>> Welcome to the Nmap,
TCP, and UDP port scanning lab.
This lab takes a little bit of time to go through,
so I decided to separate it from
the port scanning lesson itself.
Understanding how to tell Nmap what ports to
scan is fundamental to creating Nmap scan statements.
This lab is one of the most important in the course.
I think you'll find it pretty easy once
you see several examples, and
practice it for yourself. Now onto the lab.
In this lab, I'll show you how to create, and run
Nmap statements that scan for specific ports.
We'll run through a bunch of
different options that include
both TCP, and UDP ports, and quickly evaluate the results.
This slide shows you the steps will follow.
Welcome to the Nmap port scanning lab.
After you've used host discovery options
to narrow down your search to
select an interesting targets,
you need to get more granular about your scans in
order to uncover potential vulnerabilities.
In this lab, I'll focus on
scanning a Windows 2012 server.
I don't mean to harp on Windows Servers too much,
but they're very common, and they have the potential,
especially on a local network,
to expose a lot of useful information to
an attacker even when
the built-in host-based firewall is enabled.
On my network, my 2012 R2 server
is at the IP address 192.168.1.10.
We'll start with a regular Nmap scan,
which as you've heard a million times,
it scans a 1,000 TCP ports using
the SYN scan, and it's the same as a -S.
We'll do Nmap
192.168.1.10.
See all the open ports.
That's the same as nmap- sS,
put the same IP address.
I won't run it again. You've seen it a lot.
All right. Now we'll do Nmap -F, and as you know,
this scans 100 of the most popular TCP boards.
There you go. Pretty much the same results.
Nmap's really good about identifying what are
the most common ports so in some scans you won't see
a difference between the open ports in a
1,000 port scan versus
the 100 port scan, or the fast scan.
Another thing that you could do,
and we'll get into more details about UDP scans,
but you can do an Nmap- sU.
What this will do is scan 1,000 of
the most popular UDP ports on this IP address.
I'm not going to run the scan, because it takes
a really long time but feel free to
>> do that on your own.
>> What I will do is show you that -F,
a fast scan of the 100 most popular UDP ports
will work, and it doesn't take too long to run.
Enter to see the progress.
Enter again.
I'll go ahead, and let this run the scan complete.
Even though it does take a little bit of time,
UDP scanning takes a lot longer to
run than typical TCP
scanning no matter what type of DCP scan that you run.
Really, especially a SYN scan,
SYN scans are so fast. There you go.
You see the three open UDP ports,
and the responding services. All right.
I'll clear the screen, and now
we'll do a combination of those two,
we'll do a fast UDP, and TCP scan.
This is nmap -S for the SYN scan,
sU for UDP scan,
and dash F for the fast scan, my target.
The main thing I want to point out here is
that if you do a sU,
it will only scan UDP ports.
If you want to also add TCP ports,
you have to specify what type of
>> TCP scan you want to do.
>> In this case, I'm just going to do a
SYN scan because it's fast,
and it provides a lot of
valuable information. I'll hit Enter.
It'll take a little bit longer than
the last scan since we've added
the TCP SYN scan
but surprisingly it doesn't
take much longer than that one.
There we go. Now you can see ports, the state,
the service, and you see TCP, and UDP ports.
It took 21.92 seconds.
Now we're going to get into scanning
specific ports using a TCP SYN scan.
We'll do a nmap -P for the port.
We'll do port 53 for DNS.
All right, so -P, and then the port number against
that target, and we see that that port is open.
That's how you specify one port.
Let's do a nmap -p,
we'll do a 53,
80, and 135.
When you want to specify multiple TCP ports,
just do a space, and then each port
>> separated by a comma.
>> You see how fast that is.
All three of those are open on my Windows 2012 server.
Now I want to show you a little bit
of a variation from that.
Another thing that you can do is you can put
a port range and that's just separated by a dash.
I did a nmap -P 53,
453, and then this range of ports against this target.
Very fast, and you can see the results.
Another thing you can do in Nmap is you can do
a nmap -p-, and then the target.
This scan scans every single, all 65,535 ports.
Even with a SYN scan,
which is the default scan,
it takes a really long time.
I'm not going to run this one.
I'll go ahead and hit Enter just for the heck of it,
I guess, and you can see the status.
In this case, it takes
about a minute and a half probably.
I'm not going to let that run,
but I just wanted to show you
the syntax for scanning every single TCP port.
Another way that you can specify a port
is by the service name.
We'll do a nmap -p,
and we're going to scan against
these services or applications.
You have to learn a little bit of
what Nmap calls each one of those services.
They're pretty standard but once you do learn them,
if this is the way that you want to do it, feel free.
If you can't remember the port number,
but can remember the service name,
might be easier for you.
The scan is just as fast
so there you can see the results.
That's TCP SYN port scanning,
which is the default with Nmap.