Advanced Nmap: Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should Know « Null Byte :: WonderHowTo

Nmap is more powerful than you know. With a few scripts, we can extend its functionality beyond a simple port scanner and start to identify details about target servers sysadmins don't want us to know.Possibly the most popular and well-known reconnaissance tool currently available in the hacking world, Nmap has beencovered several timeson Null Byte before. For example, we've shown how todetect CVEs,automate brute-force attacks, andperform advanced reconnaissance, to name just a few Nmap tutorials.This article assumes readers have some experience withthe Nmap basics. I'll be targetting ports 80 and 443 (-p80,443) with most of the commands, as these are common web server ports. I'll also be engagingNmap's NSE functionswith the--scriptargument.Don't Miss:Using the Nmap Scripting Engine (NSE) for ReconnaissanceMost-known for its ability to accurately fingerprint ports on web servers, Nmap's NSE functionalities make it an extremely powerful, multipurpose tool, scaling it far beyond an ordinary port scanner. In this multi-part Nmap series, I'll be showing off some of its more advanced capabilities for aggressively discovering web server error pages, web application firewall fingerprints, subdomains, and extracting metadata from photos.Disclaimer: Theintrusive Nmap scriptsexhaust significate resources (CPU and bandwidth) on the target web server and may cause it to crash, break, or unintentionally inflict denial of service attacks. Based on the scope of your penetration testing engagement, this may not be allowed by a given employer. Pentester's should use the below scripts with caution.Update Nmap on Your Kali SystemBefore we dive into Nmap scripts, let's first make sure we have the latest available version of Nmap installed on our Kali Linux system. At the time of this writing, Kali is offering v7.70.Nmap can be installed using the belowapt-getcommands.apt-get update && apt-get install nmapWhen that's done, we can verify it was installed with the--versionargument.nmap --version

Nmap version 7.70 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu
Compiled with: liblua-5.3.3 openssl-1.1.0h libssh2-1.8.0 libz-1.2.11 libpcre-8.39 nmap-libpcap-1.7.3 nmap-libdnet-1.12 ipv6And as always, we can use the--helpargument to view its available options. These options can be coupled with Nmap scripts to further enhance the commands featured in this article.nmap --help

Nmap 7.70 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
  --traceroute: Trace hop path to each host
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sU: UDP Scan
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idle scan
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b <FTP relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
  --exclude-ports <port ranges>: Exclude the specified ports from scanning
  -F: Fast mode - Scan fewer ports than the default scan
  -r: Scan ports consecutively - don't randomize
  --top-ports <number>: Scan <number> most common ports
  --port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity <level>: Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
  -sC: equivalent to --script=default
  --script=<Lua scripts>: <Lua scripts> is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=<Lua scripts>: Show help about scripts.
           <Lua scripts> is a comma-separated list of script-files or
           script-categories.
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take <time> are in seconds, or append 'ms' (milliseconds),
  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T<0-5>: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <numprobes>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second
FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
  --data <hex string>: Append a custom payload to sent packets
  --data-string <string>: Append a custom ASCII string to sent packets
  --data-length <num>: Append random data to sent packets
  --ip-options <options>: Send packets with specified ip options
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP/SCTP checksum
OUTPUT:
  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --reason: Display the reason a port is in a particular state
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Nmap.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  -6: Enable IPv6 scanning
  -A: Enable OS detection, version detection, script scanning, and traceroute
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  --unprivileged: Assume the user lacks raw socket privileges
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  nmap -v -A scanme.nmap.org
  nmap -v -sn 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -Pn -p 80
SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLESRelated Book: "Network Scanning Cookbook: Practical Network Security using Nmap and Nessus 7" by Sairam Jetty1. Web Application Firewall DetectionAweb application firewall, shortened to WAF, detects and blocks malicious traffic transmitting to and from the web server its protecting. WAFs are most commonly used to help protect websites against SQL injection, file inclusion, and cross-site scripting (XSS) attacks.A server well-protected by a WAF could mean all potential web-based vulnerabilities are thwarted. Adversely, a server unprotected by any kind of WAF could be disastrous for system's administrators trying to defend against hackers. Our ability to detect web application firewalls on target web servers is crucial as pentesters.Thehttp-waf-detectscript is designed to help us learn the presence of a web application firewall. It will probe the target web server with several requests. First, it'll send a normal web request and record the response from the server. Then, it'll send another request with a payload (malformed URL) and compare the responses. This method of detecting WAFs is far from perfect and may vary based on the type of web server and WAF product.To enable thehttp-waf-detectscript, use the belownmapcommand.nmap -p80,443 --script http-waf-detect --script-args="http-waf-detect.aggro,http-waf-detect.detectBodyChanges" targetWebsite.comHere, I'm using thehttp-waf-detect.aggroargument, which instructs Nmap to try all of its built-in attack vectors to trigger the servers WAF. Also enabled is thehttp-waf-detect.detectBodyChangesargument, which looks for changes in the body of the HTTP requests and further increases the likeliness of detection.Starting Nmap 7.70 ( https://nmap.org )
Nmap scan report for targetWebsite.com
Host is up (0.65s latency).

PORT    STATE SERVICE
80/tcp  open  http
| http-waf-detect: IDS/IPS/WAF detected:
|_targetWebsite.com:80/?p4yl04d=hostname%00
443/tcp open  https
| http-waf-detect: IDS/IPS/WAF detected:
|_targetWebsite.com:443/?p4yl04d=hostname%00As we can see in the above output, Nmap has detected some kind of web application firewall present on the target web server. There are many commercial WAF products available to administrators. To learn which WAF is in production, we'll need to employ a different Nmap script.2. Web Application Firewall Fingerprint DetectionLearning which WAF is in use can be important as every WAF has its own predefined rate-limiting and detection methods. Identifying the type of WAF can aid pentester's in evading detection (or stayingunder the radar) if we can preemptively learn the WAFs limitations and detection triggers.Thehttp-waf-fingerprintNmap script is designed to help us learn the exact web application firewall in use on a target web server. It will also attempt to identify its type and exact version number.In its simplest form, we don't need to include any--script-argsto get this Nmap script working.nmap -p80,443 --script http-waf-fingerprint targetWebsite.com

Starting Nmap 7.70 ( https://nmap.org )
Nmap scan report for targetWebsite.com
Host is up (0.71s latency).

PORT    STATE SERVICE
80/tcp  open  http
| http-waf-fingerprint:
|   Detected WAF
|_    Cloudflare
443/tcp open  httpsAs you can see above, this particular website is using the popular Cloudflare service as a front-end to protect their website from attackers.We can further improve Nmap's ability to detect WAF types and versions using thehttp-waf-fingerprint.intensiveargument. This will prolong the scan time and also increase the amount ofnoise(web traffic) generated by the script.nmap -p80,443 --script http-waf-fingerprint --script-args http-waf-fingerprint.intensive=1 targetWebsite

Starting Nmap 7.70 ( https://nmap.org )
Nmap scan report for targetWebsite
Host is up (0.84s latency).

PORT    STATE SERVICE
80/tcp  open  http
| http-waf-fingerprint:
|   Detected WAF
|_    BinarySec version 3.4.0
443/tcp open  httpsWe've just learned the BinarySec WAF (version 3.4) is in use. An attack could study the WAF manual to better learn the triggers to avoid detection while penetration testing.3. Find HTTP ErrorsHypertext Transfer Protocol (HTTP)status codes, also known as "response codes," are issued by web servers to our web browsers when we make requests. These codes are a way for web servers to communicate errors to server administrators, web developers, and end-users alike.HTTP status codes are split into several categories or "classes." The first digit defines the categories and the following digits are sub-categories, specific to different types of error messages. For example, the 4xx categories is a class of errors specific to HTTP requests that cannot be fulfilled by the web server. Like trying to view a webpage that doesn't exist. That's defined as a status "404 Not Found," probably one of the most well-known status codes on the internet.Status codes are especially useful to pentester's because it helps us identify broken, malformed, and misconfigured parts of a server which might be leaking sensitive information, or they can allow for some exploitable way of controlling aspects of the server.As per Wikipedia, below is a list of the five HTTP status code categories. Web application penetration testers should familiarize themselves with all of the status codes and their definitions.1xx(Informational): The request was received, continuing process2xx(Successful): The request was successfully received, understood, and accepted3xx(Redirection): Further action needs to be taken in order to complete the request4xx(Client Error): The request contains bad syntax or cannot be fulfilled5xx(Server Error): The server failed to fulfill an apparently valid requestThehttp-errorsNmap script can be used to identify interesting status codes for further investigation.nmap -p80,443 --script http-errors targetWebsite.comSimply calling thehttp-errorsscript is enough to get started. Ports 80 and 443 are command web server ports but can be changed to meet your needs.Nmap scan report for targetWebsite.com
Host is up (0.67s latency).

PORT    STATE SERVICE
80/tcp  open  http
| http-errors:
| Spidering limited to: maxpagecount=40; withinhost=targetWebsite.com
|   Found the following error pages:
|
|   Error Code: 403
|_  	http://targetWebsite.com:80/
443/tcp open  https
| http-errors:
| Spidering limited to: maxpagecount=40; withinhost=targetWebsite.com
|   Found the following error pages:
|
|   Error Code: 400
|_  	http://targetWebsite.com:443/In the above output, Nmap detected a status 403, which suggests the servers file permissions are misconfigured and visitors don't have access to the requested resource. Below is a more refined command that includes several script arguments.nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/docs/,httpspider.maxpagecount=3,httpspider.maxdepth=1" targetwebsite.comThis particular Nmap script utilizes thehttpspiderlibrary, so we can use arguments likehttpspider.url,httpspider.maxpagecount, andhttpspider.maxdepthto refine our scan to specific URLs and define how many pages we want Nmap to crawl before stopping.4. Find Shared & New ServersSubdomains are often used to host additional websites for a specific subset of users. For example, Null Byte (null-byte.wonderhowto.com) is one of many subdomains in the WonderHowTo network of websites. Popular subdomains includem.facebook.com,mobile.twitter.com, anddeveloper.github.com.These subdomains are useful to hackers because the subdomain and main domain may actually be hosted on completely different virtual private servers, in different parts of the world, and may not exercise the same degree of security.Thedns-brutescript built into Nmap is designed to enumerate subdomains and their corresponding server IP addresses.nmap -p80,443 --script dns-brute targetWebsite.com

Starting Nmap 7.70 ( https://nmap.org )
Nmap scan report for targetWebsite.com
Host is up (0.16s latency).

PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https

Host script results:
| dns-brute:
|   DNS Brute-force hostnames:
|     http.targetWebsite.com - 198.105.244.228
|     http.targetWebsite.com - 198.105.254.228
|     mysql.targetWebsite.com - 198.105.244.228
|     mysql.targetWebsite.com - 198.105.254.228
|     news.targetWebsite.com - 104.17.202.106
|     news.targetWebsite.com - 104.17.203.106
|     news.targetWebsite.com - 104.17.204.106
|     news.targetWebsite.com - 104.17.205.106
|     news.targetWebsite.com - 104.17.206.106
|     app.targetWebsite.com - 104.97.95.87
|     apps.targetWebsite.com - 12.18.141.21
|     web.targetWebsite.com - 198.105.244.228
|     web.targetWebsite.com - 198.105.254.228
|     auth.targetWebsite.com - 204.238.150.111
|     web2test.targetWebsite.com - 198.105.244.228
|     web2test.targetWebsite.com - 198.105.254.228
|     beta.targetWebsite.com - 98.99.252.42
|     id.targetWebsite.com - 98.99.254.9
|     blog.targetWebsite.com - 216.87.148.114
|     www.targetWebsite.com - 104.97.95.87
|     www2.targetWebsite.com - 207.76.137.99
|     cms.targetWebsite.com - 98.99.252.57
|     ldap.targetWebsite.com - 98.99.254.57
|     owa.targetWebsite.com - 98.99.252.118
|     sip.targetWebsite.com - 199.233.179.46
|     mail.targetWebsite.com - 98.99.254.8
|     mobile.targetWebsite.com - 216.87.148.114
|     help.targetWebsite.com - 98.99.252.46
|     home.targetWebsite.com - 198.105.244.228
|_    home.targetWebsite.com - 198.105.254.228

Nmap done: 1 IP address (1 host up) scanned in 32.62 secondsThis particular website has many subdomains configured and not all share the same IP address. At this point, a penetration tester can further expand their reconnaissance to the newly discovered servers under this websites control.Below is adns-brutecommand that features several--script-args.nmap -p80,443 --script dns-brute --script-args dns-brute.threads=25,dns-brute.hostlist=/root/Desktop/custom-subdomain-wordlist.txt targetWebsite.com

Starting Nmap 7.70 ( https://nmap.org )
Nmap scan report for targetWebsite.com
Host is up (0.17s latency).

PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https

Host script results:
| dns-brute:
|   DNS Brute-force hostnames:
|     www7.targetWebsite.com - 198.105.244.228
|     www7.targetWebsite.com - 198.105.254.228
|     www.targetWebsite.com - 104.97.95.87
|     webdisk.test.targetWebsite.com - 198.105.244.228
|     webdisk.test.targetWebsite.com - 198.105.254.228
|     www4.targetWebsite.com - 198.105.244.228
|     www4.targetWebsite.com - 198.105.254.228
|     www1.targetWebsite.com - 198.105.244.228
|     www1.targetWebsite.com - 198.105.254.228
|     app.targetWebsite.com - 104.97.95.87
|     mail.targetWebsite.com - 98.99.254.8
|     www.m.targetWebsite.com - 198.105.244.228
|     www.m.targetWebsite.com - 198.105.254.228
|     meet.targetWebsite.com - 199.233.179.60
|     members.targetWebsite.com - 52.85.88.11
|     members.targetWebsite.com - 52.85.88.178
|     members.targetWebsite.com - 52.85.88.184
|     members.targetWebsite.com - 52.85.88.186
|     webmail2.targetWebsite.com - 198.105.244.228
|     webmail2.targetWebsite.com - 198.105.254.228
|     ww2.targetWebsite.com - 198.105.244.228
|     ww2.targetWebsite.com - 198.105.254.228
|     sip.targetWebsite.com - 199.233.179.46
|     www.beta.targetWebsite.com - 198.105.244.228
|     www.beta.targetWebsite.com - 198.105.254.228
|     news.targetWebsite.com - 104.17.202.106
|     news.targetWebsite.com - 104.17.203.106
|     news.targetWebsite.com - 104.17.204.106
|     news.targetWebsite.com - 104.17.205.106
|     news.targetWebsite.com - 104.17.206.106
|     www.news.targetWebsite.com - 198.105.244.228
|     www.news.targetWebsite.com - 198.105.254.228
|     www.shop.targetWebsite.com - 198.105.244.228
|     www.shop.targetWebsite.com - 198.105.254.228
|     portal.targetWebsite.com - 192.237.142.31
|     preview.targetWebsite.com - 104.97.95.87
|     search.targetWebsite.com - 98.99.252.118
|     www.support.targetWebsite.com - 198.105.244.228
|     www.support.targetWebsite.com - 198.105.254.228
|     api.targetWebsite.com - 98.99.252.56
|     share.targetWebsite.com - 69.28.231.168
|     mobile.targetWebsite.com - 216.87.148.114
|     lyncdiscover.targetWebsite.com - 199.233.179.60
|     mysql.targetWebsite.com - 198.105.244.228
|     mysql.targetWebsite.com - 198.105.254.228
|     owa.targetWebsite.com - 98.99.252.118
|     webdisk.forum.targetWebsite.com - 198.105.244.228
|     webdisk.forum.targetWebsite.com - 198.105.254.228
|     www.blog.targetWebsite.com - 198.105.244.228
|     www.blog.targetWebsite.com - 198.105.254.228
|     beta.targetWebsite.com - 98.99.252.42
|     partner.targetWebsite.com - 98.99.252.118
|     a.targetWebsite.com - 63.149.195.18
|     a.targetWebsite.com - 67.134.222.254
|     a.targetWebsite.com - 8.33.184.254
|     blogs.targetWebsite.com - 98.99.252.176
|     webdisk.m.targetWebsite.com - 198.105.244.228
|     webdisk.m.targetWebsite.com - 198.105.254.228
|     webdisk.demo.targetWebsite.com - 198.105.244.228
|     webdisk.demo.targetWebsite.com - 198.105.254.228
|     ldap.targetWebsite.com - 98.99.254.57
|     www.webmail.targetWebsite.com - 198.105.244.228
|     www.webmail.targetWebsite.com - 198.105.254.228
|     webmail.targetWebsite.com - 98.99.254.8
|     web3.targetWebsite.com - 198.105.244.228
|     web3.targetWebsite.com - 198.105.254.228
|     community.targetWebsite.com - 216.87.148.114
|     webmail.cp.targetWebsite.com - 198.105.244.228
|     webmail.cp.targetWebsite.com - 198.105.254.228
|     www.demo.targetWebsite.com - 198.105.244.228
|     www.demo.targetWebsite.com - 198.105.254.228
|     remote.targetWebsite.com - 216.87.148.114
|     my.targetWebsite.com - 198.105.244.228
|     my.targetWebsite.com - 198.105.254.228
|     webdisk.dev.targetWebsite.com - 198.105.244.228
|     webdisk.dev.targetWebsite.com - 198.105.254.228
|     www.forum.targetWebsite.com - 198.105.244.228
|     www.forum.targetWebsite.com - 198.105.254.228
|     webdisk.targetWebsite.com - 198.105.244.228
|     webdisk.targetWebsite.com - 198.105.254.228
|     www.test.targetWebsite.com - 198.105.244.228
|     www.test.targetWebsite.com - 198.105.254.228
|     www.mobile.targetWebsite.com - 198.105.244.228
|     www.mobile.targetWebsite.com - 198.105.254.228
|     web1.targetWebsite.com - 198.105.244.228
|     web1.targetWebsite.com - 198.105.254.228
|     relay.targetWebsite.com - 98.99.254.28
|     web2.targetWebsite.com - 198.105.244.228
|     web2.targetWebsite.com - 198.105.254.228
|     web.targetWebsite.com - 198.105.244.228
|     web.targetWebsite.com - 198.105.254.228
|     dialin.targetWebsite.com - 199.233.179.60
|     jobs.targetWebsite.com - 216.87.148.114
|     webdisk.blog.targetWebsite.com - 198.105.244.228
|     webdisk.blog.targetWebsite.com - 198.105.254.228
|     home.targetWebsite.com - 198.105.244.228
|     home.targetWebsite.com - 198.105.254.228
|     www3.targetWebsite.com - 198.105.244.228
|     www3.targetWebsite.com - 198.105.254.228
|     www.store.targetWebsite.com - 104.16.53.60
|     www.store.targetWebsite.com - 104.16.54.60
|     www6.targetWebsite.com - 198.105.244.228
|     www6.targetWebsite.com - 198.105.254.228
|     www.my.targetWebsite.com - 198.105.244.228
|     www.my.targetWebsite.com - 198.105.254.228
|     www5.targetWebsite.com - 198.105.244.228
|     www5.targetWebsite.com - 198.105.254.228
|     autodiscover.targetWebsite.com - 98.99.254.176
|     www.admin.targetWebsite.com - 198.105.244.228
|     www.admin.targetWebsite.com - 198.105.254.228
|     store.targetWebsite.com - 104.16.206.251
|     store.targetWebsite.com - 104.16.207.251
|     web01.targetWebsite.com - 198.105.244.228
|     web01.targetWebsite.com - 198.105.254.228
|     cms.targetWebsite.com - 98.99.252.57
|     www.old.targetWebsite.com - 198.105.244.228
|     www.old.targetWebsite.com - 198.105.254.228
|     blog.targetWebsite.com - 216.87.148.114
|     www2.targetWebsite.com - 207.76.137.99
|     webservices.targetWebsite.com - 198.105.244.228
|     webservices.targetWebsite.com - 198.105.254.228
|     www.video.targetWebsite.com - 198.105.244.228
|     www.video.targetWebsite.com - 198.105.254.228
|     web4.targetWebsite.com - 198.105.244.228
|     web4.targetWebsite.com - 198.105.254.228
|     e.targetWebsite.com - 63.149.195.18
|     e.targetWebsite.com - 67.134.222.254
|     e.targetWebsite.com - 8.33.184.254
|     auth.targetWebsite.com - 204.238.150.111
|     wwww.targetWebsite.com - 198.105.244.228
|     wwww.targetWebsite.com - 198.105.254.228
|     help.targetWebsite.com - 98.99.252.46
|     jira.targetWebsite.com - 98.99.254.68
|     outlook.targetWebsite.com - 98.99.254.66
|     www.mail.targetWebsite.com - 198.105.244.228
|     www.mail.targetWebsite.com - 198.105.254.228
|     MAIL.targetWebsite.com - 98.99.254.8
|     www.new.targetWebsite.com - 198.105.244.228
|     www.new.targetWebsite.com - 198.105.254.228
|     mdm.targetWebsite.com - 192.30.68.141
|     origin-www.targetWebsite.com - 104.97.95.87
|     sslvpn.targetWebsite.com - 204.238.150.49
|     assets.targetWebsite.com - 107.14.46.27
|     assets.targetWebsite.com - 107.14.46.35
|     www.en.targetWebsite.com - 198.105.244.228
|     www.en.targetWebsite.com - 198.105.254.228
|     docs.targetWebsite.com - 98.99.254.67
|     www.dev.targetWebsite.com - 198.105.244.228
|     www.dev.targetWebsite.com - 198.105.254.228
|     www.forums.targetWebsite.com - 198.105.244.228
|     www.forums.targetWebsite.com - 198.105.254.228
|     www.ads.targetWebsite.com - 198.105.244.228
|     www.ads.targetWebsite.com - 198.105.254.228
|     apps.targetWebsite.com - 12.18.141.21
|     www.wiki.targetWebsite.com - 198.105.244.228
|     www.wiki.targetWebsite.com - 198.105.254.228
|     webconf.targetWebsite.com - 198.105.244.228
|     webconf.targetWebsite.com - 198.105.254.228
|     ww.targetWebsite.com - 198.105.244.228
|     ww.targetWebsite.com - 198.105.254.228
|     webcam.targetWebsite.com - 198.105.244.228
|     webcam.targetWebsite.com - 198.105.254.228
|     www.chat.targetWebsite.com - 198.105.244.228
|_    www.chat.targetWebsite.com - 198.105.254.228

Nmap done: 1 IP address (1 host up) scanned in 62.15 secondsBy default, dns-brute will scan using five concurrent threads. We can increase or decrease this value with thedns-brute.threads. Depending on the type of web server, many threads will crash a server or act as a denial of service, making the website slow or unresponsive for other users. Adjust this value with caution.Dns-brute will attempt about 125 popular subdomains. We can usecustom subdomain listswith thedns-brute.hostlistargument. As we can see in the above output, using acomprehensive wordlist, we were able to detect more subdomains and IP addresses controlled by this website.Related Book: "Nmap 6: Network Exploration and Security Auditing Cookbook" by Paulino Calderon (Available fromAmazon|Walmart)5. Extract EXIF Data from PhotosExchangeable image file, known more as EXIF, is information stored in JPEG, PNG, PDF, and many more file types. This embedded data can sometimes reveal interesting information, including timestamps, device information, and GPS coordinates. Most websites still do not properly sanitize EXIF data from images, leaving themselves or their users at risk.As penetration testers, knowing what kind of device a target is using will aid us in determining what kind(s) of payloads to generate. A classic example ofEXIF data being used to catch a black hatis the arrest of Higinio Ochoa. FBI agents extrapolated his girlfriend's geographic location using the GPS data found in a photo Higinio uploaded to the internet.Nmap'shttp-exif-spiderscript can be used to extract interesting EXIF data from photos found on websites. Such a script isn't useful against mainstream sites like Instagram, Twitter, and Facebook. Major websites scrub EXIF data when users upload new photos. However, personal blogs, small businesses, and corporate organizations may not practice strong security precautions or monitor what employees are posting online. It's not uncommon to find GPS data in photos.nmap -p80,443 --script http-exif-spider targetWebsite.com

Starting Nmap 7.70 ( https://nmap.org )
Nmap scan report for targetWebsite.com
Host is up (0.12s latency).

PORT    STATE SERVICE
80/tcp  open  http
| http-exif-spider:
|   http://targetWebsite.com:80/image_10012.jpg
|     Make: NIKON CORPORATION
|     Model: NIKON D4
|     Date: 2017:04:26 21:22:49
|   http://targetWebsite.com:80/ips.jpg
|     Make: Samsung
|     Model: Galaxy S6
|_    Date: 2017:02:24 23:37:14
443/tcp open  https
| http-exif-spider:
|   https://targetWebsite.com:443/clifton.jpg
|     Make: Canon
|_    Model: Canon EOS 5D Mark III

Nmap done: 1 IP address (1 host up) scanned in 30.43 secondsWe can see the above target is using an Android phone and a variety of digital cameras. We can now (with some degree of certainty) generate an Android-specific payload and send it to the target to further compromise their devices, accounts, and networks.When attempting to extract EXIF data from large photos, Nmap may produce an error message that states "Current http cache size exceeds max size." This is Nmap telling us that the photo is too large and is exceeding the default maximum file size value. Use thehttp.max-cache-sizeargument and increase the value as needed. Below I've set it to an arbitrarily high number.nmap -p80,443 --script http-exif-spider --script-args="http.max-cache-size=99999999" targetWebsite.comMore Nmap Scripts to Come ...Whether we're enumerating subdomains, detecting WAF version info, or reporting broken webpages for a small bug bounty, Nmap scripts have us covered. And we've barely scratched the surface with what Nmap scripts are capable of. In my next article, I'll be talking about scripts that don't trigger web application firewalls or alert system administrators to our attempts at reconnaissance.Don't Miss:More Nmap Guides on Null ByteFollow Gadget Hacks onFacebook,Twitter,YouTube, andFlipboardSign up forGadget Hacks' daily newsletteror weeklyAndroidandiOSupdatesFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo by Justin Meyers/Null ByteRelatedHow To:Get Started Writing Your Own NSE Scripts for NmapHow To:Use NMAP 7 to Discover Vulnerabilities, Launch DoS Attacks and More!How To:Easily Detect CVEs with Nmap ScriptsHack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHow To:Tactical Nmap for Beginner Network ReconnaissanceHack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHack Like a Pro:Scripting for the Aspiring Hacker, Part 2 (Conditional Statements)Hack Like a Pro:Advanced Nmap for ReconnaissanceHow To:Enumerate NetBIOS Shares with NBTScan & Nmap Scripting EngineHow To:Identify Web Application Firewalls with Wafw00f & NmapDissecting Nmap:Part 1How to Hack Databases:Hunting for Microsoft's SQL ServerHow To:Automate Brute-Force Attacks for Nmap ScansZanti:NmapHack Like a Pro:Scripting for the Aspiring Hacker, Part 1 (BASH Basics)Hack Like a Pro:Python Scripting for the Aspiring Hacker, Part 1Hack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapHow To:Do a Simple NMAP Scan on ArmatigeHow To:Use Magic Tree to Organize Your ProjectsHow To:Do an Idle Scan with NmapHow To:Break into the Lucrative World of Ethical Hacking with This Reasonably Priced Course BundleHow To:Perform Network-Based Attacks with an SBC ImplantHack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItHacking Reconnaissance:Finding Vulnerabilities in Your Target Using NmapHow To:Use the Nmap security tool