>> Welcome to the lesson on the scan phases of Nmap.
Like most software,
Nmap executes its processes in a sequence
>> with one phase completing before the next begins.
>> This lesson walks you through each of those phases.
Some of you might think that this lesson
may not have a lot of practical implications,
but I hope to prove to you otherwise.
Knowing how Nmap works under the hood
>> will definitely help you as you use it.
>> One last thing, this lesson doesn't include a lab.
If you're not in front of a computer that runs Nmap,
you won't miss anything.
Let's get started.
>> Here are the learning objectives for this lesson.
>> First, we're going to answer the question,
why should I care about Nmap's scan phases?
Then we'll go through each scan phase
>> in the order in which they are executed and processed.
>> Finally, I'll talk to you a little bit
>> about what you can do with this information.
>> Why should you care about Nmap scan phases?
Well, I would argue that understanding
>> how any software works
>> always helps when using it.
>> Think of a car, for example.
While it's true that most people
>> can get a long way by driving a car
>> without ever having to know
>> anything about how it works,
>> you have to admit
>> that having a basic understanding of how it starts,
>> runs, and stops can be very helpful.
>> This is especially true
>> if the car begins operating outside of the norm.
>> If the tire pressure gets low,
it's good to know how that may affect performance
>> or what should be done to resolve it,
>> or if it struggles to start or overheats,
it might be really helpful to know
>> some things you can try
>> before taking it to a mechanic.
>> Similarly, if you understand how Nmap processes scan,
it may really help you when the results of your scan
>> don't match what you've expected.
>> Additionally, it helps
>> when you're constructing an Nmap scan.
>> For example, it's really helpful to know
>> that Nmap performs target enumeration and port scanning
>> before performing version detection or OS detection.
If you don't specify the right target
>> or don't include the right TCP
>> or UDP ports in your scan,
>> version detection and OS detection
>> will either be inaccurate or will simply not work.
>> Like our analogy,
if your car doesn't start
>> and you don't know how to read the gas gauge
>> to determine the tank is bone dry,
>> you might be left wondering why it didn't start.
Also, understanding the scan phases really helps
>> while tuning the performance of an Nmap scan.
>> When using Nmap in the real-world,
you'll almost always want to know
>> what you can do to minimize the amount of time
>> in computing resources required
>> while still effectively producing
>> the results you're aiming to achieve.
>> Even though Nmap operates very efficiently,
there are many times
>> when you can optimize its performance
>> by simply adding or taking away
>> some extra command line switches.
>> For example, if you're examining an email server,
you probably don't need to let Nmap
>> scan the default 1,000 most common ports.
>> During your scan, you can limit Nmap
>> to scanning less than 10 of the most common ports
>> used by email servers.
This could improve the scan performance
by more than 50 percent,
yet produce the exact same results.
Some of you may consider a lot of this
>> as purely an academic exercise,
>> but I really hope that I've provided you
with a strong argument about why it matters
>> that you at least have some cursory knowledge
>> of the Nmap scan phases.
>> You don't necessarily have to memorize them,
but it would be handy
>> to keep them in the back your mind,
>> or have a quick reference of them nearby.
All of the information in this lesson
>> comes from the reference I've provided
>> from the Nmap website
>> as the last bullet point in this slide.
The main thing to understand
>> when looking at the scan phases
>> is that scans proceed phase by phase.
>> In other words, each phase completes
>> before the next one begins,
>> and they're not iterative.
That means, for example,
that Nmap will not do port scanning,
then do OS detection,
then go back and do more port scanning.
Here, they are in order.
After this quick review,
we'll dive into what happens
at each phase in more detail.
Phase 1 is script pre-scanning.
Phase 2 is target enumeration.
Phase 3; host discovery.
Phase 4; reverse-DNS resolution.
Phase 5; port scanning.
Phase 6; version detection.
Phase 7; OS detection.
Phase 8; traceroute.
Phase 9; script scanning.
Phase 10; output.
Phase 11; script post-scanning.
Now let's look at each phase one at a time.
Phase 1; script pre-scanning.
This phase only occurs while running
Nmap scripting engine or NSE scans,
which use the dash dash script
or the dash S capital C switches.
Additionally, according to Theodore's book,
this phase is for scripts
>> which only have to be run once per Nmap execution,
>> rather than running separately
against individual targets.
We'll cover NSE in detail later.
Phase 2; target enumeration.
This phase occurs with every scan.
>> Essentially, Nmap determines every host to scan
>> based on the user's command line argument.
>> There are a lot of ways
>> to tell Nmap what target to scan,
>> and we'll go over those later.
Just note that passing Nmap IP addresses
>> or a group of IP addresses
>> will make the scan faster than names,
>> because Nmap doesn't have to do name resolution.
Phase 3; host discovery,
also known as Ping Scanning.
This phase discovers which targets are online
>> and worth investigating further.
>> It can be skipped by passing
>> the dash capital P lowercase n,
>> which is no Ping option.
>> This causes Nmap to assume all target IPs are online.
This can be helpful if your scans have little to do
>> with ICMP echo responses.
>> For example, you may be doing Arp request
or TCP or UDP scans.
If the target is blocking or filtering ICMP messages,
host discovery will be a waste of resources,
so turning it off for some scans
maybe better use of your time computing
>> and network capacities.
>> According to the book,
once Nmap has determined which hosts to scan,
it looks up the reverse DNS names
>> of all hosts found online by the Ping scan.
>> Sometimes, a host name provides clues to its function
>> and names make reports more readable
>> than providing only IP addresses.
>> This step maybe skipped
>> with a dash N or no resolution option,
>> or expanded to cover all target IPs,
even down ones with a dash capital R,
which is resolve all.
Phase 5; port scanning.
At its core and by reputation, port scanning
>> is what Nmap does better than any other tool.
>> In fact, many people
>> simply consider Nmap a port scanner.
>> I'm hoping that this course shows
how simplistic this view is.
Probes are sent and
the responses or non responses are used to determine
>> whether the targets ports
>> are open, closed, or filtered.
>> This phase in an Nmap scan is very important
>> and performed by default in every Nmap scan.
>> However, it can be skipped by using the dash SN option.
Phase 6; version detection.
When ports are found open,
Nmap attempts to determine
the server software that is running on the target.
It sends additional probes to open ports
>> and attempts to match responses to an Nmap database
>> that contains thousands of service signatures.
>> This phase can be enabled on any scan
>> by using the dash S capital V command line switch.
>> Phase 7; OS detection.
The operating system detection phase is optional
and is run on several default Nmap scans.
Also, you can add
the dash capital O option on any scan
>> to attempt operating system detection.
>> Similar to version detection,
Nmap examines the responses to various network probes
>> and compares those responses
>> to signatures and behaviors of known operating systems.
>> Then it provides you with a degree of likelihood
>> that the responses match one or more
>> of those known operating systems.
Phase 8; traceroute.
Some scans may make use
>> of Nmap's advanced traceroute capabilities.
>> You can force Nmap to perform a traceroute
>> by using the dash dash traceroute option
>> in the command line.
>> Nmap will determine the route to the target,
then run reverse DNS resolution
>> on several intermediate hosts in parallel
>> in order to speed up the trace.
>> Phase 9; script scanning.
This is where most of the NSE scripts run,
rather than the pre-scan or post-scan phase.
As I mentioned before, NSE will be covered in detail
>> later in this course.
>> But for now, just know that this phase
>> of the scanning process
>> is where most of the NSE scripts
>> perform their processing.
>> Phase 10; output.
In most scans, this is the final phase.
After Nmap does all of its processing,
collects all information
>> it has gathered during scanning,
>> it either writes the output to the screen
>> or do a single or multiple files.
>> From a network inventory, forensic investigation,
or reporting standpoint,
>> this is where Nmap really proves its value.
>> The output can be pulled into many different programs,
>> like word processors, spreadsheets, databases,
>> or even HTML files with some processing.
This course will spend some time
>> on dealing with output other than just on-screen.
>> It's one thing to tell people
>> that you have determined details about a target,
>> but quite another to show them
>> the results of your analysis.
>> Phase 11; script post-scanning.
This phase is currently more of an idea
>> than an actual phase.
>> In other words, if you learn
the Lua programming language
>> to write your own NSE scripts
>> and choose to add additional results processing
>> in order to deliver reports and statistics,
>> this is the phase in Nmap processing
>> that this would occur.
>> No official Nmap NSE scripts currently do this,
but Nmap is evolving constantly,
so it is likely that this will change.
Now that you've learned the Nmap scan phases,
what should you do with this information?
Like I said earlier,
keep it as a reference
>> and burn it into the back of your mind.
>> When you run Nmap scans,
you may not get the results you want
or you may not get them quickly enough.
Knowing how Nmap processes a scan
>> can really help to make the most of your resources
>> and it can help you troubleshoot
>> when things don't look quite right.
>> Becoming proficient in Nmap
takes time and experimentation.
But you'll never become an expert
without understanding how it works under the hood.
In this lesson, we discussed
>> why you should care about the Nmap scan phases,
>> we then learned about each of them,
and finally, we briefly discussed
>> what you should do with this information.
>> Thanks so much for walking through
the phases of Nmap scans with me.
I'll talk to you in the next lesson.