>> Welcome to the target specification lab.
I decided to break this off from
the previous lesson because there's just so much to go
through and getting your target right might be
the most important thing about
constructing an Nmap statement.
Bear with me because it is really all useful stuff.
Let's move on to the lab.
In this lab, we're going to run through
target specifications we discussed in
a previous lesson then combine them with
new target specs I provided
you in this lesson. Let's do it.
Welcome to the Nmap lab on target specification.
Getting the target right is vital to any Nmap scan.
Let's make sure we do it right.
I'm at the command prompt and I'm going to start with
a single IP address scan using Nmap 192.168.1.1.
The target obviously is an IP address,
and there you can see the results and
some information about the device that sits at that IP.
I'll clear the screen and now we'll do a new one.
[NOISE]
This is Nmap scan of multiple IP addresses.
Notice that they're separated by a space.
There's no comma there. I'll hit "Enter".
There you can see the results,
three hosts up scanned in 12.77 seconds.
I'll slowly scroll up so you can see the details.
See the ports, MAC addresses, and so forth.
I'll clear the screen.
Now I'll do a nmap -F. That's a fast scan,
meaning that it scans the most popular 100 ports.
I'm going to do a range of IP addresses, 1-50.
You don't have to type the entire IP address again,
you can just put 1.1-50.
It's a lot IP addresses to scan,
but it goes fast because I did the fast scan.
You can see there's 50 IP addresses.
Six of them are up,
and it was scanned in 3.67 seconds.
Here's all the detail.
I'll clear the screen again.
Now I just want to show you that you
can scan a single fully qualified domain name.
We'll do a nmap scanm.nmap.org.
We've done this 100 times already.
I actually typed it wrong nmap scanme.nmap.org.
There's the details on the nmap
scanme.nmap.org fully qualified domain name.
I'll clear the screen again.
Now I want to show you a combination of
two of the scans that we just did and
that is the following.
Basically what I'm trying to show you here is that you
can scan multiple hosts with a space in-between them.
But they don't all have to be IP addresses.
They can be IP addresses and IPv4 format,
IPv6, and you can put
a fully qualified domain name in there.
>> I'll hit "Enter".
>> Took 12.15 seconds and all three hosts are up.
There's the details.
Lots of stuff open on 1.10.
It was successful. I'll clear the screen again.
Now, we'll do a ping sweep.
This will be a ping sweep of
the entire subnet insider notation.
What the ping sweep does
>> is it sends an IP echo request,
>> TCP SYN to port 443,
TCP act to port 80,
and an ICMP timestamp request.
The thing I like the most about is that it
scans a huge range of IP addresses really fast,
and it basically provides you with a list of
only the IP addresses that are up and running.
It gives you a list of live hosts. Here's the command.
Most important part here is
we're talking about target specification.
It's just basically nmap and then the 192.168.1.0/24,
so the cider notation,
but because we're limited on time,
I threw in that -sn because it runs so fast.
Here you can see the results took 4.93 seconds
and out of 256 IP addresses it found 27 hosts.
You can see that it provides a MAC address,
tries to determine the manufacturer
of the network card based on the MAC address.
It'll do a name resolution on each IP.
It's a really cool scan.
We'll do it more later when we get into host discovery.
Clear the screen again. I want
to show you a similar scan which
>> is nmap -sn nmap.org/29.
>> The main thing is the nmap.org/29.
We've done this one before too.
Basically, I'm trying to show you that you can do
CIDR notation with a domain name.
It'll find all of the IP addresses in
the slash 29 network adjacent to nmap.org.
I'm doing a ping sweep again because it's fast.
There's the results and you can
see that there are five hosts
adjacent to that domain name.
I'll clear the screen again.
Now, we're going to go into something a little bit new.
You can see I'm in Program Files, Nmap directory.
I'm going to create a directory called targets.
I'm going to navigate to that folder. Clear the screen.
Now, I'm going to basically create
a file and you'll see why in a second.
I'm going to do a notepad targetlist.txt.
Do you want to create a new file?
Yes. Here's the file.
What you can do is just list
as many targets as you want to scan.
I'll show you the command for running
the scan against those targets in just a minute.
I'll just pick some random ones.
I'll throw in a hostname,
and I'll go ahead and do an outside domain name.
We'll just do a Google.
Let's just leave it at that.
File, Save, Close.
Do a dir make sure it's there.
Our target list is there.
Clear the screen again.
The command to run a scan
against all of those targets is like this.
We'll do an nmap,
and you can just do a -iL, and then the file.
Since there's a bunch of them there,
I'm going to do a ping sweep again.
We'll do a sn,
and then a -iL,
and then the name of the file.
Basically, what it's going to do
>> is do a ping sweep with
>> all of the hosts that exist in this file name.
I hit "Enter". There you
can see it scanned 35 IP addresses,
seven of them are up and it scanned it in 1.5 seconds.
That was really fast. You see Google right there.
I don't feel too bad about doing a ping sweep
of Google because it's really a very quiet scan,
and people ping Google
all the time just to make
sure that our network is working,
and so a simple ping sweep
is nothing compared to the traffic they're used to.
Do a clear screen.