Hack Like a Pro: Advanced Nmap for Reconnaissance « Null Byte :: WonderHowTo

Welcome back, my novice hackers!Reconnaissanceis one of the most important preparatory steps to hacking. As I have emphasized many times before here on Null Byte, you must know the operating system, the ports, the services, the applications, and sometimes even the language of the target to be effective. If you haven't taken the time to gather this info, then you are likely wasting your time.In anearlier post, I had shown you the most widely-used and valuable reconnaissance tool in the hacker's toolbox, nmap. There are a number ofother recon toolsthat are also helpful such ashpingandxprobe, but nmap is the standard by which all others are judged. I STRONGLY recommend that you master nmap if you are to truly call yourself a hacker.Don't Miss:Tactical Nmap for Beginner Network ReconnaissanceI've already shown you some ofthe basics of nmap, like performing port scans using the TCP (-sT) and SYN (-sS) scans, as well as performing OS (-O) detection. In addition, I showed you how to change the speed of the scans to evade intrusion detection systems.This post will take you through some more advanced features so that it can be an even more useful tool for you. To begin, let's fire upKali Linuxand open nmap.Step 1: Open Nmap in KaliOpen a terminal in Kali and type nmap.kali > nmapWhen you do so, nmap will display the help screen like that below.At the bottom of the first screen, you will see a section named SCAN TECHNIQUES. Inmy earlier post, we used the -sS and -sT scans.Using nmap's basic syntax:nmap <scantype> IP addressWe get results like that below showing all of the TCP ports that are open on our target machine and the default service for that port.Step 2: Scan for Specific Port or Port RangeSometimes we are looking for a specific port or a port range. Nmap uses the -p switch to designate a port or port range. So, if we were only looking for ports 25-150, we could use:kali > nmap 192.168.89.191 -p25-150As you can see, this command scans and reveals only the ports in that port range.Step 3: Scanning a SubnetOften, we want to scan more than a single IP address. Nmap allows us to use CIDR notation to designate an entire subnet. So, for instance, if we wanted to scan on entire Class C subnet (256 hosts) for port 80 open, we could type:kali > nmap 192.168.89.0/24 -p80As you can see in the last line of this output from nmap, it scanned all 256 addresses in the subnet and found "2 hosts up." One host had port 80 open and the other did not.Step 4: Spoofing & Decoy ScanWhen we are scanning machines that are not ours, we often want to hide our IP (our identity). Obviously, every packet must contain our source address or else the response from the target system will not know where to return to.The same applies to spoofing our IP when using nmap. We CAN spoof our IP address (-S) in nmap, but as a result, any response and any info we are trying to gather will return to the spoofed IP. Not very useful, if we are scanning for info gathering.A better solution is to obfuscate our IP address. In other words, bury our IP address among many IP addresses so that the network/security admin can't pinpoint the source of the scan. Nmap allows us to use decoy IP addresses so that it looks like many IP addresses are scanning the target.We can do this by using the -D switch, such as:nmap -sS 192.168.89.191 -D 10.0.0.1,10.0.0.2,10.0.0.4This scan will use three decoy IP addresses, but also use our own address as well. In this way, we get responses and the info on the target AND the admin of the system sees scans coming from four systems simultaneously. In this way, he can't pinpoint the true source of the scan easily.Step 5: Evading FirewallsMany firewalls and routers block or drop the ICMP (echo request, echo reply) ping. This is meant to obscure the presence of the hosts behind the firewall and protect against a possible DoS using the ping packet.When you use nmap to scan a system or network, by default, it send out a ping to see if the host is up and if it gets a response, it then sends the specified packets to scan the system. If the ping is blocked or dropped, nmap gives up and says, "host is down."To get around firewalls and routers that block or drop the ping, we need to suppress nmap's default behavior of sending out that initial ping and get past the firewall that is blocking us. We can do this by using the -P0 switch:kali > nmap -sS -P0 192.168.89.191Step 6: Gathering Version InfoWhen nmap runs a port scan, it retrieves the port info (open/closed/filtered) and then gives us thedefaultservice that is running on that port. As one can run ANY service on any port, that may not be adequate information. If our attack requires a particular service on a particular port, gathering the default information may not be enough.We need to know what service is actually running on that port, not the default service. For instance, knowing that port 80 is open and running http is good to know, but if our attack is specific to Apache, then if the target has Microsoft's IIS running on that port, it won't work. We often need the service on the port.Nmap has a feature that interrogates the service running on each port scanned. It can be used with the -V switch, such as:kali > nmap -V 192.168.89.191Notice in the output above that the server is running an older version of IIS on port 80. That makes a tempting target!Step 7: UDP ScanUp until this point, all of our scans have been for TCP ports. Some services and ports use UDP to communicate to the outside world. Our previous scan types (-sS and -sT) will not find UDP ports as they are only looking for TCP ports. Some services only run on UDP, such NTP (port 123) and SNMP (port 161). To find these ports and services, we need to do a UDP scan. We can do this with the -sU switch:kali > nmap -sU 192.168.89.191As you can see, the UDP scan reveals ports and services not found with our TCP scans.Step 8: ReasonNote in the output from the UDP scan above that some ports are reported as open/filtered. This indicates that nmap cannot determine whether the port is open or it is filtered by a device such as a firewall.Unlike TCP ports that respond with a RST packet when they are closed, UDP ports respond with an ICMP packet when they are closed. This can make scans far less reliable, as often the ICMP response is blocked or dropped by intermediate devices (firewalls or routers).Nmap has a switch that will return the reason why it has placed a particular port in a particular state. For instance, we can run the same UDP scan as above with the--reasonswitch and nmap will return the same results, but this time will give us the reason it has determined the particular state of the port.kali > nmap -sU --reason 192.168.89.191Notice in the screenshot above that I have highlighted the "reason" that nmap has found that port 123 is either open or filtered. Nmap tells us that it received "no response," so it doesn't know if that port is open or filtered.Step 9: Using a ListMany times we want to scan a list of IP addresses and not an entire subnet. We can use any text editor and create a list of IP addresses and "feed" it to nmap. Here, I am using Leafpad, which is built into Kali (any text editor will work), to put together a list of IP addresses I want to scan.Then I can use this list of IP address in nmap rather than having to retype these IP addresses each time I scan.kali > nmap -iL scanlist.txtAs you can see, nmap scanned all five IP addresses I listed in my text document, but only found two were up.Step 10: Ouput to a FileIf we are scanning multiple IP addresses, we probably want to save the output to a file for later reference. Although nmap has many ways and formats to save the output, I prefer the -oN (output normal) switch.Simply add the -oN switch at the end of the command with the name of the file you want to save the output to. Here, I have used a file named "portscan.txt":kali > nmap -sS 192.168.89.191 -oN portscanWhen I run the command, I get my same output to the screen, but I also get that output saved to a file. I can view the contents of that file by using thecat, more, less commands. Here I have used the cat command.kali > cat portscan.txtAs you can see, the output that always appears on the screen with a nmap scan is now saved to a file for later reference and some permanence.Nmap is one of those tools that EVERY hacker must master to be proficient at this trade. With this post, we have advanced your nmap skills another step, but we still have much to learn, so keep coming back, my novice hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image vianmapRelatedHack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapAdvanced Nmap:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowHow To:Advanced Penetration Testing - Part 1 (Introduction)How to Hack Databases:Hunting for Microsoft's SQL ServerHack Like a Pro:How to Conduct OS Fingerprinting with Xprobe2Hack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)How To:Easily Detect CVEs with Nmap ScriptsHow To:Tactical Nmap for Beginner Network ReconnaissanceDissecting Nmap:Part 1How To:Do a Simple NMAP Scan on ArmatigeHack Like a Pro:How to Use Maltego to Do Network ReconnaissanceZanti:NmapHack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHack Like a Pro:Reconnaissance with Recon-Ng, Part 1 (Getting Started)How To:Do an Idle Scan with NmapHack Like a Pro:The Hacker MethodologyHack Like a Pro:Scripting for the Aspiring Hacker, Part 2 (Conditional Statements)Hack Like a Pro:Getting Started with BackTrack, Your New Hacking SystemHow To:The Five Phases of HackingHow To:Get Started Writing Your Own NSE Scripts for NmapHow To:Use NMAP 7 to Discover Vulnerabilities, Launch DoS Attacks and More!Hack Like a Pro:How to Conduct Passive Reconnaissance of a Potential TargetHacking Reconnaissance:Finding Vulnerabilities in Your Target Using NmapHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesNews:Rock Band 3 unveiled! (Keyboard!)Null Byte:Never Let Us DieCamera Plus Pro:The iPhone Camera App That Does it All