General notes

• By default, nmap uses only IPv4 for scan­ning. Try to per­form scans twice, one with­out and one with the ‑6 para­me­ter.
  nmap -6 -sT -sC fc:00:...%eth0
• Run nmap as root, because some scans (e.g. which require incom­plete hand­shakes) are not pos­si­ble in userspace.
• How does nmap detects if a host is up? It does the fol­low­ing and if at least one test returns a response, the host is con­sid­ered as online. 
  • ARP request (if the tar­get is in the same Eth­er­net subnet)
  • ICMP echo request
  • TCP SYN to port 443
  • TCP ACK to port 80
  • ICMP time­stamp request
• You can use ipt­a­bles to mea­sure the traf­fic to / from the tar­get (e.g. to opti­mize a port scan before to be more silent.)

NC / Netcat

Try net­cat first on inter­est­ing ports or nar­row port ranges to be more silent

Network scan

Choose a port which is prob­a­bly open on sys­tems on this net­work. E.g. 445 for Win­dows hosts or 22 for Lin­ux hosts.

for i in $(seq 1 254); do nc -zv -w 1 10.10.10.$i 445; done

Port scan

For TCP:

nc -nvv -w 1 -z 10.11.1.220 3388-3390 2>&1 | grep open

For UDP: (This will need more time because if a fire­wall is in our way, the ICMP mes­sages could be fil­tered out and nc then would wait a moment for a time out before mov­ing to the next port.)

nc -nvv -u -w 1 -z 10.11.1.220 3388-3390 2>&1 | grep open

SNMP

If SNMP is avail­able, a list of open ports can be retrieved as well. See the SNMP article.

Masscan

Scan very fast:

masscan -e tun0 -p 1-65535 --rate 2000 $victim
masscan -e tun0 -p U:1-65535 --rate 2000 $victim

Network sweeping

Scan­ning a whole sub­net. The fol­low­ing scans from 192.168.5.0 until 192.168.5.255.

nmap 192.168.5.0/24

The fol­low­ing is more effi­cient, skip­ping spe­cial addresses.

nmap 192.168.5.1-254

This nota­tion can also be used oth­er seg­ments, like 192.168.1–10.1–254. IPv6 address­es can be defined the same way but cur­rent­ly not with a range.

To scan and out­put in a grep friend­ly way, use ‑oG like here

nmap -sn 10.10.10.0/24 -oG /tmp/t
grep Up /tmp/t | cut -d" " -f2

Show only open ports in a network

nmap 10.11.1.1-254 -p2233 --open

Host sweep­ing with PowerShell:

1..225 | % { echo "10.10.10.$_"; ping -n 1 -w 100 10.10.10.$_ | select-string ttl }

Single client scanning

Scan the most inter­est­ing 1000 ports (~ 71 KB of traffic)

nmap 10.10.10.10

Scan all ports (~ 4,5 MB of traffic)

nmap -p 1-65535 10.10.10.10

Net­cat can be used as prim­i­tive port scan­ner which could be inter­est­ing on a tar­get where it is installed already.

nc -nvv -w 1 -z $victim 1-1500
for port in $(seq 1 1500); do nc -nvv -w1 -z $victim $port 2>&1 | grep succeeded; done

Reading IPs from file

It’s pos­si­ble to load a file which con­tains the tar­get IPs (sep­a­rat­ed via any white space).

nmap -i retrieved_dhcp_host_ips.txt

Random scanning

Nmap can gen­er­ate ran­dom IP ranges to scan for surveys.

nmap -iR 2 192.168.5.0/24

Detect hosts

Nmap has sev­er­al meth­ods to detect hosts.

Good goto line:

nmap -PS21,22,23,25,53,80,110,111,135,137,139,143,443,445,502,993,995,1433,1432,1723,3306,3389,590,8080 -PE -iL hosts.txt

Cre­ate a host list via the host dis­cov­ery pack­ets which the hosts send by them­selfs; that means that this method is passive.

nmap -sL 192.168.5.1-254

Cre­ate a list of active hosts. This uses an addi­tion­al ICMP echo request for each report­ed host.

nmap -sn 192.168.5.1-254

Cre­ate a list of active hosts which are active on giv­en ports. Nmap sends a TCP SYN pack­et to each port to ini­ti­ate the three way hand­shake. (If a serv­er reponds, nmap clos­es it with a RST pack­et so that no con­nec­tion will be created.)

For exam­ple, use ‑PS22,111 to detect Lin­ux servers or PS-137–139,45,3389 to detect Win­dows Sys­tems. Or add a port from a ser­vice you’re expect­ing in the network.

nmap -PS22-23,80,443 192.168.5.0/24

If a fire­wall blocks this, use the PA option which sends a TCP ACK. State­full fire­walls often don’t accept new SYN pack­ets from the inter­net, but an incom­ming ACK packe seems to be from a exist­ing con­nec­tion. The ser­vice will respond a RST, but that does­n’t mat­ter because it proves that the ser­vice is alive.

nmap -PA80 192.168.5.1-254

Anoth­er alter­na­tive is using an UDP ping.

nmap -PU80 192.168.5.1-254

Anoth­er alter­na­tive is the SCTP INIT ping, which shows also the MAC address­es. (Root priv­i­leges are need­ed for this!)

nmap -PY80 192.168.5.1-254

Anoth­er alter­na­tive with the IP pro­to­col ping.

nmap -PO80 192.168.5.1-254

Anoth­er option for Eth­er­net net­works is the ARP Ping option. Obvi­ous­ly, this works only in the local net­work until the next gateway.

nmap -PR 192.168.5.1-254

List IPs of a net­work, mark online ones

nmap -sL 10.10.64.0/27 | awk '/Nmap scan report/{print $NF}'

Detect hosts via a zombie

Nmap can use a zom­bie serv­er which per­forms the scan from his per­spec­tive. The zom­bie has to be idle because the IP ID field must not change between a scan. There­fore, scan a poten­tial zom­bie first with

nmap -v -O zombie.andreas-klingler.de

and note the IP ID Sequence Gen­er­a­tion out­put to decide if this could be a zom­bie or not. After this, scan as follows.

nmap -Pn -p22,80,143 -sI <zombie_ip> $victim

Determine the OS and version numbers

Deter­mine the OS

nmap -v -O $target
nmap -v --osscan-guess $target

Or try to get infor­ma­tion about the ver­sion num­bers of active ser­vices. This can be fur­ther extend­ed via an addi­tion­al -A switch.

nmap -sV [-A] $victim

Detect protocols

Deter­mine which pro­to­cols the attacked client supports.

nmap -sO $victim

FTP BOUNCE attack

FTP serv­er can talk direct­ly to each oth­er. This fea­ture can be used to per­form port scans from thiry-par­ty FTP servers.

Check if a FTP serv­er is prone to this attack by scan­ning with nmap (para­me­ter ‑sC). This will return “ftp-bounce: bounce work­ing!” if the tar­get is vul­ner­a­ble. Then, per­form the scan from the first FTP serv­er to the sec­ond like follows:

proxychains4 -q nmap -p23 -Pn -v -b anonymous:dsfsd@$victim 10.2.2.23

Detect open ports between two systems

1. Cre­ate nc lis­ten­er in a bash loop for a cer­tain range.

Fast inter­nal scanning

Small script to scan from an inter­nal host to see which ports are open outbound.

!/bin/bash
host=10.5.5.11
for port in {1..65535}; do
timeout .1 bash -c "echo >/dev/tcp/$host/$port" &&
echo "port $port is open" done
echo "Done"

With Pow­er­Shell:

1..2048 | % { echo ((new-object Net.Sockets.TcpClient).Connect("10.10.10.10",$_)) "Port $_ is open" } 2>$null }

Nmap options

• Ignore hosts which seems to be inac­tive: With the ‑Pn option, nmap skips the ini­tial check if a host is alive before per­form­ing any fur­ther checks. This means that the entire net­work is probed, also for IPs which seems not to be used at the moment.
• Set the scan speed with ‑T X — nmap will wait X sec­onds between packets 
  • 0 = 5 minutes
  • 1 = 15 seconds
  • 2 = 0,4 seconds
  • 3 = auto­mat­ic / default
  • 4 = more aggresive
  • 5 = extrem­ly aggre­sive, can over­load and miss packets.
• Add tracer­oute: With –tracer­oute, tracer­oute is exe­cut­ed for every host which is alive.
• No DNS res­o­lu­tion: Speed up the scan with -n.
• Com­plete DNS res­o­lu­tion: Force reverse DNS res­o­lu­tion for all pos­si­ble hosts with­in the giv­en range with -R. This includes offline hosts also. This could return inter­est­ing DNS entries from hosts which are cur­rent­ly offline.
• Use spec­i­fied DNS servers: Use only giv­en DNS servers with –dns-servers srv1,srv2. In some net­works, it could be that only some local DNS servers can resolve all address­es because there are not exposed to the pub­lic DNS sys­tem. In this case, try to fig­ure out which DNS servers in the inter­est­ing net­work are online and add these to the real scan run.
• Scan also UDP by adding -sU. Cau­tion: Because UDP does­n’t use a con­nec­tion, nmap has to wait for a time­out and try it again to make sure that the pack­et was­n’t sim­ply lost. So, this switch should be used speci­ficly and not in a wide scan. 
  • Cau­tion: This scan can be unre­li­able; make sure to scan mul­ti­ple times to make sure no port was omitted!
• Try exot­ic scan types like -sN, -sF, -sX, ‑sZ or ‑sM  which can bypass fil­ter. (See man­page for more details.)
• Try to scan for proxy FTP servers. Very unusu­al today, but you can nev­er know. See the man­page for details.
• Speed up and scan for few­er ports with the ‑F options. Scans the most usu­al 100 ports instead of the most usu­al 1000 ports.
• Play the Romu­lans by adding some decoy attack­ers via -D <ip1>,<ip2>. Nmap will pro­duce also pack­ets from this IPs so that an IDS would see a portscan from oth­er sys­tems also.
• Use prox­ies (SOCKS or HTTP) with –prox­ies <proxy1>. This reduces the speed and it can be nec­es­sary to decrease some oth­er para­me­ters like time­outs. See the manpage.

Nmap output options

Addi­tion­al to the reg­u­lar out­put via STDOUT, nmap can out­put the results also in dif­fer­ent ways.

The fol­low­ing writes the default out­put which would be gen­er­at­ed to STDOUT into a text file.

nmap ... -oN <filename>

The fol­low­ing writes the results in a XML file.

nmap ... -oX <filename>

The fol­low­ing cre­ates files in all for­mats (.txt, .xml and .grepable)

nmap ... -oA <basename>

Nmap scripts

See nmap script page

Tools

dnmap

• Dis­trib­utes port scanning
• One serv­er con­trolls n clients which per­form the actu­al scans.
• See https://tools.kali.org/information-gathering/dnmap for short usage.

zenmap

• UI for nmap which makes read­ing the out­put easier.

EyeWitness

Cre­ate auto­mat­ed screen­shots from a list of webservers.

Windows

Deter­mine a sin­gle port in PowerShell:

PS> Test-NetConnection -Port 123 $target

Check mul­ti­ple ports in PowerShell:

1..1024 | % {echo ((New-Object Net.Sockets.TcpClient).Connect("10.10.10.10", $_)) "TCP port $_ is open"} 2>$null