Thursday, October 3, 2019

Host Discovery with NMAP

Ping Sweep

To perform a scan of hosts on a network and do not port scan after host discovery you would do: 

sam@asus:~% nmap -sn 192.168.0.1/24

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 10:06 MDT
Nmap scan report for acme.com (192.168.0.1)
Host is up (0.013s latency).
Nmap scan report for 192.168.0.38
Host is up (0.0022s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.66 seconds
sam@asus:~%

nmap only reports host that are alive.

No Ping Scan

To skip host discovery and not issue a ping scan you would issue the nmap command: 

sam@asus:~% nmap -Pn 192.168.0.1/24

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 10:07 MDT
Nmap scan report for 192.168.0.0
Host is up (0.000015s latency).
All 1000 scanned ports on 192.168.0.0 are filtered

Nmap scan report for acme.com (192.168.0.1)
Host is up (0.0083s latency).
Not shown: 995 closed ports
PORT      STATE    SERVICE
53/tcp    open     domain
80/tcp    open     http
8080/tcp  filtered http-proxy
49152/tcp open     unknown
49153/tcp open     unknown

Nmap scan report for 192.168.0.2
Host is up (2.8s latency).
All 1000 scanned ports on 192.168.0.2 are filtered
sam@asus:~%

As you can see nmap reported back with hosts up and ports open on the remote hosts. This is good is you have a list of targets that you already know is up and want to skip the host discovery phase of the nmap scan.

TCP SYN Packet

Nmap give you the ability to send an empty tcp SYN packet to the host to try an estbalish a connection on the specified port. Nmap will send the tcp syn packet to port 80 by default. The '-sn' is used to do a ping sweep on the remote host. 

sam@asus:~% nmap -sn -PS 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 10:34 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up (0.00016s latency).
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
sam@asus:~%

NMAP reported back that the host is indeed up.

TCP ACK Packet

The TCP ACK packet is just like the SYN except it sends an ACK packet. Nmap will send the tcp ACK packet to port 80 by default. 
sam@asus:~% nmap -sn -PA 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 10:38 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up (0.00016s latency).
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds
sam@asus:~%

Here nmap sends an empty ACK packet to the host trying to recive a RST packet acknowledging that the service is existent on the remote host.

UDP Packets

This will send a UDP packet to a given port. By default nmap uses udp port 40 and 125. 

root@asus:~% nmap -sn -PU 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 13:52 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~%

Here we specify the '-sn' option telling nmap we do not want to do a port scan and just query the ports specified.

ICMP Pings

Nmap can send ping probes just like the ping command line utility. The types of ICMP pings nmap can send are: Echo (type 8),Timestamp (13) and address mask (17).

ICMP Echo

root@asus:~% nmap -sn -PE 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 14:51 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~%

ICMP Timestamp

root@asus:~% nmap -sn -PP 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 14:52 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~%

ICMP Address Mask

root@asus:~% nmap -sn -PM 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 14:52 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds
root@asus:~%

IP Protocol Ping

The IP Protocol Ping sends IP packets with the specified protocol number set in their IP header.

root@asus:~% nmap -sn -PO 48.21.33.124

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-03 15:03 MDT
Nmap scan report for srv01.acme.com (48.21.33.124)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds
root@asus:~%
at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Exploiting Weak WEBDAV Configurations

The server we are going to audit has the following fingerprint. 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) Next we need t...

  • Enumerating SNMP Servers with NMAP
    NMAP gives you the ability to use scripts to enumerate and exploit remote host with the use of the NMAP Scripting Engine. Today we will be ...
  • Enumerating SMTP Servers with NMAP
    NMAP gives you the ability to enumerate SMTP service with some scripts from the NMAP Scripting Enigne. These scripts will produce some gene...
  • Testing LDAP servers with examples
    Today we are going to be attacking the remote service LDAP. The only thing we need is an IP Address so lets ping our host to verify its up ...
  • Exploring POP3 Servers
    Scanning the remote host We can use NMAP to scan the remote host and run enumeration scripts against the POP3 server. root@asus:~/unix% ...
  • Reading local files with XXE attacks
    Today we will be exploring XXE XML External Entity Attacks. A XXE attack is a attack that is brought against an application that deals with...
  • bWAPP Remote & Local File Inclusion (RFI/LFI)
    In bWAPP There is a module for RFI and LFI injections. Our goal is to exploit these vulnerabilities and get local access to the remote mac...
  • Socat Encrypted Bind and Reverse shells
    Encrypted Bind Shell First we need to generate a new openssl key to use with our bind shell. Victim Box: user@debian:~$ openssl req -ne...
  • DVWA: SQL Injection (Blind) with sqlmap
    We start off by getting the database names hosted on the remote server. sam@ubuntu:~/pentest/sqlmap$ python sqlmap.py -u "http://192...
  • Exploring NTP servers
    The ntpupdate command is used for updating your system time from a remote NTP server root@asus:~/unix% ntpdate -d 48.21.33.124 24 Sep 11:...
  • Metasploitable II: Samba Shares
    Lets first start off with an nmap scan of the remote host. root@ubuntu:~# nmap -p 139,445 -sV -sC 192.168.56.101 Starting Nmap 7.60 ( ht...