Now that you know the basics of nmap we can move on to advanced features. Many firewalls and routers
block or drop ICMP ping packets. When you use nmap to scan a system or a network, by default, it sends
out a ping to see if the host is up and if it gets a response, it then sends the specified packets
to scan the system. If the ping is blocked or dropped, nmap gives up and says, "host is down." To get around
firewalls and routers that block ping packets,
we need to suppress nmap's default behavior of sending out that initial ping.
We can do this by using the -Pn option,
like this: nmap -Pn (P in uppercase) and the target, it will scan the target without sending an initial
ping.
Let’s move on and talk about Firewall and IDS, Evasion and Spoofing. When you are
scanning machines that are not yours,
you often want to hide your real IP address which is your identity.
Obviously every packet must contain your source IP address,
otherwise responses from the target will not return back. A recommended solution to obfuscate
your real IP address is to use decoys. -D option causes a decoy scan to be performed, which makes
it appear to the remote host that the hosts you specify as decoys are scanning the target network too
and their intrusion detection system might report multiple ports scans from unique IP addresses but they
won't know which IP was scanning them and which were innocent decoys.
This is generally an effective technique for hiding your IP address. Let's scan the port 22 using
decoys so nmap -p 22 -sV
I want a version scan as well.
The IP address of the target
-D and the decoys using a comma between them;
the first the decoy,
the second decoy,
and the last one.
In this example the target will be scanned from four different IP addresses and it will be hard for
it to identify which one is the real source of the scanning.
I've used private IP addresses as decoys,
but of course you can use public IP addresses as well.
Note that the hosts you use as decoys should be up or you might accidentally SYN flood your targets.
Also it will be pretty easy to determine which host is scanning if only one is actually up on the network,
so the decoy hosts must be up. In the next example
I want to show you how to read the targets from a file. Passing a huge list of hosts is often awkward
on the command line.
Just imagine you have a list with 100 hosts
you wanted to scan and you want to avoid writing 100 IP addresses at the command line; you simply generate
the list of hosts to scan and pass that filename to Nmap as an argument to the -iL option.
Let's create the list: vim hosts.txt 192.168.0.100
the default gateway, the public DNS server from Google and vulnweb.com
entries can be in any of the formats accepted by nmap on the command line, so IP addresses, host
names, networks and so on.
Each entry must be separated by one or more spaces, tabs or new lines.
So I want to scan these 4 hosts.
You can use notepad or your preferred editor to create the text file and nmap -p
I want to scan only part 80, 80 -iL and the name of the file hosts.txt and it scaned
those 4 hosts and port 80.
If you want to speed up the scan you can disable reverse DNS which is performed by default.
You can use -n option.
This is reverse DNS; it tried to translate the IP address into a domain name, so -n
If you wanted to export the output into a file to further analyze it you use -oN
option like this; -oN output.txt, the file will be created.
The output was displayed both at the console and saved into the file.
This is the scan output. At the the end of this lecture
we'll discuss timing templates which are used to optimize and improve the quality and performance of
the scan.
These templates set the time interval nmap waits for our response and the time between each packet
sent by nmap to the target; -T option is used to set a timing template and there are 6 such
templates. Each template has a name and a number. Better let's take a look at the man page of nmap
and I'm searching for -T typing /-T and enter; and n to find the next occurrence
and one more time.
And OK
these are the templates; paranoid or a 0; sneaky or 1; polite or 2; normal or 3 or aggressive and insane
which is 5; these templates allow you to specify how aggressive you wish to be while leaving nmap
to pick the exact timing values. The first two, paranoid and sneaky, are for intrusion detection system
evasion and nmap will slow down the scan a lot. You'll have to wait a longer time if there are more
hosts and ports to be scanned. T3 or normal is the default and the last two will make nmap
scan the target extremely fast. That will probably be detected and you'll sacrifice some accuracy for
speed. If you want to see the exact time values for these templates you should take a look at the man
page of nmap.
You'll see a lot of details here; if you want to perform a fast scan T4's the recommended template
in most cases. I'm exiting the man page by pressing on q. Let’s try such a fast scan on a
target nmap -T4 and I'll also use the-A option which enables operating system and version
detection script scanning and trace route. This is a really useful option. And the target1
This scan will take a few tens of seconds! Remember that if you press the Enter key while running you'll
see the progress.
It's almost over!
And it's over; we see the result of the scan! Okay, that's all! In the next lecture we'll talk about
Nmap sScripting Engine or NSE.