Nmap — A Guide To The Greatest Scanning Tool Of All Time

Network-Mapper (NMap), is the most famous scanning tool used by penetration testers.

What is Nmap?

Nmap is the short form for Network Mapper. It is an open-source Linux command-line tool that is used to scan IP addresses and ports in a network and to detect installed applications. Nmap allows network admins to find out the devices running on their network, discover open ports and services, and detect vulnerabilities.

Gordon Lyon (pseudonym Fyodor) wrote Nmap as a tool to help map an entire network easily and to find its open ports and services. Nmap is also hugely popular, being featured in movies like (The Matrix and the popular series Mr. Robot).

Nmap features include:

• Host discovery — Identifying hosts on a network. For example, listing the hosts that respond to TCP and/or ICMP requests or have a particular port open.
• Port scanning — Enumerating the open ports on target hosts.
• Version detection — Interrogating network services on remote devices to determine application name and version number.
• OS detection — Determining the operating system and hardware characteristics of network devices.
• Scriptable interaction with the target — using Nmap Scripting Engine(NSE) and Lua programming language.

Commands

Let’s look at some Nmap commands. If you don’t have Nmap installed, you can get it from here.

Basic scans

Scanning the list of active devices in a network is the first step in network mapping. There are two types of scans you can use for that:

• Ping scan — Scans the list of devices up and running on a given subnet.

> nmap -sp 192.168.1.1/24(your ip)

• Scan a single host — Scans a single host for 1000 well-known ports. These ports are the ones used by popular services like SQL, SNTP, apache, etc.

> nmap scanme.nmap.org

Nmap basic scan

Stealth scan

Stealth scanning is performed by sending an SYN packet and analyzing the response. If SYN/ACK is received, it means the port is open, and you can open a TCP connection. However, a stealth scan never completes the 3-way handshake, hence it’s hard for the target to determine the scanning system.

> nmap -sS scanme.nmap.org

you can use the “-sS” command to perform a stealth scan .

Version scanning

Finding application versions is a crucial part in penetration testing. It makes your life easier since you can find an existing vulnerability from the Common Vulnerabilities and Exploits (CVE) database for a particular version of the service. You can then use it to attack a machine using an exploitation tool like Metasploit.

> nmap -sV scanme.nmap.org

To do a version scan, use the ‘-sV’ command. Nmap will provide a list of services with its versions.

Nmap version scanning

OS Scanning

In addition to the services and their versions, Nmap can provide information about the underlying operating system using TCP/IP fingerprinting. Nmap will also try to find the system uptime during an OS scan.

> nmap -sV scanme.nmap.org

Scanning Multiple Hosts

Nmap has the capability of scanning multiple hosts simultaneously. This feature comes in real handy when you are managing vast network infrastructure.

You can scan multiple hosts through numerous approaches:

• Write all the IP addresses in a single row to scan all of the hosts at the same time.

> nmap 192.164.1.1 192.164.0.2 192.164.0.2

• Use the asterisk (*) to scan all of the subnets at once.

> nmap 192.164.1.*

• Add commas to separate the addresses endings instead of typing the entire domains

> nmap 192.164.0.1,2,3,4

• Use a hyphen to specify a range of IP addresses

> nmap 192.164.0.0–255

Port Scanning

Port scanning is one of the most fundamental features of Nmap. You can scan for ports in several ways.

• Using the -p param to scan for a single port

> nmap -p 973 192.164.0.1

• If you specify the type of port, you can scan for information about a particular type of connection. eg. for a TCP connection,

> nmap -p T:7777, 973 192.164.0.1

• A range of ports can be scanned by separating them with a hyphen.

> nmap -p 76–973 192.164.0.1

• You can also use the -top-ports flag to specify the top n ports to scan

> nmap --top-ports 10 scanme.nmap.org

Scanning from a File

If you want to scan a large list of IP addresses, you can do it by importing a file with the list of IP addresses.

> nmap -iL /input_ips.txt

The above command will produce the scan results of all the given domains in the “input_ips.txt” file. Other than simply scanning the IP addresses, you can use additional options and flags as well.

Verbosity and Exporting Scan Results

Penetration testing can last days or even weeks. Exporting Nmap results can be useful to avoid redundant work and to help with creating final reports. Let’s look at some ways to export Nmap scan results.

Verbose Output

> nmap -v scanme.nmap.org

The verbose output provides additional information about the scan being performed. It is useful to monitor step by step actions Nmap performs on a network, especially if you are an outsider scanning a client’s network.

Nmap Help

Nmap has a built-in help command that lists all the flags and options you can use. It is often handy given the number of command-line arguments Nmap comes with.

> nmap -h

NMap help

Conclusion:

If you are interested to learn Nmap in-depth, here is a great resource for you.