Thursday, October 3, 2019

Host Discovery with NMAP

Ping Sweep

To perform a scan of hosts on a network and do not port scan after host discovery you would do: 

sam@asus:~% nmap -sn 192.168.0.1/24

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 10:06 MDT
Nmap scan report for acme.com (192.168.0.1)
Host is up (0.013s latency).
Nmap scan report for 192.168.0.38
Host is up (0.0022s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.66 seconds
sam@asus:~%

nmap only reports host that are alive.

No Ping Scan

To skip host discovery and not issue a ping scan you would issue the nmap command: 

sam@asus:~% nmap -Pn 192.168.0.1/24

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 10:07 MDT
Nmap scan report for 192.168.0.0
Host is up (0.000015s latency).
All 1000 scanned ports on 192.168.0.0 are filtered

Nmap scan report for acme.com (192.168.0.1)
Host is up (0.0083s latency).
Not shown: 995 closed ports
PORT      STATE    SERVICE
53/tcp    open     domain
80/tcp    open     http
8080/tcp  filtered http-proxy
49152/tcp open     unknown
49153/tcp open     unknown

Nmap scan report for 192.168.0.2
Host is up (2.8s latency).
All 1000 scanned ports on 192.168.0.2 are filtered
sam@asus:~%

As you can see nmap reported back with hosts up and ports open on the remote hosts. This is good is you have a list of targets that you already know is up and want to skip the host discovery phase of the nmap scan.

TCP SYN Packet

Nmap give you the ability to send an empty tcp SYN packet to the host to try an estbalish a connection on the specified port. Nmap will send the tcp syn packet to port 80 by default. The '-sn' is used to do a ping sweep on the remote host. 

sam@asus:~% nmap -sn -PS 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 10:34 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up (0.00016s latency).
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
sam@asus:~%

NMAP reported back that the host is indeed up.

TCP ACK Packet

The TCP ACK packet is just like the SYN except it sends an ACK packet. Nmap will send the tcp ACK packet to port 80 by default. 
sam@asus:~% nmap -sn -PA 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 10:38 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up (0.00016s latency).
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds
sam@asus:~%

Here nmap sends an empty ACK packet to the host trying to recive a RST packet acknowledging that the service is existent on the remote host.

UDP Packets

This will send a UDP packet to a given port. By default nmap uses udp port 40 and 125. 

root@asus:~% nmap -sn -PU 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 13:52 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~%

Here we specify the '-sn' option telling nmap we do not want to do a port scan and just query the ports specified.

ICMP Pings

Nmap can send ping probes just like the ping command line utility. The types of ICMP pings nmap can send are: Echo (type 8),Timestamp (13) and address mask (17).

ICMP Echo

root@asus:~% nmap -sn -PE 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 14:51 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~%

ICMP Timestamp

root@asus:~% nmap -sn -PP 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 14:52 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~%

ICMP Address Mask

root@asus:~% nmap -sn -PM 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 14:52 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds
root@asus:~%

IP Protocol Ping

The IP Protocol Ping sends IP packets with the specified protocol number set in their IP header.

root@asus:~% nmap -sn -PO 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 15:03 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds
root@asus:~%
at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Exploiting Weak WEBDAV Configurations

The server we are going to audit has the following fingerprint. 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) Next we need t...

  • Exploring POP3 Servers
    Scanning the remote host We can use NMAP to scan the remote host and run enumeration scripts against the POP3 server. root@asus:~/unix% ...
  • Enumerating SMTP Servers with NMAP
    NMAP gives you the ability to enumerate SMTP service with some scripts from the NMAP Scripting Enigne. These scripts will produce some gene...
  • Enumerating SNMP Servers with NMAP
    NMAP gives you the ability to use scripts to enumerate and exploit remote host with the use of the NMAP Scripting Engine. Today we will be ...
  • Testing LDAP servers with examples
    Today we are going to be attacking the remote service LDAP. The only thing we need is an IP Address so lets ping our host to verify its up ...
  • Enumerating UNIX usernames
    Sometimes you may come across a situation where all you have from your OSINT phase is a list of first and last names. you can use pre-built...
  • Reading local files with XXE attacks
    Today we will be exploring XXE XML External Entity Attacks. A XXE attack is a attack that is brought against an application that deals with...
  • Attacking SMTP on Debian Linux
    First lets do a quick service scan against the remote host. root@asus:/mnt% nmap -sV -T4 -p22,25 mail.acme.com Starting Nmap 7.01 ( https:...
  • Attacking NFS
    This is our data set we will work from which was gathered during the OSINT phase from the company website: http://www.acme.com k.madden@m...
  • VulnHub: RickdiculouslyEasy Walkthrough
    Lets first start off with a nmap scan of the remote host. root@ubuntu:~# nmap -p0-65355 -sV -O -sC -T5 192.168.0.48 Starting Nmap 7.60 (...
  • Exploring IMAP Servers
    Scanning the Remote Host We can use NMAP to scan the remote IMAP server and run enumeration scripts agaisnt it to see what all the server i...