Port scanning with Nmap.
In this video, we're going to be exploring
the process of identifying open ports on a target system
as well as the respective services that are
running on these open ports.
And we're going to be doing this through the use
of a tool called Nmap as we have already
explored in the previous video.
So if you recall in the previous video,
we explored the process of discovering hosts on a network.
We are now going to turn our attention
to targeting or performing a port scan on one of these hosts
in order to identify the open ports that are running
on this target system as well as the services that are running
on those open ports.
And we'll also try and perform some service version detection
scanning, operating system detection.
And the objective here is to essentially obtain
as much information as possible or enumerate as
much information as possible from a target system with Nmap.
Of course.
I'm not going to be focusing on service and enumeration,
because that is going to be covered in its own course.
We're primarily focused on performing
port scanning on both TCP ports and UDP ports.
But this video will give you an introduction
to performing port scanning with Nmap,
and we'll be covering quite a few techniques.
So this video has a lab environment attached to it
that you can start up and follow along if you want to,
or you can complete this video and then go ahead and start up
the lab environment and run through the instructions
provided or highlighted within the lab documentation.
So I'm just going to switch over into my lab environment.
So I'm currently within the lab environment.
This lab environment will provide you
with a graphical user interface or GUI access
to a Kali Linux system.
You will also be provided with the IP address of the target
system.
So we're now going to assume that you've
selected an IP address that you'd
like to perform a port scan on.
Please do note that in your case or in your lab environment,
the target IP address will be different.
So just keep that in mind.
So I'm just going to open up my terminal here, and let's
perform the default Nmap scan.
And I'll be explaining what the default Nmap scan does.
So whenever you're using Nmap and you simply type in Nmap
and you provide the target IP, this is a default Nmap scan.
Now, when you're performing a default Nmap scan,
you're essentially performing a SYN scan on 1,000
of the most frequently used ports.
So you're not scanning the entire TCP
range or the entire range of TCP ports on the target system.
So I'll just hit Enter, and you will see
that we'll run into an issue.
And the reason we're running into the issue
is very important.
So whenever you're dealing with Windows target systems,
and in this case, this is the IP address of a Windows system,
Windows systems will typically block ICMP pings
or ping probes if you will.
And as a result, Nmap will tell us that the host seems down.
That's because it's blocking the ping probes.
So Nmap recommends disabling or essentially
avoiding the process of performing a ping
or trying to identify if the host is active.
And that can be done through the use of the Pn option.
So we can specify this by saying Pn
and remember we're still performing
a port scan on 1,000 of the most frequently used ports.
The only difference now is we're essentially telling Nmap,
do not check if this host is online,
just perform the port scan.
So I'll hit Enter.
And you'll see after a couple of seconds,
this will provide us with a list of open ports on the target
system.
And it tells us right over here that the host is up
and 993 ports are closed or filtered.
So that again, vindicates my point that the default Nmap
scan performs a port scan on 1,000 of the most frequently
or most commonly used ports.
So you can see that this Nmap will display the output
in the form of three columns.
So you have your port, the state, and the service.
So in this case, we've performed a TCP port scan.
I'll be working through how to perform
a UDP port scan as well.
So you can see we have port 80, which is open.
And, of course, that's used to host a web server.
And then of course port 135, 139, 445, 3389.
So from these services alone, we can pretty much
tell that this system is running Windows.
Now, Nmap can be used to perform operating system detection.
We'll get to that shortly.
But just by taking a look at the services being displayed here,
this doesn't display the exact service or the service version.
But you can see we have Microsoft DS.
Port 3389 is used for RDP.
And, of course, this is for 139, and 445 are used for SMB.
And then, of course, we have about 135,
which is used for MSRPC.
And we have a web server running on the target as well.
And, of course, we can confirm this by trying to access.
I'll just copy the IP here.
We can try and access the web server
by navigating to the target IP within our browser
or within Firefox.
And you can see it's running an HTTP file server.
So now, that we've identified or we've
taken a look at how to perform a default Nmap scan,
let's take a look at what we can do as well.
So let's say we wanted to perform an Nmap port scan
on the entire range of TCP ports,
which is about 65,535 ports.
Well, after the Pn option, which is applicable for Windows
targets, we can utilize or specify
the -p- hyphen option, which will scan the entire TCP port
range.
Now, because we're scanning about 65,535 ports,
this scan is going to take a couple of minutes.
So we're not going to be doing that.
But you can also specify specific ports
that you'd like to scan.
So for example, if I wanted to scan port 80 to see if it's
open, I can say -p port 80.
And you can also space this out.
So I can hit Enter, and you can see it only scans port 80.
You can also specify multiple ports, so maybe
port 80, port 445, and port 3389.
So let's say we want you to see whether these ports are
open on the target system, we can hit Enter.
And indeed, you can see they are open.
If we specify another port that might
be closed on this system like port 80,
you can see how the Nmap output will differ.
So you can see that in this case,
it tells us that port 8080 is filtered.
Now, that means that it could be the actual target
system may have a firewall that is filtering the traffic.
And this pretty much means that there is a firewall in place
or that this port is closed.
And you can see this port-- the service is typically
used either by a web server or an HTTP proxy.
So that's how to specify a custom list of ports.
As I said, you can also specify the entire range, which
can be done using the -p- option,
or you can specify the range itself.
So you can say port 1 to 65,535 like so,
or you can say I want you to scan
ports between the range of 1 to maybe 10,000.
So you can also do that if you want as well.
So I'll hit Enter.
This is going to scan the port range from port 1 all
the way to 10,000.
And as you can see, it does that right over here.
Now, there are a couple of other options that you can use.
The default and Nmap scan scans 1,000 of the most commonly used
ports.
But Nmap also has a fast scan option,
which will only scan a hundred of the most commonly used ports
on the target system.
That can be done by specifying the -F option.
So I'll hit Enter.
And you can see that will, again,
perform a scan on 100 ports.
So you can see 93 are filtered or closed
and the rest are open.
In this case, about seven ports.
That is how to specify a custom port or a custom port range
if you will and how to specify the entire range of TCP ports.
Now, if you want it to perform a UDP port scan,
you would need to use the su option.
So you can say su because by default, Nmap
will perform a TCP port scan.
So you can say su and hit Enter.
This is going to take a couple of seconds
to a couple of minutes, depending
on the target and the actual network environment
you're working in.
I'll also be showing you shortly how
to speed up or slow down scans.
In some cases, you may want to speed up your scans.
And in certain cases, you may want
to be stealthy and slow down your scans,
so that your traffic is not flagged as malicious.
Because remember, the current scenario that we're working on
or that we are trying to emulate here
is that you're now connected to a company's internal network
or a company's network, and you're
trying to perform a port scan on the systems
that you are able to identify through the host discovery--
through the host-- or from the host discovery phase.
So this is going to take a while.
I'm just going to wait for it to complete.
You can hit Enter to view the status of the scan.
So you can see it'll give you a percentage indicator here,
and you can also increase the verbosity of the scan, which
means Nmap will display a more output regarding what
is going on in the background.
So I'll walk you through that shortly.
I'm just going to wait for this to complete.
This should tell us what UDP ports are currently
open on the target system.
So I'm just going to give this a couple of minutes, about two
minutes Nmap is saying here.
And I'll get back to you when it's done.
All right.
The UDP port scan is done.
And in this case, it tells us that all 1,000 scanned ports
on the target are open or filtered.
But it doesn't display the ports, which
means it is unlikely that any of the UDP ports are open
and are running any services.
But it's always good to perform a UDP port scan,
because specific services run on UDP services like, for example,
DNS.
So it's always good to know how to do that.
So as I said previously, you can also
increase the verbosity of the output produced by Nmap when
performing a scan.
That can be done through the use of the v options or -v,
hit Enter.
And what this will do is it'll actually
display output during the scan.
So it'll tell you what port has been discovered
or what port has been discovered to be open,
and then it'll display the results right over here.
So you can always get an idea as to what's
happening in the background.
So now that we've been able to identify the open ports
on the target system, what we would now need to do
is identify the specific services and service versions
running on those open ports.
So you can see, we have all of these open ports.
And we can identify more information
regarding those services.
So let's say we wanted to perform a fast scan.
We can then say we want to perform a service version
detection scan using the sv option.
So that's -sV.
We provide the target IP address there,
and we can then hit Enter.
And you'll now see the difference
between the two scans or the scan
that we performed previously.
So I'll give this a couple of seconds.
Because when you're performing service version detection scans
or when you're trying to identify
the specific services and the service versions
running on these open ports, it's
going to take a much longer or signific--
or comparatively longer.
So you can see you can hit Enter to get an update
or to get an idea as to how much of the scan is complete,
and how much time is remaining.
So I will give this a couple of seconds to complete.
All right.
So the service version detection scan is complete.
And now, Nmap will output the results.
And we'll also add an additional column
for the version information.
So you can see well, in the previous scan,
we identified the open ports themselves.
We now get an idea as to what services
and the specific service versions
or the version of the services that
are running on that open port.
So in the case of port 80, we can
see we have the HTTP file server version 2.3.
Why is this information important?
Well, for example, we could essentially try and identify
vulnerabilities that affect this specific version of the HTTP
file server.
And you can see in the case of the other ports,
the SMB port gives us the actual operating system banner,
which in this case, tells us that this system might
be running Windows Server 2008 R2 all
the way to Windows Server 2012.
Now, we can also perform an operating system detection
scan with Nmap by using the O option so that is -O.
And that will try and detect what operating system is
running on the target system.
Now, this is not always conclusive or accurate.
And in most cases, it'll give you
a range of operating systems that might be
running on the target system.
So I'm going to hit Enter.
And again, we're going to give this
a couple of seconds to a couple of minutes to complete.
And as I said, if you'd like to know
what's going on in the background,
let me just terminate that.
I can just specify that I want verbose output.
And you can see it's going to start off
by discovering open ports.
It's then going to perform--
it's then going to begin performing the service version
detection scan.
And there we are.
You can see it's going to complete the SYN Stealth scan.
It discovers the open ports there.
And then it's going to scan seven services
to discover the specific services that
are running on those open ports and the versions
if that information is contained within the service banner.
And then after this is done, it's
going to then perform an operating system detection scan
or operating system guess based on the open ports on the target
as well as the banners or the services
that are running on those open ports on the target system.
So I'm just going to give this a couple of seconds
to a couple of minutes to complete.
It looks like it's about 57% done.
So the Nmap scan is complete.
And as you can see, it runs all the options or the checks
that we wanted the Nmap scan to perform.
At the bottom here, you can see it tells us
that the operating system scan results may be unreliable.
Because we could not find at least one open
and one closed port, and then it tells us-- it gives us a guess,
essentially that this system is running Windows Server 2012.
However, it doesn't give us the exact edition of Windows Server
2012.
But in this case, I can confirm that this is correct.
So Nmap, in this case, has been able to tell us
what operating system is running on the target, which
is very, very important.
Because as a penetration tester, you
could then start identifying vulnerabilities
that affect this specific version of Windows server
and consequently identify exploits, and then
try and gain access to the target system that way.
So that is how to identify the operating system that's
running on the target system.
We can also obtain more information
from these open ports by performing a default Nmap
script scan.
That can be done by also including the S--
So that is -sC So that's lowercase s, uppercase c
option there.
And this will run--
it'll essentially run a list of Nmap scripts
on the ports that are currently open in order
to identify more information or in order
to enumerate more information from these open ports.
So I'll just hit Enter.
And as I said previously, I'm just
going to give this a couple of seconds to a couple of minutes
to complete.
Because the more options we specify
or the more information that we are
trying to enumerate from the target system,
the longer the scan will take.
But once this is done, I'll show you
how this can be sped up or slowed down
based on your own requirements or based on the network
environment that you're working in.
So I'm just going to wait for this to complete.
The Nmap scan is complete.
And as you can see, in addition to providing us
with the operating system here--
the operating system information here,
we can see that under each of these services
whenever you perform an Nmap script scan, especially
with the default Nmap script scan option
for each of the services, it will
run a series of Nmap scripts based on the service.
So in this case, you can see that it runs a script called
HTTP favicon, HTTP methods.
In this case, it tells you the supported methods
on this particular web server, and then the HTTP server
header, which tells us that it's running HTTP File Server
version 2.3.
And then the HTTP title script simply
tells us the title of the website.
And under the port 3389, you can see it runs--
it essentially runs an RDP Nmap script that tells you--
gives you information regarding the SSL certificate
pertinent to this particular service.
And it also does that--
or it also does this for the SMB port.
So you can see it runs a script called SMB security mode, which
tells you whether the authentication
level, the challenge response, and the actual message signing
status.
So you can see it's currently disabled.
And then it tells you that the current version of SMB
is SMB version 2.02.
And it also gives you the SMB time or the actual time
of the system based.
This is obtained from the SMB two times script here.
So that is how to run the default Nmap script scan.
Now, we'll not be covering how to run individual or other Nmap
scripts.
That is something that we'll be exploring in the enumeration
course.
For now, you can simply take a look
at how to run the default Nmap script scan.
So that's how to perform the Nmap script scan.
A couple of other Nmap scan options we can use
are, for example, the aggressive scan.
So what the aggressive scan is--
the aggressive scan essentially combines a service version
detection, operating system detection, and the default Nmap
script scan into one.
And it can be denoted or it can be specified
by specifying -A. It'll essentially just run
the same scan that we ran previously,
which is this scan here.
So given the fact that we've already done that,
we don't need to do it again.
Now, if you wanted to speed up a scan,
you can utilize Nmap scan timing templates.
And I'll just open up Nmap here the, main pages for Nmap,
and I'll just locate, for example T4--
sorry.
That is -T4.
So you can see that Nmap provides you
with various timing templates ranging from T0 to T5.
The lower the number, the slower the scan.
And the higher the number, the faster the scan.
Why would you want to speed up or slow down your scan?
Well, let me see if I can identify that here
under the options summary.
It should be somewhere here.
So there we are.
Under timing and performance, you
can specify the timing template to use.
So you can see higher is faster.
And if we actually go to the timing options just below here
under the documentation, let me see if I can find that here.
So I'll just take a couple of seconds,
because I do want to explain the differences.
Because they're not only known by their names,
but they also have specific names based on what they do.
So let's see if I can identify that under the documentation
here, because I know it should be below this here.
So here we are.
So you can see this is used to specify the timing template.
So you have paranoid, sneaky.
So paranoid is all the way from zero.
So T0 is paranoid.
T1 is sneaky.
T2 is polite.
T3 is normal.
T4 is aggressive.
T5 is insane.
So this allows you to speed up or slow down your scan.
So in certain cases, you may want to slow down your scan
if there is an intrusion detection system
present on the network, or you may want to speed up your scan
if you're trying to essentially get your scan results as
quickly as possible.
So for example, if I wanted to run this scan faster,
I could specify the timing template T4 or T5.
So I can say T4 or T5.
Now, by default, Nmap will automatically
detect what timing template to use based on the network
infrastructure.
But you can always overwrite this.
So let's try and use T5 here.
This is, of course, not recommended on any production
network, because this will essentially
increase the amount of packets being sent.
And that could potentially lead to a denial of service
on the networking equipment like routers or switches.
So I'll just hit Enter.
And you should see that this is going
to be much faster than when we run the scan previously.
So I'll just give this a couple of seconds.
And we should get the actual results much faster than
when we had use the default Nmap timing template or timing
profile, if you will.
So the Nmap scan is complete.
Now, this is the previous Nmap scan
that we ran without the timing template or the timing
profile specified.
So you can see it here.
Let me see if I can identify the actual Nmap scan.
So you can see no timing template,
and we take a look at the summary at the bottom.
Nmap will actually tell you how long this scan took.
So that was without the scanning--
without the timing template.
And then this one right over here took about 119 seconds.
So in the grand scheme of things,
it may not look like an improvement.
But when you're scanning an increased number of ports
and maybe if you're scanning more than one system,
then the utilizing the timing templates will be a huge help.
So you can also slow it down if required.
As I said, it's all based or all dependent on the environment
that you are working on.
One of the final options that I want to highlight
or that I want to cover is the ability
to output your Nmap scan results into a file, which
is very, very important during a penetration test.
Because you always need to be documenting whatever you
are doing.
And in the case of port scans, you
need to make sure that all of the port
scans you're performing are saved somewhere.
So that you can always refer back to it.
So that you don't have to go through this process again.
So Nmap allows you to output into three main formats.
I'm just going to be exploring two of them.
One of them is the normal format, which will essentially
output the scan results in the same way they
are displayed on the terminal into a file of your choice.
In most cases, you can specify or output the results
into a txt file.
So I'm just going to say -oN and the file
that we're going to be exporting the scan results to is called
test.txt.
So I'll just hit Enter.
And now, if I kept the contents of test.txt,
you can see that it should actually
display the same information.
There we are.
The other output format is xml format.
That is very useful because you can essentially output--
this output can be imported into a framework like Metasploit.
So I can say oX and I can then change the file to an xml file.
So I'll just hit.
Enter and you should see that the format,
if we get the content of test.xml,
the format should be in xml format as you can see here.
So that is going to conclude the practical demonstration
side of this video.
So that was the final video within this course.
So we have now been able to successfully explore
both passive and active information gathering.
As I said, this is not entirely conclusive
when it comes down to information gathering.
We will be exploring enumeration,
which is another aspect of active information
gathering in its own course.
Because that is something that requires its own course because
of the depth involved and the large amount of services
that you are required or that you should know how
to enumerate information from.
So that is going to conclude this course.
And I'll be seeing you in the course conclusion video
up next.