on bizarre ports.

Then again the lighter adaptation of the service will be a lot quicker as it doesn’t generally endeavor to identify the service just snatching the standard of the open service.

1. NMAP OS detection and Services : nmap -A 192.168.10.20

2. Standard service detection : nmap -sV 192.168.10.20

3. Lighter banner grabbing detection : nmap -sV --version-intensity 0 192.168.10.20

4. More aggressive Service Detection : nmap -sV --version-intensity 5 192.168.10.20

HTTP Service Information

1. Gather page titles from HTTP services: nmap --script=http-title 192.168.10.0/24

2. Get HTTP headers of web services: nmap --script=http-headers 192.168.10.0/24

3. Find web apps from known paths: nmap --script=http-enum 192.168.10.0/24

There are numerous HTTP data gathering scripts, here are a not many that are basic but supportive while analyzing bigger systems. It helps in rapidly distinguishing what the HTTP benefit is that is running on the open port.

Note the http-enum script is especially loud.

It is like Nikto in that it will endeavor to specify known ways of web applications and scripts. This will unavoidably created several 404 HTTP responses in the web server mistake and access logs.

GitHub:

https://github.com/nmap/nmap

https://nmap.org/

ENJOY & HAPPY LEARNING! :+1:

11 Likes