Nmap is a network exploration tool that collects information about target hosts including open ports, services, OS detection, and running scripts. It offers various host discovery techniques like ICMP ping, TCP and UDP ping to find active systems on the network. Once hosts are identified, nmap performs port scanning using TCP SYN, ACK, and UDP scans to determine open and closed ports. It can also detect services, versions, and OS on each host. Nmap scripts provide additional information gathering capabilities for vulnerabilities and exploits.

1. Basics of NMAP
By : Prateek Aryan

2. What’s NMAP ?
-> NMAP is a mapping or a footprinting tool.
-> It is used for network exploration.
-> NMAP collects information about target host.
-> Target can be specified by IP Adress or Domain Name.
-> command : nmap 192.168.10.1 or nmap www.google.com

3. What’s NMAP ?
-> Host / Port / Service Discovery
-> OS Version Detection
-> Service Version Detection
-> Vulnerability and Exploit detection using NSE
-> Firewall and spoofing evasions.

4. Installing NMAP
-> NMAP is available fo all cross platforms.
-> In Linux distros we can install it by using sudo apt-get nmap.

5. Target Specification

6. Target Specification
-> Target can be a single host or multiple hosts.
nmap 192.168.10.1
nmap 192.168.10.2 192.168.10.3
nmap 192.168.10.1-24
-> any random hosts
nmap -iR 5

7. Target Specification
->CIDR Notation
nmap 192.168.10.0/24 - scans 192.168.10.0 -192.168.255
nmap 192.168.10.0/0 - scans whole internet

8. Target Specification
-> input from file name
nmap -iL URL

9. Default Scan
-> nmap 192.168.10.0/24
->ping phase :
pings all the listed ip address.
-> port scan phase :
If ip address responds to ping i.e host is online then
->nmap scans all the ports of the ip address ( by default it scans 1000
ports ).

11. Host Discovery

12. Host Discovery
-> One of the very first steps in any network expolartion mission is to reduce a
(sometimes huge) set of IP ranges into a list of active hosts.
-> Scanning every port of every single IP address is slow and usually
unnecessary.
-> Nmap offers a wide variety of options for customizing the techniques used.

13. Various Host Discovery Techniques
-> List Scan
->no port scan
-> No ping scan
->TCP SYN Ping
-> TCP ACK Ping
-> UDP Ping
-> Traceroute

14. Varios Host Discovery Techniques
-> ICMP Ping Types
-> no dns resolution
-> DNS Resolution for all targets

15. List Scan
-> List Scan
nmap -sL 192.168.43.0/24
-> simply lists each host of the network specified.
-> it doesnt send any packets to the target hosts.
-> does DNS resolution.

17. No port scan
-> Does’t do port scan after host discovery
->only prints out the available hosts
nmap -sn 192.168.10.0/24

19. No Ping
This options skips the Nmap Discovery Stage
nmap -Pn 192.168.10.0/24

21. TCP SYN Ping
-> This option sends an empty TCP packet with the SYN flag set
nmap -PS 192.168.10.0/24

23. TCP ACK Ping
-> This option sends an empty TCP packet with ACK flag set.
->
nmap -PA 192.168.10.0/24

25. UDP Ping
-> This option sends an empty UDP packets to hosts.
-> Generally ACK and SYN packets are blocked by firewall.
-> This option helps in bypassing firewall.
nmap -PU 192.168.10.0/24

27. ICMP echo ping
-> This options send ICMP echo request to hosts.
nmap -PE 192.168.10.0/24

29. Other options
-> --traceroute
Traces path to host.
-> -n
No DNS resolution

32. PORT Scanning

33. Port Scanning
-> as we have found online hosts .. our next step will be targeting ports of active
hosts.
-> there are 65,535 ports
-> nmap by default scans 1000 ports
-> nmap recognizes ports in 6 states.

34. Port Scanning
Six states rezognized by nmap are :
->open
->closed
-> filtered
->unfiltered
->open | filered
-> close | filtered

35. Port Scanning Techniques
-> TCP SYN Scan
-> TCP ACK Scan
-> TCP UDP Scan
-> TCP Null Scan

36. TCP SYN Scan
-> by defaut nmap scans ports by sending TCP packets with syn flag set
nmap -sS 192.168.10.1

38. TCP ACK Scan
-> sends empty TCP Packets with ACK flag set.
nmap -sA 192.168.10.1

40. TCP UDP Scan
-> sends UDP packets to ports
nmap -sU 192.168.10.1

42. Other options
-> -p port numbers
We can specify which port we want to scan.
-> -F
Fast mode. It only scans 100 important ports.

43. Version and OS detection

44. Service and version detection
-> nmap can detect service and version of softwares running at ports of hosts.
nmap -sV 192.168.10.1

46. OS version detection
-> nmap can detect OS version of the host.
nmap -O 192.168.10.1

48. NMAP Scripting Engines

49. NMAP Script Engine
->The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible
features.
-> It allows users to write (and share) simple scripts (using the Lua programming
language) to automate a wide variety of networking tasks.
-> NMAP also comes with premade scripts
->NSE can even be used for vulnerability exploitation

50. What’s a script ?
-> a script is basically a predefined code written using Lua Programming
Language
-> this predefined code helps in gathering more information about services running
at the ports.

51. List of Scripts
->nmap comes with premade scripts and are stored in the
/usr/share/nmap/scripts
-> we can list all the premade scripts
ls /usr/share/nmap/scripts

53. List of scripts
-> for different services we have different list of scripts available.
-> we can list scripts available for a particular service using grep command.
ls /usr/share/nmap/scripts | grep “service_name”
-> for example
We can list scripts available for http service
ls /usr/share/nmap/scripts | grep http

55. Script Scanning
-> default script scanning : for different services default scripts are set
-> when default script is run , nmap scan default scripts of services running at
ports.
nmap -sC scanme.nmap.org

57. Script Scannning
nmap --script=”script_name” 192.168.10.1
-> example
nmap --script=http-brute.nse scanme.nmap.org
//multiple scripts
nmap -script=http-traceroute.nse,http-brute.nse scanme.nmap.org

60. Interesting Scripts

68. OUTPUT

69. OUTPUT
-> we can save our scan results in an output file.
-> nmap -oN file_name 192.168.10.1
Outputs to given file name.
-> nmap -oX file_name 192.168.10.1
-> XML Output to given file name.

70. Miscellaneous Options

71. Miscellaneous Options
-> verbose scanning
Print more information about the scan in progress
nmap -v 192.168.10.1
-> aggressive scanning
Enables OS (-O) and service detection(-sV) , traceroute(--
traceroute),
scriptscanning (-sC) .
nmap -A 192.168.10.1

72. THANK YOU ! :)