>> Welcome to the lesson on constructing an Nmap scan.
This lesson is not intended to go into
detail about building complex Nmap scans.
The main point of it is really to show
you several important command line
switches you should know about an Nmap because they
are critical to consider in every single Nmap scan.
I want you to see that Nmap scans
can be constructed in a variety of different ways.
My hope is that you will figure
out a way that works well for you
and stick with it as you experiment
with Nmap. Let's get started.
>> Here are the learning objectives for this lesson.
First, I remind you about how to get help.
Next, we'll go over basic requirements of an Nmap scan.
Then I'll answer the question,
does it matter what order options
are placed in an Nmap scan?
We'll then cover two really important options
that you should consider in every Nmap scan.
Next, I'll talk to you briefly
about a regular scan versus a script scan.
Finally, we'll go through a quick lab on constructing
an Nmap scan that will demonstrate
the concepts discussed in this lesson.
If you haven't already,
I suggest going back and revisiting Lesson 2.9,
which was about ways Nmap users can get help.
As a refresher, let's go over a couple.
Simply typing Nmap or nmap -h then hitting
''Enter'' on your keyboard
at the command prompt will show
you many of the different options you
have available in Nmap.
There isn't a ton of detail there,
but it's a great way to remind yourself
of the many options available and how to use them.
If you're considering running an NSE script,
you can type nmap --script-help 'the,
name of the script' then hitting ''Enter''.
If you want much more detail and
are running Linux or Unix,
Mac OS included, you can type,
man nmap then hit ''Enter''.
To dig as deep as possible,
you should go to the Nmap website,
which now includes Theodore's entire book.
I've put a couple key URLs in this slide.
Finally, either create for
yourself or find a cheat sheet online.
I will include one in this lesson,
and I believe it will help a lot.
I won't include every single command
>> or command sequence,
>> but we'll share a single page of what I
consider to be the most important Nmap scans,
especially when you're starting out.
What are the basic requirements of an Nmap scan?
Well, first of all, you must
have Nmap installed properly.
If you've installed it, according to
my previous lessons, you should be good to go.
Secondly, and especially when starting out,
open your terminal or Windows
command prompt as a privileged user.
Or what I should say is,
if you're using Linux, Unix,
or the MacOS, run Nmap using pseudo.
If you're running Windows,
open the command prompt as administrator.
I'm sure you know what I mean here,
but I'll demonstrate this in the lab.
The next thing to consider
is where in the file system you're
running Nmap from and
>> whether your environment variables,
>> specifically the path variable, are set correctly.
I'll show you this in the lab.
Finally, the most important thing that you must include
in every single Nmap scan is the target.
No matter how sophisticated your scan is,
without a target, it'll fail.
Every time I execute a command line program,
I wonder, does it matter what order
I place the switches or options in?
Well, unlike some programs or environments,
in Nmap, it really doesn't matter too much.
In other words, you can type the switches that indicate
the type of scan before or after the target.
For example, you could tell Nmap to scan 192.168.1.1,
then place the details about the type of
scan you want to perform such as
the -A for an advanced scan
or -O for an operating system detection at the end.
You can also provide details
about what Layer 4 protocol or
what ports before or after
the type of scan or the target.
This provides for a lot of
flexibility and a lot of different styles.
It doesn't really matter what order you put
your command line options, not really.
One thing that I think you should
determine early on in your Nmap
scanning adventures though is where you put
your target and output options.
Play around with a couple of different ways to do
it and decide which way suits your needs.
I'll tell you the way that I usually do it
though just in case it makes sense to you.
I typically place all my command line switches
before the target and output.
In other words, I put the target and
output type at the end of every Nmap statement.
As we go through scans later on,
you'll see exactly what I mean.
But as an example,
if I'm doing a simple advanced scan on a target,
let's say scanme.nmap.org and I
want to output the results into an XML file,
I would type
>> Nmap -A scanme.nmap.org 'the target' -oX results.xml.
>> The type of scan was determined by the -A,
then I put the target,
then I put the output option.
The reason I like this is that
scans can sometimes get really long.
After they execute,
I can simply hit the up arrow on my keyboard,
then only change the name of the output file or
the target very simply
because they're at the end of the command.
Even though it really doesn't matter
too much from Nmap's perspective,
from a success or failure or performance standpoint,
it matters from a usability standpoint.
I'll show you what I mean in the lab
just in case this isn't clear.
Another thing I think you may want to consider
is the previous lesson on Nmap scan phases.
Think about how Nmap processes a scan from phase to
phase and try to put
your command line switches in that general order.
Sometimes this helps from
a conceptual standpoint because it forces
you to think about what it will
take for your scan to be optimized.
This will take a little bit of time to master and
may only be pertinent to some of you.
But I'd say that thinking about scans in
this manner has really helped me a lot
to learn Nmap and memorize
most important options and how and why they're used.
Ultimately though,
find a standard that works well for you
>> and stick to it.
>> Along with higher-level reasoning
>> and conceptualization,
>> I'm a firm believer that most of us get really
effective and efficient through route memorization.
Executing Nmap scans using
the same basic format every single
time will really help you to burn
the most important command line options into your mind.
Pick the style that works best for you and stick to it.
Now that I explained to you that I like to put
the target and output type at the end,
I'll discuss a little bit of
detail about these two options.
For the target specification,
you can use many different options.
You can use a local or remote host name
or fully qualified domain name.
You can use an IP address or you can
use multiple host names or IP addresses.
Additionally, you can use
an entire network inside your notation.
For example, 192.168.1.0/24 would
indicate every host on the 192.168.1.0 network.
You can also provide Nmap with a file that has all of
the host names and/or IP addresses
>> that you want to scan.
>> The options are almost unlimited.
In fact, you can even ask Nmap to
choose a number of random targets.
You can also provide Nmap with a bunch of targets,
then tell it which ones of those to exclude.
We'll go over all this stuff later on.
Now for the output.
Again, Nmap has a lot of capabilities here.
The big things to consider are, one,
do you want your output
>> to go to the screen or to a file?
>> Two, if you want it to go to a file,
what format do you want it in?
Three, how much detail do you
want your scan and its results?
-oN, followed by a file name,
will output the results to a text file that you've
specified in the normal and map format.
-oX will output it to an XML formatted file.
-oS will output it in script kiddie format.
-oG will output the results in a grepable format
>> for those of you who like to use grep.
>> If you use -oA,
followed by a filename without an extension,
Nmap will create three different output files
in normal, XML, and grepable format.
The last two options I put here are -v and -vv.
I placed them with all the output formats because what
these two options do is determine
the level of detail or verbosity,
which is what the v stands for, in the output.
If you leave them out, Nmap
will output a normal level of detail.
If you add the -v switch,
it will increase the level of detail.
If you add the -vv,
it will increase the level of detail even more.
Again, play around with these
options with some simple scans.
You'll figure out the amount
of detail that's right for you.
Even though you have a lot of flexibility with
how you construct your Nmap scan statements,
there's a key distinction I'd like to make and
>> that's between a regular scan and an NSE script scan.
>> The same rules about the target
and the output still apply,
but a standard regular scan is usually simpler.
For example, you can run a regular simple scan against
scanme.nmap.org by simply typing nmap scanme.nmap.org.
However, if you want to execute one of
Nmap's NSE scripts against the same target,
you would have to type Nmap -sC scanme.nmap.org,
which will run every NSE script
labeled as default against the target,
or you would type Nmap --script
equals 'the script name' scanme.nmap.org.
The main point that I'm trying to make
here is that a simple script scan adds
one additional command line switch
as a basic requirement of a scan.
We'll go into much more detail about
NSE scripts later on,
and I'll show you what I'm talking about
in this lesson's lab so you can follow along.
In this lesson, I reminded you about
the value of help and where you can get it quickly.
I talked with you about
the basic requirements of an Nmap scan statement.
We discussed whether or not the order in which
an Nmap scan statement is typed matters.
I showed you the two most important options,
target and output, that you
need to consider in every scan.
We then looked at the difference between
a simple regular scan versus a script scan.
In the next lesson, we'll run through
the lab on constructing an Nmap scan.
Thanks so much for walking through this lesson with
me and I'll talk to you in the next lesson.