Hello, my name is Stephan, and in this lecture we will explore the fascinating world of a network
reconnaissance.
So.
Nmap is renewed for its extensive range of host and port discovery techniques, allowing penetration
testers and system administrators to gather critical information about their networks.
By utilizing these techniques, we can effectively scan hosts even in the most restricted environments.
So let's explore some of the key techniques employed by Nmap for host discovery.
We can also trace routes with map.
So tracing routes with Nmap.
From the scanning machine to the target host can provide valuable insight into the network topology.
Nmap enables us to include trace route information during our scans.
So for example, now we will enter the Nmap as an nmap.
As and we will add a trace route option.
So by using this option, we can trace the path taken by packets from our machine to the target host.
Let's do this example here.
So nmap traceroute and here we will enter our some website.
In this case it's going to be, for example, code sally.
This is our application which we.
Our website which we installed for penetration testing in in this course here.
And as you can see here, traceroute has to run as root and we will use this sudo here and after that
and as you can see here, here we this is our traceroute.
So this command initiates a ping scan with a traceroute enabled for both the.
Constantly on our host machine.
So we can also add another here, for example, Google.com and here.
That's it.
So.
We are allowing us to visualize the network path and identify potential bottlenecks or routing areas
here.
As you can see, we don't have any usually on rooting here.
So Segment three Leveraging NSA scripts during host discovery and Maps scripting capabilities through
the Nmap scripting engine.
NSA here provide a powerful way to gather additional information about a target during the host discovery
phase.
By executing the Nmap scripting engine scripts, we can extract valuable insights about a target service's
vulnerabilities or even perform specific tasks to execute Nmap scripting engine script without conducting
a port scanning, we can use the as an option to skip port scanning and specify the desired script using
the script option.
So here what we're going to do is an Nmap script here and we will use the DNS root DNS root as a Nmap
scripting engine.
So DNS root here and after that we will enter our target domain or IP address.
So in this case it's going to be console here, dot com and here.
We will pay the execution here.
Let's actually run with the pseudo privileges.
And here, as you can see here, we got no target specified.
And so zero host scanned.
And here, if you are getting this error, you can also use the alternative script for this here.
So instead of writing DNS root here, you can also write the DNS insecure and enum and after that you
enter the your domain or IP address.
So here this is an alternative and this script performs a DNS enumeration by querying for Dnssec records,
which can provide valuable information about the domain.
And here now, we will get.
An output here.
And also keep in mind that the success of this command depends on the availability of this DNS insect
enum script on your network configuration, and you may need to install additional Nmap scripting engine
scripts or adjust the command according to your specific environment.
So if you need any.
Assistance If you or if you encounter any errors, feel free to ask me on the.
Question sections of our course.
And as you can see here, we got a lot of information here.
We got ports and this here.
So here in this command, we are executing this DNS Dnssec script during host Discovery, which attempts
to brute force DNS records for the cozily.com domain.
This can reveal hidden subdomains, but also provide valuable information here and as you can see,
open ports and so on.
So we can also use the SDN here before the script here.
And let's see how the port will change.
And as you can see here, this is now we are not scanning port signs.
This parameter will not scan port here and here We are sending this host record server here.
And as you can see here, our hosting for this domain.
Contains this domain address here and which is this is the IP address of this.
And one interesting Nmap scripting engine script available in Nmap is broadcast ping script, which
utilizes a broadcast ping request to identify online hosts within a network by broadcasting a ping message.
Nmap can detect hosts that respond even if they have a restrictive firewall rules.
And to use this script, we specify it with this script option as we did earlier, along with the desired
target range.
So we will do Nmap as n here script again.
With two year script.
And after that we will enter the broadcast pink and 192168.
Let's actually see our.
Ifconfig IP.
Local IP address 13 138 13 one here.
And after that we will enter the 24 and here.
And map.
And so we need to actually oops, we had the error with this typo here.
Broadcast and that's it.
And as you can see, it's not running for lack of privileges.
So we need to run it with sudo here, root privileges here and now you will see an output.
And here.
So with this command, we are scanning the local network with the IP range of this one slash 24, which
we will scan this IP address from 0 to 256 here using this broadcast ping and here, this can be particularly
useful in scenarios where your host might not respond to a traditional ping requests here.
So in conclusion, Nmap discovery capabilities provide a powerful arsenal for network reconnaissance
by understanding the leveraging techniques such as traceroute, NSA, Nmap, scripting, engine scripting
and specialized scripts like broadcast ping, we can gain comprehensive insights into network environments,
identify active hosts and uncover potential vulnerabilities.
So equip yourself with the knowledge of Nmap host discovery features and embark on your network recon
science journey with confidence.