Namp
- 2. Outline What is IP network scanning? Concepts, motivation Example Tool nmap Scanning types Host discovery port scanning Version detection OS detection
- 3. What is Scanning? • Method to gather information regarding the devices running on the network – Typically to discover services or servers on a network • Which hosts are up? • Which services are offering? • Do not confuse with “host vulnerability scanner” which further explore a computer by testing for common vulnerabilities (nessus)
- 4. Why Scanning? Network Security assessment Evaluation and Auditing the security Firewall Penetration Test (Policy auditing) IDS proof/evaluation Identifying unexpected new servers Identifying open ports for proactively protect the network (Network and security admin) attacking it (Hackers)
- 5. Why nmap An excellent tool Long history of development and support Continuous development and improvements “Industry Standard” port scanner
- 6. nmap features • Host Discovery: Which host is alive? – Identifying computers on a network, for example listing the computers which respond to pings (Ping Sweeps) • Port Scanning : What services are available? – Enumerating the open ports on one or more target computers • Service and Version Detection : Which version is running? – Determine the application name and version number • OS Detection: What platforms are served? – Remotely determining the OS and some hardware characteristics of network devices
- 7. Host Discovery Querying multiple hosts using this method is referred to as ping sweeps The most basic step in mapping out a network. Several Sweeps technique ICMP Sweeps Broadcast ICMP NON Echo ICMP TCP sweep UDP sweep
- 8. Target Selection Scan a single IP: nmap 192.168.20.128
- 9. Target Selection Scan a host : nmap www.example.com
- 10. Target Selection Scan a range of IPs : nmap 192.168.20.120-128
- 11. Target Selection Scan a subnet : nmap 192.168.20.2/24
- 12. Target Selection Scan targets from Text file : nmap -iL ips.txt
- 13. Port Selection Scan a single port: nmap -p 22 192.168.20.128
- 14. Port Selection Scan a range of ports : nmap -p 1-100 192.168.20.128
- 15. Port Selection Scan 100 common ports : nmap -F 192.168.20.128
- 16. Port Selection Scan all ports : nmap -p- 192.168.20.128
- 17. Scan Types Scan using TCP connect : nmap -sT 192.168.20.128
- 18. Scan Types Scan using TCP SYN scan : nmap -sS 192.168.20.128
- 19. Scan Types Scan UDP ports : nmap -sU -p 123,161,162 192.168.20.128
- 20. Scan Types Scan Selected ports (Ignore Discovery) : nmap -Pn -F 192.168.20.128
- 21. Service and OS Detection Detect OS and Services : nmap -A 192.168.20.128
- 22. Service and OS Detection Standard service detection : nmap -sV 192.168.20.128
- 23. Output Formats Save default output to file : nmap -oN result.txt 192.168.20.128
- 24. Output Formats Save results as XML : nmap -oX resultxml.xml 192.168.20.128
- 25. Output Formats Save in all formats : nmap -oA allformats 192.168.20.128
- 26. Scripting Engine Scan using default safe scripts : nmap -sV -sC 192.168.20.128
- 27. Scripting Engine Get help for a script : nmap –script-help=ssl-heartbleed
- 28. Scripting Engine Scan using a specific script : nmap -sV -p 443 -script=ssl-heartbleed 192.168.20.133
- 29. Scripting Engine Update script database : nmap –script-updatedb
- 30. Some Useful NSE Scripts Scan for UDP DDOS reflectors : nmap -sU -A -PN -n -pU:19,53,123,161 -script=ntp- monlist,dns-recursion,snmp-sysdescr 192.168.20.2/24
- 31. Some Useful NSE Scripts Gather page titles from HTTP Servers : nmap –script=http-title 192.168.20.128
- 32. Some Useful NSE Scripts Get HTTP headers of web services : nmap –script= http-headers 192.168.20.128
- 33. Some Useful NSE Scripts Find web apps from known paths : nmap –script=http-enum 192.168.20.128