INTRODUCTION

TO NMAP
By
Gopalsamy Rajendran
$ uname -a

Security Analyst @ Securight Technologies Pvt Ltd

Owasp Cuddalore Chapter Leader
Volunteer @ Kerala Cyberdome
Youtuber | Blogger | Technical Speaker
Certified EC-Council Security Analyst
Proud Civil Engineer ( Since 2018 )
$ cat Context.txt

What is Nmap?
Target Specification
Host Discovery
Scanning Techniques
Version Detection
Timing and scan speed
Output
NSE ( Nmap Scripting Engine )
What is Nmap ?

Network mapper
Network Discovering Tool
Identify Live hosts in the network.
Open Ports, Service version Detection and OS Detection.
Vulnerabilities Discovery
Target Specification:
-iL Include List of IP
--exclude Port Range scan
--excludefile Exclude list of IP

Host Discovery:
-sL Include List of IP to scan
-sP Ping Scan

Other efficient way of host discovery is arp-scan

Port Specification:
-p Particular port scan
-p 22-200 Port Range scan
-p- Scan all ports
-F Scan 100 Ports
--top-ports Scan top ports
-p-65535 Scan from 1 and ends at 65535
Commands:
nmap -A -p 22 <target>
nmap -A -p 22-445 <target>
nmap -A -p- <target>
nmap -F <target> 
nmap --top-ports <target>
nmap -p-65535 <target>
Various Scanning Techniques:

TCP SYN Scan (-sS)

TCP Connect Scan (-sT)
UDP Scan (-sU)
Ping Scan (-sP)
Service Version Detection (-sV)
Idle Scan (-sI)
Xmas, Null, Fin ( -sX, -sN, -sF )
Flags explanation:

SYN  - Synchronize
ACK  - Acknowledge
RST - Reset
FIN  - Final 
NULL - Nothing
TCP Connect Scan (-sT)
Full Open scan
Establish connection to the target
Uses three way handshake ( syn,ack,rst )
High chance of getting logged
Find only TCP port not UDP
Command: nmap -sT <target>

Port open Port close

TCP SYN Scan (-sS)
Half-Open scanning
Sends SYN packets to the target
Won't create a session
Less possibility of getting logged
Fast and reliable
Command: nmap -sS <target>

Port open Port close

UDP Scan (-sU)
Slow scanning
Find only UDP Port
Don't forget to run UDP scan on the given target

Command: nmap -sU <target>

Port Reachable

Port open Port close

Xmas Scan (-sX)
Sends Fin/Urg/Push flag
No reply - open
Reply with RST - Closed

Command: nmap -sX <target>

Port open Port close

Null Scan (-sN)
No flags will be sent
No reply - open
Reply - Closed

Command: nmap -sN <target>

Port open Port close

Fin Scan (-sF)
Fin flags will be sent
No reply - open
Reply - Closed
Command: nmap -sF <target>

Port open Port close

Service Version Scan (-sV)
Used to find services version
Details about the services

Command: nmap -sV <target>

Idle Scan (-sI)

Use another System to scan the target

Command: nmap -sI <target>

Timing Scan (-T)
T0 - Paranoid 
T1 - Sneaky 
T2 - Polite
T3 - Normal
T4 - Aggressive
T5 - Insane
Command: nmap -sV -A -T3 <target>
Output (-O)
oN - Normal Output
oX - XML Output 
oA - All formats
--open - Shows only open ports
ndiff - Shows difference b/w two files

Commands:
nmap -A -oN <target>
nmap -A -oX <target>
nmap -A -oA <target>
nmap -A <target> --open
ndiff result.xml result2.xml
Doubts ??
 @hackison @hackison.official
@infosectamil info@hackison.com @infosectamil