Friday, April 19, 2019

NMAP Host Discovery Scanning with Examples

Host Discovery

Host discovery is an important part of security testing a network. Luckily, nmap provides us with a wealth of option we can use against hosts to check their ‘up’ status. All of the commands that follow in the ‘discovery’ section will use the ‘-sn’ option. The ‘-sn’ option tells nmap not to run a port scan against the host or do DNS resolution and just to check to see if the host is alive. This will speed up the scan.

Ping sweep

nmap -sn target 

root@asus:~/unix% nmap -sn 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 21:16 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.02 seconds
root@asus:~/unix%

SYN ping scan

Send a TCP SYN Packet to port 80 and 443 to see if the host is up

nmap -sn -PS80,443 target 

root@asus:~/unix% nmap -sn -PS80,443 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:14 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds
root@asus:~/unix%

ACK ping scan

Send a TCP ACK Packet to port 80 and 443 to see if the host is up

nmap -sn -PA80,443 target 

root@asus:~/unix% nmap -sn -PA80,443 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:14 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~/unix%

UDP ping scan

Send a UDP Ping to ports 53 and 137 to see if the host is up

nmap -sn -PU53,137 target 

root@asus:~/unix% nmap -sn -PU53,137 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:15 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~/unix%

ICMP ping scan

Send an ICMP Echo Request to see if the host is up

nmap -sn -PE target 

root@asus:~/unix% nmap -sn -PE 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:16 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds
root@asus:~/unix%

ICMP timestamp reply

Send an ICMP TIMESTAMP reply to see if the host is up

nmap -sn -PP target 

root@asus:~/unix% nmap -sn -PP 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:17 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~/unix%

ICMP address mask reply

Send and ICMP address mask reply to see if the host is up

nmap -sn -PM target 

root@asus:~/unix% nmap -sn -PM 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:19 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.02 seconds
root@asus:~/unix%

IP Protocol ping scan using ICMP, IGMP, TCP using 255 byte random payload

nmap -sn -PO1,2,6 --data-len 100 target 

root@asus:~/unix% nmap -sn -PO1,2,6 --data-len 255 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:20 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~/unix%

Arp Ping Scan

nmap -sn -PR target 
root@asus:~/unix% nmap -sn -PR 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:20 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~/unix%

NO Ping

Do not ping the target just check to see if it is up

nmap -sn -Pn target 
root@asus:~/unix% nmap -sn -Pn 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:21 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.02 seconds
root@asus:~/unix%
at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Exploiting Weak WEBDAV Configurations

The server we are going to audit has the following fingerprint. 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) Next we need t...

  • Exploring POP3 Servers
    Scanning the remote host We can use NMAP to scan the remote host and run enumeration scripts against the POP3 server. root@asus:~/unix% ...
  • Enumerating SMTP Servers with NMAP
    NMAP gives you the ability to enumerate SMTP service with some scripts from the NMAP Scripting Enigne. These scripts will produce some gene...
  • Enumerating SNMP Servers with NMAP
    NMAP gives you the ability to use scripts to enumerate and exploit remote host with the use of the NMAP Scripting Engine. Today we will be ...
  • Enumerating UNIX usernames
    Sometimes you may come across a situation where all you have from your OSINT phase is a list of first and last names. you can use pre-built...
  • Testing LDAP servers with examples
    Today we are going to be attacking the remote service LDAP. The only thing we need is an IP Address so lets ping our host to verify its up ...
  • Reading local files with XXE attacks
    Today we will be exploring XXE XML External Entity Attacks. A XXE attack is a attack that is brought against an application that deals with...
  • Attacking SMTP on Debian Linux
    First lets do a quick service scan against the remote host. root@asus:/mnt% nmap -sV -T4 -p22,25 mail.acme.com Starting Nmap 7.01 ( https:...
  • Attacking NFS
    This is our data set we will work from which was gathered during the OSINT phase from the company website: http://www.acme.com k.madden@m...
  • VulnHub: RickdiculouslyEasy Walkthrough
    Lets first start off with a nmap scan of the remote host. root@ubuntu:~# nmap -p0-65355 -sV -O -sC -T5 192.168.0.48 Starting Nmap 7.60 (...
  • Exploring IMAP Servers
    Scanning the Remote Host We can use NMAP to scan the remote IMAP server and run enumeration scripts agaisnt it to see what all the server i...