>> Now I'm going to show you a really interesting one,
the nmap has built in and that is
nmap-iR and then a number.
What this does is it tells nmap
to basically randomly select
10 IP addresses and they're all
outside your network perimeter
and then run a scan against them.
I'm not going to run it because I don't
know those IP addresses and I don't really want
to run it against people that
I don't know because I think
it's borderline unethical and possibly illegal,
so I'm not going to do it.
That's that scan.
If you did want to run this from your house,
I wouldn't recommend doing it from your work or at home.
If you want to do a really quiet scan
using random IP addresses out there,
you could do nmap-sS-p
80-T2-iR.
Then the number of random IP addresses that you want.
Let's say you wanted to run against 50.
What the scan does is it's a SYN scan,
which is really the default scan
that nmap runs a TCP SYN scan.
The dash p is for the port that you want to scan.
It's only scanning a single port
instead of 1,000 or a 100.
The -T2 is the timing,
and that timing is considered polite.
Like we said before,
-iR is a random selection of
IP addresses and the
50 is the number of IP addresses you want to scan.
Again, if you want to run that from your house,
I don't think it's going to do any harm at all.
But I just suggest that you don't do it from work or
school because might get
picked up by your company's IDs,
or if they have
a seam or Advanced Threat Management System.
You just don't want any of those guys
talking to you unless that's you.
In which case?
If it's part of your job description, go ahead.
Now I'm going to do nmap-sn.
That's a scan that we've run before.
This time I'm going to add an exclusion.
We'll do exclusion of 1.1.
Actually I'm going to modify it just a
little bit to make it run faster.
Well, 1.0 through, let's do 40.
We'll exclude IP address 1.1.
There's only three hosts up
out of those 40 that we scanned.
Here they are right here.
It got done in 1.67 seconds.
If you notice, we did an exclusion on 1.1,
which should be about right here and it's not there.
That's how you do an exclusion in nmap.
Now what I want to do, clear the screen.
Let's say you wanted to do the same thing,
but you wanted to exclude
multiple hosts that were in that range.
This is the way you do it, nmap.
I'll do a ping sweep again.
I'll go ahead and do the full subnet,
will do a - -exclude.
We'll exclude 192.168.1.1.
I know the host name of the server on this network.
We'll do see psrv1 and we'll do 192.168.1.254.
My main point is it's the same command as last time.
But if you're going to put multiple exclusions,
unlike your target specification
from earlier with the exclusions,
you actually have to separate them by commas.
I don't know why they did that, but that's
the way it is. Let me run it.
I'm not going to go through this whole list here,
but you'll notice at the end,
the last IP address that is alive or up is 192.168.1.167.
We excluded 1.254,
which would show up right around here if it was
up or if it wasn't excluded is what I mean.
It's not their so are exclusion list worked.
Clear the screen again.
We're in the targets folder here.
The one that we created earlier.
You can call it whatever you want really,
but I just do targets just to make it easy.
What we're going to do now
is I'm going to show you how to do
an exclusion list without
having to type each one at the command line,
you can actually create a file like.
We did with the target specification,
the target list earlier.
We'll do no bad.
Of course, this assumes you're on Windows 10.
If you're in Linux or Unix platform or Mac OS,
you can do VI or whatever makes you happy.
I'll do a notepad or
excludelist.txt. Yes, I want to create it.
I'll do some exclusions here.
I'll do 192.168.1.1.
I'm going to do 192.168.1.10-50,
>> we'll do 192.168.1.254.
>> Just so you know, this is
my Layer 3 switch on this network.
These are servers and other devices,
and then everything in between 50 and 254
are just devices on this network,
254 is my firewall.
There's some inside information
there. Don't use it against me.
We'll do a clear screen.
Now that we've created our exclude list file will run
a scan against an entire subnet
using that exclusion file.
So nmap-sn.
We'll do excludefile.
Then the name of the file that we want to
specify where the exclusions are. Hit Enter.
I'll scan up and show you.
You can see here that it skipped 1.1,
and then it skipped everything beyond 1.10.
Then it's started grab and everything from 1.101 and on.
Then it skipped 1.254,
which we know is alive. There you have it.
That's pretty much all
of the target specifications in nmap,
there are some other options
and other things you can play with.
But for the most part,
that's everything that you're going
to use in your daily life.
Thanks for going through this lab with me,
and I'll see you in the next lesson.
In this lesson and the previous one,
we did a review of target specification
is covered in previous lessons.
Then I showed you a bunch of additional options.
Finally, we did a lab that covered all of them.
Thanks again for walking through this lesson with
me and I'll talk to you again on the next one.