How to Use NMAP 7 to Discover Vulnerabilities, Launch DoS Attacks and More! « Null Byte :: WonderHowTo

NMAP is an essential tool in any hacker's arsenal. Originally written by Gordon Lyon aka Fydor, it's used to locate hosts and services and create a map of the network. NMAP has always been an incredibly powerful tool, but with it's newest release, which dropped mid-November of last year, they've really out done themselves.NMAP version 7 comes equipped with a ton of new scripts you can use to do everything from DoSing targets to exploiting them (with written permission, of course). The scripts cover the following categoriesAuth:Use to test whether you can bypass authentication mechanismBroadcast:Use to find other hosts on the network and automatically add them to scanning que.Brute:Use for brute password guessing.Discovery:Use to discover more about the network.Dos:Use to test whether a target is vulnerable to DoSExploit:Use to actively exploit a vulnerabilityFuzzer:Use to test how server responds to unexpected or randomized fields in packets and determine other potential vulnerabilitiesIntrusive:Use to perform more intense scans that pose a much higher risk of being detected by admins.Malware:Use to test target for presence of malwareSafe:Use to perform general network security scan that's less likely to alarm remote administratorsVuln:Use to find vulnerabilities on the targetFor this tutorial, I will show you how to scan a target for vulnerabilities, actively try and exploit any vulnerabilities, test whether the target is vulnerable to DoS, and then finally launch a DoS attack.Step 1: Download NMAPDownload nmap fromhttps://nmap.org/download.htmland follow the installation instructions for your particular Operating System. NMAP works easily on both Windows and Linux. After installing you will have NMAP and ZENMAP on your computer.ZENMAP and NMAP are the same thing except ZENMAP provides you with a graphical user interface. For the rest of this tutorial you can chose to either run NMAP from your command line, or launch ZENMAP and enter the commands in the GUI.Step 2: Run NMAPNow that we've got NMAP installed, it's time to scan our target for vulnerabilities. As mentioned there is an entire category of scripts dedicated to finding vulnerabilities on a target. Invoking the following command will run all of the scripts against your target.nmap -Pn --script vuln <target.com or ip> <enter>*I always throw a -Pn in there just in case the target blocks ping probes, although it's optional.Step 3: Review ResultsAfter your scan completes, review NMAPs output to determine what vulnerabilities were found. It will list it's findings along with applicable CVEs and links to any exploits that exist in Offensive Security's Exploit Database.Use NMAP to Actively Exploit Detected VulnerabilitiesAs mentioned, you can also use NMAP's exploit script category to have NMAP actively exploit detected vulnerabilities by issuing the following command:nmap --script exploit -Pn <target.com or ip> <enter>Use NMAP to Brute Force PasswordsNmap contains scripts for brute forcing dozens of protocols, including http-brute, oracle-brute, snmp-brute, etc. Use the following command to perform brute force attacks to guess authentication credentials of a remote server.nmap --script brute -Pn <target.com or ip> <enter>Use NMAP to Test if Target Is Vulnerable to DosUse the following command to check whether the target is vulnerable to DoS:nmap --script dos -Pn <target.com or ip> <enter>This will tell you whether the target is vulnerable without actually launching a dos attack.Use NMAP to Perform DOS AttackUse the following command to perform an active DoS attack against a target for an indefinite period of time:nmap --max-parallelism 750 -Pn --script http-slowloris --script-args http-slowloris.runforever=trueThese are just a few very cool features NMAP has to offer. NMAP is very noob friendly so get yourself a copy.On a side note, this week I was tasked with identifying vulnerabilities in a company's server as apart of the interview process Thanks to NMAP, I was able to identify, and then successfully verify, their server had the POODLE issue. This was something (shockingly) the company was not aware of. Nessus, Openvas, Acunetix, and BurpSuite did not identify the vulnerability and it did prove legit.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHow To:Automate Brute-Force Attacks for Nmap ScansHow To:Tactical Nmap for Beginner Network ReconnaissanceHack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHow To:Attack a Vulnerable Practice Computer: A Guide from Scan to ShellHow To:Brute-Force SSH, FTP, VNC & More with BruteDumHow To:Easily Detect CVEs with Nmap ScriptsHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPAdvanced Nmap:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowHow To:The Five Phases of HackingNews:Banks Around the World Hit with Repeated DDoS Attacks!How To:Perform Network-Based Attacks with an SBC ImplantHow To:Locate & Exploit Devices Vulnerable to the Libssh Security FlawHow To:Conduct OSINT Recon on a Target Domain with Raccoon ScannerHow To:Discover Computers Vulnerable to EternalBlue & EternalRomance Zero-DaysHow to Hack Databases:Hunting for Microsoft's SQL ServerHow To:Discover & Attack Services on Web Apps or Networks with SpartaAndroid for Hackers:How to Scan Websites for Vulnerabilities Using an Android Phone Without RootHow To:Hack Apache Tomcat via Malicious WAR File UploadHow To:Use Metasploit's Database to Stay Organized & Store Information While HackingHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)How To:Identify Web Application Firewalls with Wafw00f & NmapNews:Life Becomes More Difficult for Driverless HackersHack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapHacking Reconnaissance:Finding Vulnerabilities in Your Target Using NmapHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesWeekend Homework:How to Become a Null Byte ContributorForbes Exploited:XSS Vulnerabilities Allow Phishers to Hijack Sessions & Steal LoginsHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItNews:Bugzilla Cross Site Request ForgeryHow To:How Cross-Site Scripting (XSS) Attacks Sneak into Unprotected Websites (Plus: How to Block Them)How To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsNews:The Myths of Limited War