>> Welcome to the lab on constructing an Nmap scan.
This lab is pretty long,
so let's get started. In the lab.
I'll quickly review how to get
quick reference help as you're running Nmap scans,
then I'll demonstrate that Nmap scans can be typed
out in various ways while delivering the same results.
Next, we'll go through
>> the main target and output types.
>> Finally, I'll show you why I like putting
target and output at the end of Nmap scans.
Welcome to the lab on constructing
an Nmap command line scan statement.
In this lab, I'm going to be using Windows 10.
Everything is the same with other operating systems,
except for the first part.
I'm going to show you where to go in Windows
to make sure Nmap is in your path,
meaning that no matter where you are
in the command prompt file system,
Nmap scans all runs successfully.
The first thing you want to do is click on
your Start button and type system.
Then click on System Control Panel,
and click "Advance System Settings" over to the left.
Then at the bottom you'll see
environment variables, click on them.
What we're looking for is the path
variable which is right here.
We'll edit that.
Right here you'll see Nmap is installed to
see program files \nmap.
That's correct in my installation,
that's pretty much the default installation of Nmap.
If you've installed it somewhere else or you don't see
Nmap anywhere in
your environment variables in your path,
click on New and then just
>> type the location where it is.
>> You'll know better than I will.
Once you have it typed out there
or in most cases you're going to have it,
but once you've verified
that Nmap is in your path just click "Okay",
"Okay", "Okay",
and then just close that.
The next thing I want to show you
is running Nmap as an administrator.
Click on your Start button and
type CMD for the command prompt.
Once it comes up at the top of the list,
right-click on it and click "Run" as administrator.
By default when it opens,
it should be at C Windows system 32;
you can see that right there.
What I want to do is show you that Nmap indeed does
work from anywhere in the operating system.
We'll type nmap -V.
That'll give us the version of Nmap that we're running,
hit "Enter" and it works.
I type cd \ hit
"Enter" and I'm at the root of the
>> operating system now,
>> a root of C I should say.
Again, type nmap
>> -V just to test to make sure it's still working.
>> Nmap will run from anywhere in the operating system,
you can pretty much assume because it's
worked from the system 32 folder
and from the root of C. Just as a refresher,
to get help for Nmap,
you can type Nmap -h.
I'll scroll up here just so you can see
all of the different options available to you at Nmap.
Additionally, as we covered before,
you can type nmap and hit "Enter".
The results of both of
those two commands are exactly the same.
One of the things that I want to cover
now are target types.
I'm going to scroll up to the very top,
right after we ran the Nmap command.
Here's the Nmap command, right underneath
it shows target specification.
You can pass host names,
IP addresses, networks, etc.
If you ever want to refer back to it,
>> that's where it is.
>> I'm going to go ahead and do a clear screen.
The first thing I wanted to do is show you how to
scan a single host even though we've done this before,
nmap 192.168.1.254;
that does a standard default and map
scan of that IP address,
there's the results, or you can do
a scan of multiple hosts at the same time,
you do an IP range.
We'll do it nmap
192.168.1.1-25, I hit "Enter".
The scan will take a little bit more time
so I'll probably cut it from the video.
You see that that scan took 9.62 seconds which is
a very nice information to have for any scan.
Now, I'm going to clear the screen again.
Nmap also will accept
entire network range in CIDR notation.
If you don't know what that is, I'll
talk to you more about that
in the TCP/IP section.
We'll run nmap
/24.
That will scan every host on the 191.168 1.0
network which is a subnet mask of
255.255.255.0 essentially.
The scan takes awhile, so I'm
definitely going to cut this from the video.
Now, we have our results
from the network scan and CIDR notation.
I'm going to clear the screen again.
I'm going to go back to another scan that we've done in
the past just for demonstration purposes and that
is nmap scanme.nmap.org, hit "Enter".
This is just to show that you can
also run Nmap scan with the target of
a fully qualified domain name. Clear the screen again.
Now we'll run our Nmap.
We'll do an entire domain in CIDR notation of nmap.org,
and we'll do a /29 which is
>> a lot smaller network then a
>> /24 since there's 29 bits in the subnet mask;
meaning that there's 29 bits assigned to
the network portion of the IP address.