Hacking Reconnaissance: Finding Vulnerabilities in Your Target Using Nmap « Null Byte :: WonderHowTo

Rememberthat sceneinThe Matrixwhen Trinity uses a realisticNmapport scan, followed by an actualSSH exploit(long since patched) to break into a power company? Well, believe it or not, but that scene isnotfar fetched at all.Please enable JavaScript to watch this video.If you want to exploit vulnerabilities and root boxes, you'll need to learn how to perform the necessary reconnaissance first. In fact, you will spend far more time researching your target then you will exploiting it. In this article, I am going to show you the first step in doing just that... a security scanner called Nmap.Port MappingAny service running on a server, from HTTP to SSH, runs on ports. Think of a port as a door into and out of the computer, that only answers requests relevant to it. An example would be a web server running on port 80 (HTTP), which would have no idea how to handle an FTP connection request sent to it.Nmap (NetworkMapper) scans over those ports telling you everything from what software is running to what version it is. There is even an option to determine the operating system.Before we get started, I do want to point out something critical. Port mapping, while not illegal on its own, will show up all over the place in targets' server logs. Using a (non-free) VPN or a anonymous network like I2P can help keep you safe and hidden.Getting Started with NmapIf you are runningBacktrack, you already have Nmap installed, along with its GUI version,Zenmap. Zenmap is nice, but we will be focusing on the command line options for Nmap in this article. On Debian/Ubuntu, simply use:$ sudo apt-get install nmapAny other distributions that do not already include Nmap may download ithere.To get a feel for the software, let's run it with zero options, to see what we can do.$ nmapAs you can see, there's a lot of options:While you could write entire books on the full functionality of Nmap (and they have), much of this is beyond the scope of this article. Instead, I will go over some of the more commonly used options. Hopefully this will serve to get your foot in the door with port scanning.Options, Flags and Settings: Oh MyThere is no doubting the sheer size of options here. Let's break it down with what scan techniques are the most useful for us right away.-sU:UDPscan. It can be combined with aTCPscan type such as SYN scan (-sS) to check both protocols during the same run. UDP tends to be slower then TCP scans, but some services are only listening for UDP requests.-sS: This technique is often referred to as half-open scanning, because you don't open a full TCP connection. You send a SYN packet. A SYN/ACK indicates the port is listening (open), while a RST (reset) means it is not listening on that port.-O: This technique crafts raw packets attempting to determine the operating system.-A: This technique tells Nmap to probe for software versions on the target ports AND operating systems.Nmap in ActionHere we will run a series of port scans on a target web server, making note of the versions and operating systems. Remember, reconnaissance and patience is key to hacking. Let's take a look at Nmap in action as we port scan a web server configured just for this article.$ nmap -sS -O 50.22.84.102Oops! What happened? The -O switch tells Nmap you wish to perform an operating system fingerprint on the target. In order to do that, Nmap needs to be ran with root privileges in order to craft the raw packets needed for the task. In fact, many scan types require it.$ sudo nmap -sS -O 50.22.84.10Here we can easily see this looks like a normal web server so far. Notice how Nmap attempts to guess the operating system? That's useful when you are looking for an attack vector to exploit.Open ports- This server is actively accepting TCP connections, UDP datagrams orSCTPassociations on this port. Finding these is often the primary goal of port scanning. Security-minded people know that each open port is an avenue for attack. Attackers and pen-testers want to exploit the open ports, while administrators try to close or protect them with firewalls without thwarting legitimate users. Open ports are also interesting for non-security scans because they show services available for use on the network.Closed ports- A closed port is accessible, but there is no application listening on it. They can be helpful in showing that a host is up on an IP address (host discovery or ping scanning), and as part of OS detection. Because closed ports are reachable, it may be worth scanning later in case some open up.Let's try another scan, but this time we want to find out what software is running behind those open ports.$ sudo nmap -sS -A 50.22.84.102Here you can see what software is running and what version. For an example, my web server here is running OpenSSH 4.3 on port 22. If I knew of a vulnerability in that version, I would know this server is exploitable.Final ThoughtsThis is by no means an all inclusive listing of everything Nmap has to offer. I tried to pick and choose the highly relevant portions to give you a feel for its capabilities. You can now add another tool to your ever growing arsenal.Questions? Comments? Concerns? Let's hear 'em!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseImages byNmapRelatedHack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHow To:Use NMAP 7 to Discover Vulnerabilities, Launch DoS Attacks and More!News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapAdvanced Nmap:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowHow To:Easily Detect CVEs with Nmap ScriptsHow to Hack Databases:Hunting for Microsoft's SQL ServerHow To:The Five Phases of HackingHack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHack Like a Pro:How to Conduct OS Fingerprinting with Xprobe2Hack Like a Pro:Reconnaissance with Recon-Ng, Part 1 (Getting Started)Hack Like a Pro:Advanced Nmap for ReconnaissanceHow To:Tactical Nmap for Beginner Network ReconnaissanceDissecting Nmap:Part 1Hack Like a Pro:How to Conduct Passive Reconnaissance of a Potential TargetAndroid for Hackers:How to Scan Websites for Vulnerabilities Using an Android Phone Without RootHack Like a Pro:How to Use Maltego to Do Network ReconnaissanceHack Like a Pro:The Hacker MethodologyHow To:Automate Brute-Force Attacks for Nmap ScansHow To:Hack Apache Tomcat via Malicious WAR File UploadHow To:Identify Web Application Firewalls with Wafw00f & NmapHack Like a Pro:How to Find Almost Every Known Vulnerability & Exploit Out ThereHow To:Hack UnrealIRCd Using Python Socket ProgrammingMac for Hackers:How to Organize Your Tools by Pentest StagesHack Like a Pro:Using Nexpose to Scan for Network & System VulnerabilitiesHow To:Scan for Vulnerabilities on Any Website Using NiktoHow To:Advanced Penetration Testing - Part 1 (Introduction)How To:Conduct OSINT Recon on a Target Domain with Raccoon ScannerHow To:Detect Vulnerabilities in a Web Application with UniscanHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesIPsec Tools of the Trade:Don't Bring a Knife to a GunfightNews:Best Hacking Software