NMAP

Links and Resources

Commands

Handy options

  • -sS - Stealthy SYN scan

  • -sV - Loud version scan, will make complete connection, grab banner, and version info

  • -A - run service enumeration scripts

  • -oA [filename] - Print nmap output to file name

  • -Pn - disable ping. Most big companies will have ping diabled on most external entities

  • -n - disable DNS resolution, helps speed up scan

Basic scan 
#nmap [IP Address] or nmap [website.com]
Specify ports

Top Ports

#nmap [IP Address] --top-ports

All Ports

#nmap -p- [IP Address]

UDP Ports

#nmap -sU [IP Address]

TCP Ports (Connect Scan)

#nmap -sT [IP Address]

Quick TCP Scan

nmap -sC -sV -vv -oA quick 10.10.10.10

Quick UDP Scan

nmap -sU -sV -vv -oA quick_udp 10.10.10.10

Full TCP Scan

nmap -sC -sV -p- -vv -oA full 10.10.10.10
Port knock
for x in 7000 8000 9000; do nmap -Pn --host_timeout 201 --max-retries 0 -p $x 10.10.10.10; done

Network Sweep

Broad scans then specific on hosts of interest 

#nmap -sn 10.0.0.1-254
OS scan
#sudo nmap -O -sV [IP Address]

  • --osscan-guess provides a faster, more aggressive scan, which is useful when Nmap retrieves close to 100% OS detection. However, aggressive scanning may result in missing some ports.

  • --osscan-limit is an option used to limit what targets to scan. This option is useful when you have a large range of IPs to scan.

NSE - Nmap scripting Engine

Nmap Scripting Engine (NSE) allows users to run custom and community generated scripts. ◇ stored in /usr/share/nmap/scripts

The most basic way of running Nmap scripts is by using the -sC option, invoking the default scripts.

#nmap -sV -sC 192.168.1.1

To run a specific script against a target, the name of the script must be specified in the command. 

#nmap -sV --script http-sql-injection.nse 192.168.1.1

As well as specifying the name of the script, it is sometimes necessary to specify arguments to achieve the desired behaviour

#nmap --script http-wordpress-brute.nse --script-args ‘passdb=passwords.txt’ 192.168.1.1
#nmap -sV --script mysql-dump-hashes 10.102.9.39 --script-args='username=root,password=abc123'

Run all NSE scripts against found ports

$nmap -Pn -sV -O -pT:{TCP ports found},U:{UDP ports found} --script *vuln* $ip

IDS and IPS Evasion

https://book.hacktricks.xyz/pentesting/pentesting-network/ids-evasion

Send some packets with a TTL enough to arrive to the IDS/IPS but not enough to arrive to the final system. And then, send another packets with the same sequences as the other ones so the IPS/IDS will think that they are repetitions and won't check them, but indeed they are carrying the malicious content.

Nmap option: --ttlvalue <value>

Video Instruction

Hackersploit has one of the best video series on using NMAP.

PreviousRecon FrameworksNextBurp Suite

Last updated