So a few lecutures ago, we saw how we identify which ports are scanned. Now in input management we'll see how
we identify which systems are scanned.
OK go to Kali and open a terminal window.
First I'll prepare Nmap query and because I'll play with the destination IPs, it will be the last
parameter of my query.
nmap is the command itself.
-n to close name resolution, Pn to close ping, sS for SYN scan.
Now keep it simple let's scan just the top three ports.
Now is the time to identify the destination systems.
Up to now we learned to scan a single IP and we learned how to scan an entire
C block, .0/24
OK so what are the other ways of identifying target systems.
You can select a range of any part of the IP address. In the slide the third and the fourth parts of
the IP address is given as range.
That means and Nmap will scan IPs from 192.168.1.0 to 192.168.255.255
I'd like to keep the range small.
I only define a range for the fourth part of the destination address, from 100 to 150.
There is only 1 machine between 172.16.99.100 and 172.16.99.150.
You can scan more than one IP block in a single query. Example and the slide scans two ranges.
The first range is between 192.168.1.0 and 192.168.1.255,
and the second range is between 10.0.0.0 and 10.0.255.255
Since I don’t have a second network on my Kali, I continue with the third example.
The third example is the combination of defining a range and a single number.
For example, you can scan the IPs between 172.16.99.100 and 140, IP 206,
and the IPs between 172.16.99.220 and 230
So here are the results: Nmap found a machine from the range of 100 through 140.
The machine with IP 206
and another machine from the range of 220 through to 230.
Another way to define the target systems is to give Nmap the IP addresses in a file. In a typical
penetration test or ethical hacking will scan the network a lot of times.
First you find a host, it doesn't make sense to scan the entire network again and again you'll see huge
networks.
So if you scan the entire network each time the pen test will take a lot longer than you think.
Let's open a second terminal screen and find a host of our IP block using ping scan. As we learnt before,
now clarify the output to have only the IP addresses of live hosts. grep command to get only the rows containing
IP addresses
and cut command
to get only the IP addresses from a row.
Now we can redirect the output into a text file to reuse the list and following queries.
But first let me close the name resolution. ow put a ">" character and give a file name
to write the result: ipList.txt
We're not interested in the first two IP addresses so let's edit the file and delete them.
I use nano text editor to edit the file. In nano, use “ctrl + k” to delete a line
Use “ctrl + x” to exit nano, press “y”, to save changes and hit enter save on the same file.
Type “cat ipList.txt” to look at the file again
Now we have 4 IP addresses in the file.
Let's create a new Nmap query and this time,
let’s give the destination systems in a file "ipList.txt". and here are the results of the four
systems which are listed in the "ipList.txt" file. So let's talk about the output management in Nmap now.
Up to now we've run a lot of Nmap queries and got the results on the terminal screen.
This is the default output behaviour called interactive output and it is sent to standard output (stdout)
In a penetration test,
we should save the results of the queries to be able to analyze them later on. Hopefully Nmap has its
own output management skills.
So let's have a look.
There are three major output saving formats and Nmap; normal output which is similar to interactive
output.
That's what you see on the screen up to now, except that it displays less runtime information and warnings.
Since it is expected to be analyzed after the scan completes rather than interactively. Grepable output
which includes most information for target host on a single line.
So we can use it to collect the information you want using the excellent "grep" command.
We've already seen a few examples of grep command in this course. XML output is one of the most important
output types as it can be converted to HTML easily parsed by programs such as Nmap graphical
user interfaces or imported into databases.
There is one more magic parameter which is -oA to let you generate the outputs in all formats.
Now let's see the Nmap output management in action.
Go to Kali and open a terminal screen. Prepare an Nmap query.
For this example I want to prepare a SYN scan.
Now we are ready for output management options.
First I want to generate XML output using -­oX parameter
oX parameter needs the output file name.
You can give the file name with the full path.
If you don't specify a path just as in this example the file is created in the current folder.
Be careful.
-­oX, oG and -­oN parameters require the full filename
So if you want the file to have an extension such as ".xml" you should specify it here it.
Hit enter to run the command
to see the generated file. Here it is. And use the "ls" command to see the content of the file.
So it's typical XML file with tags.
Here's a "host" tag starts and ends. All the results about a host is listed between the start tag and the
end tag. IP address, scan ports and of course the scan result.
Here's another host tag and the scan results of the second host as well.
Press "q" to quit. "less" command.
Now let's call back our Nmap query with a updown arrow keys of the keyboard.
Now I want to generate all types of output type -oA and the base name of the files.
Be careful -oA
parameter requires a base file name of the files not the full names of a file and it'll put the file
extensions itself.
Let's look at the content of .nmap file using the less Linux command.
This is almost the same as you'll see on the screen.
Now let's look at the grepable output. Here there are two lines for each host.
One to show the status of the host and another one to show the port scan results.