Instructor: It is time to start with the first big tool
that is essential for ethical hackers.
That tool is called Nmap.
We're going to cover a lot of things inside of it,
and unlike all the other tools that we covered by now,
which you might or might not use in penetration tests,
this is a tool that you will almost always use
without any doubt.
So what is Nmap?
Nmap is a network mapper.
It is a free and open-source network scanner,
and it is used to discover
hosts and services on computer network
by sending packets and analyzing the responses.
It has a lot of different options,
and we are going to check them out in the next few videos.
For now, let us just see how we can start Nmap
and run a basic scan.
First thing, make sure your Metasploitable
is up and running,
and also, if you got any other devices in your home network,
turn them on, just so we can scan them as well.
Okay. Let us see how we can run Nmap,
and what options do we get with Nmap.
Just like all the other tools,
we can get the Nmap help menu
by only specifying "nmap" in terminal
or specifying "nmap --help".
And you will see right away,
we get a lot of options right here.
And this right here is just the short help menu.
We will see the longer menu once we start experimenting
with these options right here,
but for now, we're only interested in running Nmap
with just a basic scan.
So for basic scan, all we need to do
is specify an IP address.
If you go to the help menu
and you scroll all the way to the top,
we should see "target specification", right here;
it tells up that we can provide a hostname,
an IP address,
or a network for scanning.
And below that, we got some of the examples
of what we can specify with Nmap
and what is the syntax for specifying hosts.
We can also read our targets from a list
by specifying option -iL,
and if we want, we can exclude some hosts
that we don't want to scan
by specifying the --exclude option.
For the first time, let us get an IP address
from out Metasploitable,
and let's scan it to see what results we get
for scanning one IP address.
We already saw how we can get Metasploitable IP address:
you can either run netdiscover to see all the online hosts,
or if you don't want to bother,
you can just go to Metasploitable,
right here,
and type "ifconfig".
I can see that the IP address of my Metasploitable
is 192.168.1.6,
so that is the IP address that I will use.
Let's run our first Nmap scan.
If I type "Nmap"
and just "192.168.1.6",
and press Enter:
Wow. This finished pretty fast.
But don't get used to it;
the only reason that this can finish so fast
is because the target is on my home network.
True Nmap scans can sometimes take hours to finish,
depending on where your target is,
how many ports they have open,
are they protected by firewall,
and many other things that we are also going to cover.
But for now, this is the response for our Metasploitable
with our basic scan.
So it tells us that host is up,
it tells us which open ports it has,
we get the exact number of which ports are open
on the target machine,
and right here, we can notice that there are a lot of ports
that are open.
That is because Metasploitable is running a lot of services.
Nmap also tells you, besides the port that is opened,
which service is running on that open port,
and this is this third column.
So we can see that port 21 is open,
and it is running FTP,
which we already know that it's File Transfer Protocol.
We got port 22 to be open,
and that port is for Secure Shell.
We got port 80 that is opened, and that is an HTTP port,
and this could mean that our Metasploitable
could be hosting a webpage.
We can check this out
if we type the IP address of our Metasploitable
inside of our Firefox;
so let's go up here, open up our Firefox,
and if I go up here and type "192.168.1.6",
press Enter,
this will automatically go
and try to connect to the port 80,
and indeed, it is hosting a webpage.
But more about this webpage later on in the course,
as it holds bunch of vulnerabilities which we will cover.
For now, let us just see
what other things we got with our Nmap.
So besides these known ports that we got right here,
we also discovered a bunch of other ports
hosting different services,
and some of them could be vulnerable.
We also see this right here that says
"Not shown: 977 closed ports".
But wait a second; I said that there are over 65000 ports.
Why does it say that it didn't show only 977 ports,
or it shows that only 977 ports are closed?
That is because Nmap, by default,
scans the most known 1000 ports.
It doesn't scan all 65000.
We can tell it to scan all 65000,
which we will see later on,
but in most cases it is not necessary.
Okay, cool. Our first Nmap scan gave us some results.
And all of these results from our scans,
you would write down in a report in a real penetration test.
Now that we know how we can scan one IP address,
let us see how we can scan a range of IP addresses.
Let's say we want to scan our entire network;
and for this, once again,
you must know your subnet of your network
or your network's IP range.
We talked about this earlier.
For me, it is from 192.168.1.1
up to 192.168.1.255.
So we can specify this in two different ways:
we can type "nmap 192.168.1.1-255",
or we can type it like this: "192.168.1.1/24".
And if you're new to subnetting,
you can think of this "/24" as something that says,
"First three octets are not changeable."
And by "first three octets" I mean first three numbers,
which leaves us with only last octet, or last number,
that will be changeable inside of our IP range.
So let's scan it. If I press Enter...
Now, this scan right here might take a little bit more time
since it is not only scanning one host,
it is scanning multiple hosts.
And even though it's scanning multiple hosts,
it finished relatively fast because it is scanning
my own network.
Let us read the results.
So, these right here are the results for the Metasploitable,
as we can see by the IP address,
and we got the same results as before,
which ports are open and what services are they running.
Down here we get that it scanned 256 IP addresses
and three hosts are up;
let's see what other two hosts are up
besides our Metasploitable.
We got a device with the IP address of 192.168.1.4,
and it says right here,
all 1000 scanned ports on this device are closed.
And you remember when I told you
that this is the more secure version,
since right now we cannot connect to any one of these ports.
And this is probably some home device,
possibly my laptop,
it has all 1000 scanned ports closed
because it doesn't host any service to other machines.
And the last device that we got is my router.
We got its IP address,
and we also got which ports it has open.
So it has port 22 for SSH,
port 23 for Telnet, port 53 for the domain,
port 80 and port 443 for HTTP and HTTPS,
and this port right here that says service unknown.
This is because Nmap couldn't figure out
what service is running on this open port.
Okay, great. For now, we performed a basic Nmap scan
without adding any additional options to it,
and with this we managed to discover open ports
on our target machines.
That is good for the start.
In the next video, we will see
what else can we discover using Nmap,
and what other cool options it has.