Getting started with Nmap - Part 5

In part 4, we looked at the various scanning techniques that are available in Nmap. In this post, we'll look at the various port-scan specific options that Nmap provides.

Disclaimer: In this entire tutorial series, I have used scanme.nmap.org as the target host and sometimes my local machine itself. scanme.nmap.org is a machine set up by Nmap developers for educational purposes, so it is legal to scan it a FEW TIMES A DAY. Scanning networks, in general is a cyber crime and may even lead to jail. Please take permission before scanning random networks.

Scan specific ports


 So far, we've been looking at options where, by default the top 1000 ports were scanned. There will be situations where you would need to scan a port that is not among those 1000. This option will be helpful in that situation.

nikhilh@ubuntu:~$ nmap -d -p80,443 scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 12:25 PDT
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
...
...
PORT    STATE    SERVICE REASON
80/tcp  open     http    syn-ack
443/tcp filtered https   no-response
Final times for host: srtt: 81264 rttvar: 61024  to: 325360

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 1.84 seconds

Scan ports by name


If you have forgotten the port number for a particular service, that is not a problem. Instead of the port number, you can provide the name of the service that runs on that port number.

nikhilh@ubuntu:~$ nmap -d -pimap,smtp scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 13:23 PDT
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
...
...
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up, received syn-ack (0.082s latency).
Scanned at 2018-08-22 13:23:47 PDT for 2s

PORT    STATE    SERVICE REASON
25/tcp  filtered smtp    no-response
143/tcp filtered imap    no-response
Final times for host: srtt: 81738 rttvar: 81738  to: 408690

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 1.96 seconds

Scan ports by protocol


If you want to scan port x with TCP and port y with UDP, it is possible through this option. It important to use both -sS (or any other TCP scanning technique) and -sU for this to work.

nikhilh@ubuntu:~$ sudo nmap -d -sU -sS -p T:80,U:67 scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 15:21 PDT
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
...
...
Scanned at 2018-08-22 15:21:07 PDT for 0s

 PORT   STATE         SERVICE REASON
80/tcp open          http    syn-ack ttl 128
67/udp open|filtered dhcps   no-response
Final times for host: srtt: 10394 rttvar: 24115  to: 106854

 Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 0.35 seconds
           Raw packets sent: 7 (252B) | Rcvd: 3 (112B)

Scanning all ports


If you have the need to scan ALL 65535 ports, then this option will be helpful. Keep in mind that it will take a while to execute. I have never had the need to use this option so far. The command is as below:

nikhilh@ubuntu:~$ nmap -d -p- scanme.nmap.org

Scan top ports


Previously, we have seen the top 1000 ports being scanned. With the -F option, Nmap scans the top 100 ports. But what if you need to scan the top 10 ports? Or top 200 ports? Then this option would be helpful.

nikhilh@ubuntu:~$ nmap -d --top-ports 10 scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 13:34 PDT
PORTS: Using top 10 ports found open (TCP:10, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
...
...
PORT     STATE    SERVICE       REASON
21/tcp   filtered ftp           no-response
22/tcp   open     ssh           syn-ack
23/tcp   filtered telnet        no-response
25/tcp   filtered smtp          no-response
80/tcp   open     http          syn-ack
110/tcp  filtered pop3          no-response
139/tcp  filtered netbios-ssn   no-response
443/tcp  filtered https         no-response
445/tcp  filtered microsoft-ds  no-response
3389/tcp filtered ms-wbt-server no-response
Final times for host: srtt: 82117 rttvar: 35374  to: 223613

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 1.75 seconds

Scanning ports sequentially


Scanning ports sequentially is usually not recommended because it is very obvious that an entity is trying to scan the system. But if there is a requirement, then this is the option to use.

nikhilh@ubuntu:~$ nmap -d -r scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 13:40 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
...
...
Not shown: 998 filtered ports
Reason: 998 no-responses
PORT     STATE SERVICE    REASON
22/tcp   open  ssh        syn-ack
9929/tcp open  nping-echo syn-ack
Final times for host: srtt: 82645 rttvar: 15487  to: 144593

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 21.56 seconds

Scan and show only open ports


When this option is used, Nmap will only display open ports. All others, which include closed, filtered, unfiltered, open|filtered, closed|filtered will not be displayed.

nikhilh@ubuntu:~$ nmap -d --open scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 14:55 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
...
...
Reason: 997 no-responses
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE    REASON
22/tcp   open  ssh        syn-ack
80/tcp   open  http       syn-ack
9929/tcp open  nping-echo syn-ack
Final times for host: srtt: 83157 rttvar: 12869  to: 134633

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds

That's it for part 5! Like part 4, I believe this post's content was straight forward as well. I hope everything was simple to understand. If there are any questions, please leave them in the comments below and I'll get back to you as soon as I can!

In the next part, we'll be looking at OS and service version detection along with timing options that Nmap offers.
By at No comments:
Labels: , , , , , ,

Getting started with Nmap - Part 4

In part 3 of this tutorial series, we looked at various host discovery options that Nmap provides. Nmap first pings the target, checks its status and will proceed to scan it only if the host is alive (if -Pn option is not used). In this part, we'll look at the various scanning options that Nmap provides.

Disclaimer: In this entire tutorial series, I have used scanme.nmap.org as the target host and sometimes my local machine itself. scanme.nmap.org is a machine set up by Nmap developers for educational purposes, so it is legal to scan it a FEW TIMES A DAY. Scanning networks, in general is a cyber crime and may even lead to jail. Please take permission before scanning random networks.

Fast Scan


When the fast scan option is used, Nmap only scans the top 100 most commonly used ports rather than the top 1000.

nikhilh@ubuntu:~$ nmap -F -d scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 05:43 PDT
PORTS: Using top 100 ports found open (TCP:100, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Initiating Ping Scan at 05:43
...
...
22/tcp    open  ssh        syn-ack
80/tcp    open  http       syn-ack
Final times for host: srtt: 81393 rttvar: 34707  to: 220221

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 3.01 seconds

TCP SYN Scan


In part 2, I mentioned TCP Stealth scan. TCP SYN scan is the official name for TCP Stealth scan. This requires root access to execute and is the default scanning technique when Nmap is run as root as well.

nikhilh@ubuntu:~$ sudo nmap -sS -d scanme.nmap.org
[sudo] password for nikhilh: 
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 05:53 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
...
...
Initiating SYN Stealth Scan at 05:53
Scanning scanme.nmap.org (45.33.32.156) [1000 ports]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 45.33.32.156)))
Discovered open port 22/tcp on 45.33.32.156
Discovered open port 80/tcp on 45.33.32.156
Discovered open port 31337/tcp on 45.33.32.156
Completed SYN Stealth Scan at 05:53, 31.55s elapsed (1000 total ports)
...
...
Nmap done: 1 IP address (1 host up) scanned in 31.61 seconds
           Raw packets sent: 2018 (88.700KB) | Rcvd: 1032 (41.280KB)

TCP Connect Scan


We already know that TCP Connect scan is the default scanning technique when Nmap is run with regular user privileges.

nikhilh@ubuntu:~$ nmap -d -sT scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 06:02 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
...
...
Initiating Connect Scan at 06:02
Scanning scanme.nmap.org (45.33.32.156) [1000 ports]
Discovered open port 22/tcp on 45.33.32.156
Discovered open port 80/tcp on 45.33.32.156
Discovered open port 31337/tcp on 45.33.32.156
...
...
Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 50.72 seconds

TCP Connect scan is less reliable than TCP SYN scan because Connect scan uses the localhost's TCP/IP stack. It does not generate its own raw packets.

TCP ACK Scan


In this type of scan, Nmap generates TCP ACK packets and sends them to the target host. This type of scan is useful when you want to check if a system is protected by a firewall.
  1. If the system is protected, Nmap would receive no responses and the ports are marked filtered. 
  2. If unprotected, Nmap would receive RST packets and mark the ports as unfiltered as in the case below.
nikhilh@ubuntu:~$ sudo nmap -d -sA scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 06:15 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
...
...
Initiating ACK Scan at 06:15
Scanning scanme.nmap.org (45.33.32.156) [1000 ports]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 45.33.32.156)))
Completed ACK Scan at 06:15, 0.03s elapsed (1000 total ports)
Overall sending rates: 34491.08 packets / s, 1379643.36 bytes / s.
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up, received reset ttl 128 (0.000025s latency).
All 1000 scanned ports on scanme.nmap.org (45.33.32.156) are unfiltered because of 1000 resets
Final times for host: srtt: 25 rttvar: 7  to: 100000

 Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds
           Raw packets sent: 1004 (40.152KB) | Rcvd: 1001 (40.040KB)

TCP Null Scan


Null scan is a type of scan where all the TCP flags (SYN, ACK, FIN, RST, URG, PSH, ECE and CWR) are set to NULL. Many systems do not respond to such flags but a badly configured one, will.
  1. If a port is open, it will not understand what to do with such packets and it will discard it.
  2. If a port is closed, Nmap will receive a RST response.
nikhilh@ubuntu:~$ sudo nmap -d -sN scanme.nmap.org
[sudo] password for nikhilh: 
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 06:40 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
...
...
Initiating NULL Scan at 06:40
Scanning scanme.nmap.org (45.33.32.156) [1000 ports]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 45.33.32.156)))
Completed NULL Scan at 06:40, 4.03s elapsed (1000 total ports)
Overall sending rates: 496.45 packets / s, 19858.06 bytes / s.
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up, received reset ttl 128 (0.00039s latency).
All 1000 scanned ports on scanme.nmap.org (45.33.32.156) are open|filtered because of 1000 no-responses
Final times for host: srtt: 389 rttvar: 2213  to: 100000

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 4.09 seconds
           Raw packets sent: 2007 (80.272KB) | Rcvd: 5 (188B)

TCP FIN Scan


Like TCP NULL scan, not all systems respond to TCP FIN scan. In this type of scan, the FIN flag in the TCP header is set.
  1. If a port is open, the packet will be discarded silently and there will be no response.
  2. If a port is closed, it will generate an error message.
nikhilh@ubuntu:~$ sudo nmap -d -sF scanme.nmap.org
[sudo] password for nikhilh: 
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 08:48 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
...
...
Initiating FIN Scan at 08:48
Scanning scanme.nmap.org (45.33.32.156) [1000 ports]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 45.33.32.156)))
Completed FIN Scan at 08:48, 4.03s elapsed (1000 total ports)
Overall sending rates: 497.08 packets / s, 19883.05 bytes / s.
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up, received reset ttl 128 (0.00044s latency).
All 1000 scanned ports on scanme.nmap.org (45.33.32.156) are open|filtered because of 1000 no-responses
Final times for host: srtt: 444 rttvar: 2246  to: 100000

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 4.21 seconds
           Raw packets sent: 2007 (80.272KB) | Rcvd: 5 (188B)

XMAS Scan


In this type of scan, TCP flags - URG, FIN and PSH are set. It is called the XMAS scan because so many TCP flags have been set that the header looked like it was "lit up like a Christmas tree". Not all systems respond to this type of scan.

Systems that conform to RFC 793 are especially at risk.
  1. Ports that do not respond to such packets are deemed open.
  2. If the port replies with a RST, it is deemed closed.
nikhilh@ubuntu:~$ sudo nmap -d -sX scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 08:56 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
...
...
Initiating XMAS Scan at 08:56
Scanning scanme.nmap.org (45.33.32.156) [1000 ports]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 45.33.32.156)))
Completed XMAS Scan at 08:56, 4.04s elapsed (1000 total ports)
Overall sending rates: 495.34 packets / s, 19813.80 bytes / s.
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up, received reset ttl 128 (0.00029s latency).
All 1000 scanned ports on scanme.nmap.org (45.33.32.156) are open|filtered because of 1000 no-responses
Final times for host: srtt: 290 rttvar: 2164  to: 100000

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 4.11 seconds
           Raw packets sent: 2007 (80.272KB) | Rcvd: 5 (188B)

UDP Scan


On systems, there are ports (DHCP ports 67 and 68, for example) that specifically use UDP rather than TCP. States of such ports will be missed if you use only TCP scanning techniques.
  1. If a port is open/filtered/allocated, Nmap receives no response.
  2. If a port is closed, Nmap receives a Type 3 ICMP response - Port Unreachable. Many systems employ rate limiting which increases the time required to solicit a response from the target.
nikhilh@ubuntu:~$ sudo nmap -sU -d scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 09:04 PDT
PORTS: Using top 1000 ports found open (TCP:0, UDP:1000, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
...
...
Initiating UDP Scan at 09:04
Scanning scanme.nmap.org (45.33.32.156) [1000 ports]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 45.33.32.156)))
Completed UDP Scan at 09:04, 4.04s elapsed (1000 total ports)
Overall sending rates: 496.33 packets / s, 14365.54 bytes / s.
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up, received reset ttl 128 (0.00036s latency).
All 1000 scanned ports on scanme.nmap.org (45.33.32.156) are open|filtered because of 1000 no-responses
Final times for host: srtt: 360 rttvar: 2245  to: 100000

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 4.09 seconds
           Raw packets sent: 2007 (58.126KB) | Rcvd: 5 (188B)

IP Protocol Scan


This type of scan is useful in determining what protocols are supported on the target system. You can use this information to decide which types of scan to use (UDP scan, TCP SYN scan, etc).

nikhilh@ubuntu:~$ sudo nmap -sO -d scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 09:14 PDT
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
...
...
Initiating IPProto Scan at 09:14
Scanning scanme.nmap.org (45.33.32.156) [256 ports]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or (src host 45.33.32.156))
Discovered open port 6/ip on 45.33.32.156
Discovered open port 1/ip on 45.33.32.156
Completed IPProto Scan at 09:14, 1.21s elapsed (256 total ports)
Overall sending rates: 212.82 packets / s, 4325.74 bytes / s.
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up, received reset ttl 128 (0.010s latency).
Scanned at 2018-08-22 09:14:47 PDT for 1s
Not shown: 252 filtered protocols
Reason: 252 proto-unreaches
PROTOCOL STATE         SERVICE REASON
1        open          icmp    echo-reply ttl 128
6        open          tcp     proto-response ttl 128
17       open|filtered udp     no-response
47       open|filtered gre     no-response
Final times for host: srtt: 10311 rttvar: 20137  to: 100000

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-protocols.
Nmap done: 1 IP address (1 host up) scanned in 1.23 seconds
           Raw packets sent: 262 (5.396KB) | Rcvd: 256 (12.272KB)

That's it for part 4! This post, I feel had fairly straight forward content and probably wouldn't have caused a lot of stress while learning. If you have any questions, leave them in the comments below and I'll get back to you as soon as I can!

 In the next post, we'll look specifically at port scanning options. For example: which ports to scan, which protocols to use while scanning said ports and more.
By at No comments:
Labels: , , , , ,

Getting started with Nmap - Part 3

In part 2, we looked at the basic scanning workflow. We also understood that Nmap pings the host before scanning it. Choosing the correct ping type is important, because if Nmap doesn't receive a reply from the target, it will not scan it. In this post, we'll look at a variety of options that will help in discovering the state of the host.

Disclaimer: In this entire tutorial series, I have used scanme.nmap.org as the target host and sometimes my local machine itself. scanme.nmap.org is a machine set up by Nmap developers for educational purposes, so it is legal to scan it a FEW TIMES A DAY. Scanning networks, in general is a cyber crime and may even lead to jail. Please take permission before scanning random networks.

Traceroute


This option requires sudo access. Through this option, we can understand the route, i.e. the devices through which our packet is travelling on the Internet while trying to reach the target system.

nikhilh@ubuntu:~$ sudo nmap -d --traceroute scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-20 17:45 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Initiating Ping Scan at 17:46
Scanning scanme.nmap.org (45.33.32.156) [4 ports]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 45.33.32.156)))
We got a TCP ping packet back from 45.33.32.156 port 80 (trynum = 0)
Completed Ping Scan at 17:46, 0.00s elapsed (1 total hosts)
Overall sending rates: 1679.97 packets / s, 63838.72 bytes / s.
mass_rdns: Using DNS server 127.0.1.1
Initiating Parallel DNS resolution of 1 host. at 17:46
mass_rdns: 0.00s 0/1 [#: 1, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 17:46, 0.00s elapsed
..
...
Initiating SYN Stealth Scan at 17:46
Scanning scanme.nmap.org (45.33.32.156) [1000 ports]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 45.33.32.156)))
...
...
Initiating Traceroute at 17:46
Completed Traceroute at 17:46, 0.02s elapsed
...
...
Not shown: 996 filtered ports
Reason: 996 no-responses
...
...
TRACEROUTE (using port 80/tcp)
HOP RTT     ADDRESS
1   0.15 ms 192.168.182.2
2   0.21 ms scanme.nmap.org (45.33.32.156)
Final times for host: srtt: 12335 rttvar: 22769  to: 103411

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 30.15 seconds
           Raw packets sent: 2021 (88.816KB) | Rcvd: 658 (26.352KB)

From this output we understand that the target host is just 2 hops away. The first address is the private address of my access point (a router) and the second is the target system's public address.

Disable Reverse DNS


As you must have observed in the previous output(s), nmap always conducts a parallel DNS scan along with the initial ping. It is not always necessary for a user to know the DNS information. DNS resolution slows down nmap and it is sometimes necessary to disable it to avoid detection.

nikhilh@ubuntu:~$ sudo nmap -d -n scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-20 17:48 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Initiating Ping Scan at 17:48
Scanning scanme.nmap.org (45.33.32.156) [4 ports]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 45.33.32.156)))
We got a TCP ping packet back from 45.33.32.156 port 80 (trynum = 0)
Completed Ping Scan at 17:48, 0.00s elapsed (1 total hosts)
Overall sending rates: 1536.69 packets / s, 58394.16 bytes / s.
Initiating SYN Stealth Scan at 17:48
...
...
Scanned at 2018-08-20 17:48:49 PDT for 7s
Not shown: 996 filtered ports
...
...

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 7.04 seconds
           Raw packets sent: 2003 (88.096KB) | Rcvd: 9 (364B)

If you look closely at the log, you'll observe there is no DNS resolution in parallel with the initial ping.

Ping Only


This option allows only the host discovery part of the process to occur. Port scanning is skipped. By default, this uses an ICMP echo, TCP SYN to port 443, TCP ACK to port 80 and an ICMP Timestamp request.

nikhilh@ubuntu:~$ nmap -sn -d scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-22 05:37 PDT
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Initiating Ping Scan at 05:37
Scanning scanme.nmap.org (45.33.32.156) [2 ports]
Completed Ping Scan at 05:37, 0.08s elapsed (1 total hosts)
Overall sending rates: 24.31 packets / s.
mass_rdns: Using DNS server 127.0.1.1
Initiating Parallel DNS resolution of 1 host. at 05:37
mass_rdns: 0.12s 0/1 [#: 1, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 05:37, 0.12s elapsed
DNS resolution of 1 IPs took 0.12s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF: 0, TR: 1, CN: 0]
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up, received syn-ack (0.082s latency).
Final times for host: srtt: 81927 rttvar: 81927  to: 409635
Read from /usr/local/bin/../share/nmap: nmap-payloads.
Nmap done: 1 IP address (1 host up) scanned in 0.27 seconds

Don't Ping


In part 2, we saw that Nmap first pings the host to confirm it is alive before scanning it. When using the "Don't Ping" options, nmap skips this initial ping.

nikhilh@ubuntu:~$ sudo nmap -Pn -d scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-21 13:14 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
mass_rdns: Using DNS server 127.0.1.1
Initiating Parallel DNS resolution of 1 host. at 13:14
mass_rdns: 0.01s 0/1 [#: 1, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 13:14, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 13:14
Scanning scanme.nmap.org (45.33.32.156) [1000 ports]
...
...
22/tcp    open  ssh     syn-ack ttl 128
80/tcp    open  http    syn-ack ttl 128
31337/tcp open  Elite   syn-ack ttl 128
Final times for host: srtt: 81291 rttvar: 15399  to: 142887

 Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 30.89 seconds
           Raw packets sent: 2007 (88.308KB) | Rcvd: 866 (34.704KB)

TCP SYN or UDP Ping


By default, when Nmap is run with user privileges it uses ICMP echo when pinging hosts. In cases where ICMP ping does not help, you can use TCP SYN or UDP ping.

nikhilh@ubuntu:~$ nmap -PS -d scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-19 07:21 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Initiating Ping Scan at 07:21
Scanning scanme.nmap.org (45.33.32.156) [1 port]
Completed Ping Scan at 07:21, 0.08s elapsed (1 total hosts)
Overall sending rates: 11.88 packets / s.
mass_rdns: Using DNS server 127.0.1.1
Initiating Parallel DNS resolution of 1 host. at 07:21
mass_rdns: 0.01s 0/1 [#: 1, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 07:21, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating Connect Scan at 07:21
...
...
Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 21.38 seconds
  1. When using TCP SYN ping, nmap sends a SYN packet to the target system. If it replies with a SYN-ACK, nmap considers the host to be alive and proceeds to scan it.
  2. If there is no response, nmap will not scan the target system. 
  3. The default port used by TCP SYN ping is 80.
Let's try pinging using UDP now.

nikhilh@ubuntu:~$ sudo nmap -PU -d scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-19 07:28 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Initiating Ping Scan at 07:28
Scanning scanme.nmap.org (45.33.32.156) [1 port]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 45.33.32.156)))
Completed Ping Scan at 07:28, 2.01s elapsed (1 total hosts)
Overall sending rates: 1.00 packets / s, 27.87 bytes / s.
mass_rdns: Using DNS server 127.0.1.1
Nmap scan report for scanme.nmap.org (45.33.32.156) [host down, received no-response]
Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 2.09 seconds
           Raw packets sent: 2 (56B) | Rcvd: 0 (0B)
nikhilh@ubuntu:~$ 

By default, UDP ping uses port 40125. From the above output, we can see that
  1. UDP ping requires sudo privileges. This is because nmap accesses raw sockets when pinging using UDP.
  2. If the port were unallocated, it would have replied with a ICMP type 3 message - Port Unreachable which means that the target host is alive on the network.
  3. If the port were open and used, Nmap would receive no response.

TCP ACK Ping


nikhilh@ubuntu:~$ nmap -PA -d scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-19 07:41 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Initiating Ping Scan at 07:41
Scanning scanme.nmap.org (45.33.32.156) [1 port]
Completed Ping Scan at 07:41, 0.10s elapsed (1 total hosts)
Overall sending rates: 9.85 packets / s.
mass_rdns: Using DNS server 127.0.1.1
Initiating Parallel DNS resolution of 1 host. at 07:41
mass_rdns: 0.01s 0/1 [#: 1, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 07:41, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating Connect Scan at 07:41
...
...
Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 23.79 seconds

TCP ACK ping scans are useful when the target system is blocking TCP SYN and ICMP packets.
  1. If the port is alive, it'll reply with a RST packet since no TCP connection exists between your system and the target.
  2. If not, Nmap will receive no response.
TCP ACK uses port 80 by default.

ICMP Timestamp Ping


ICMP Timestamp (or ICMP Type 13 message) requests are usually used to synchronize system clocks on the network. These packets are rarely found on a network nowadays. A large number of these packets in the network is abnormal and is cause for suspicion.

nikhilh@ubuntu:~$ sudo nmap -PP -d scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-19 13:57 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Initiating Ping Scan at 13:57
Scanning scanme.nmap.org (45.33.32.156) [1 port]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 45.33.32.156)))
Completed Ping Scan at 13:57, 2.01s elapsed (1 total hosts)
Overall sending rates: 1.00 packets / s, 39.84 bytes / s.
mass_rdns: Using DNS server 127.0.1.1
Nmap scan report for scanme.nmap.org (45.33.32.156) [host down, received no-response]
Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 2.09 seconds
           Raw packets sent: 2 (80B) | Rcvd: 0 (0B)
  1. I expected the system to block ICMP Timestamp packets at the firewall and looks like they have. 
  2. If ICMP Timestamp were not blocked, we would have received an ICMP Timestamp reply.
  3. It is to be noted that sudo access is required for ICMP Timestamp pings.

ICMP Address Mask Ping


ICMP Address Mask (or ICMP type 17 messages) requests are used to determine the subnet mask used in a network. Again, these are uncommon nowadays.

nikhilh@ubuntu:~$ sudo nmap -PM -d scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-19 14:18 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Initiating Ping Scan at 14:18
Scanning scanme.nmap.org (45.33.32.156) [1 port]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 45.33.32.156)))
Completed Ping Scan at 14:18, 2.01s elapsed (1 total hosts)
Overall sending rates: 1.00 packets / s, 31.87 bytes / s.
mass_rdns: Using DNS server 127.0.1.1
Nmap scan report for scanme.nmap.org (45.33.32.156) [host down, received no-response]
Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 2.10 seconds
           Raw packets sent: 2 (64B) | Rcvd: 0 (0B)
  1. Again, ICMP Address Mask ping requires sudo access and is also blocked at the target system.
  2. If ICMP Address Mask were not blocked, we would have received an ICMP Address Mask reply.

IP Protocol Ping


In the IPv4 header, there is a field name called Protocol which highlights the protocol number used at the next level. An IP ping is used to communicate with the target system using a specific protocol. By default, protocol numbers 1 (ICMP), 2(IGMP) and 4 (IPv4 Encapsulation) are used.

nikhilh@ubuntu:~$ sudo nmap -d -PO1,17 scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-19 15:55 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Initiating Ping Scan at 15:55
Scanning scanme.nmap.org (45.33.32.156) [2 ports]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or (src host 45.33.32.156))
Completed Ping Scan at 15:55, 0.16s elapsed (1 total hosts)
Overall sending rates: 12.34 packets / s, 345.44 bytes / s.
mass_rdns: Using DNS server 127.0.1.1
Initiating Parallel DNS resolution of 1 host. at 15:55
mass_rdns: 0.01s 0/1 [#: 1, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 15:55, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF: 0, TR: 1, CN: 0]
...
...
Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 27.54 seconds
           Raw packets sent: 2007 (88.276KB) | Rcvd: 559 (22.400KB)
  1. In the above usage, I've used protocol numbers 1 (ICMP) and 17 (UDP) for communicating with the target host. 
  2. This again requires sudo privileges.
  3. Sometimes, if you use a protocol that is unsupported by the target system you can get a ICMP Port Unreachable (type 3 ICMP message - see below for example) which is a great hint that the target is alive. You can retry using a different protocol number.
  4. For a list of all protocol numbers, please refer to https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
nikhilh@ubuntu:~$ sudo nmap -d -PO88 scanme.nmap.org
[sudo] password for nikhilh: 
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-20 14:31 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Initiating Ping Scan at 14:31
Scanning scanme.nmap.org (45.33.32.156) [1 port]
Packet capture filter (device eth0): dst host 192.168.182.136 and (icmp or icmp6 or (src host 45.33.32.156))
Got destination unreachable for 45.33.32.156
Completed Ping Scan at 14:31, 0.00s elapsed (1 total hosts)
Overall sending rates: 296.30 packets / s, 5925.93 bytes / s.
mass_rdns: Using DNS server 127.0.1.1
Nmap scan report for scanme.nmap.org (45.33.32.156) [host down, received proto-unreach]
Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 0.23 seconds
           Raw packets sent: 1 (20B) | Rcvd: 1 (48B)

ARP ping


Address Resolution Protocol (ARP) is a protocol used to map IP address to MAC addresses.
  1. This ping is based on the assumption that if a host is alive, it must reply to an ARP request packet which makes sense. 
  2. ARP packets are not filtered/blocked because every network requires their usage to determine MAC addresses of systems on the network. 
  3. It is important to note the following:
    1. ARP ping requires sudo access to work properly
    2. when using ARP ping, the target system must be on your LAN because ARP is non-routable, which means it cannot get outside the LAN. It only exists inside the LAN.
    3. When scanning a target on the LAN, nmap automatically uses ARP ping as the default discovery method and overrides all other discovery options.
    4. To disable automatic ARP ping, use the --disable-arp-ping option
When not as the sudo user:

nikhilh@ubuntu:~$ nmap -d -PR 127.0.0.1
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-20 17:30 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Initiating Ping Scan at 17:30
Scanning 127.0.0.1 [0 ports]
Completed Ping Scan at 17:30, 0.00s elapsed (1 total hosts)
Overall sending rates: 0.00 packets / s.
mass_rdns: Using DNS server 127.0.1.1
Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 0.04 seconds

As a sudo user:

nikhilh@ubuntu:~$ sudo nmap -d -PR 127.0.0.1
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-20 17:30 PDT
PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
mass_rdns: Using DNS server 127.0.1.1
Initiating SYN Stealth Scan at 17:30
Scanning localhost (127.0.0.1) [1000 ports]
Packet capture filter (device lo): dst host 127.0.0.1 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 127.0.0.1)))
Discovered open port 631/tcp on 127.0.0.1
Completed SYN Stealth Scan at 17:30, 0.01s elapsed (1000 total ports)
Overall sending rates: 131908.72 packets / s, 5803983.64 bytes / s.
Nmap scan report for localhost (127.0.0.1)
Host is up, received localhost-response (0.0000020s latency).
Scanned at 2018-08-20 17:30:30 PDT for 0s
Not shown: 999 closed ports
Reason: 999 resets
PORT    STATE SERVICE REASON
631/tcp open  ipp     syn-ack ttl 64
Final times for host: srtt: 2 rttvar: 0  to: 100000

Read from /usr/local/bin/../share/nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds
           Raw packets sent: 1000 (44.000KB) | Rcvd: 2001 (84.044KB)

 This concludes part 3 of this tutorial series! If you have any questions, leave them in the comments below and I'll get back to you as soon as I can.

 In the next part, we'll look at various scanning options that Nmap provides. 
By at No comments:
Labels: , , , , , , ,
Subscribe to: Comments (Atom)

Popular posts