Nmap is a security tool used to discover hosts on a network, the services running on them, and operating system details. It performs host discovery using ping scans, port scanning to identify open ports and services running, and OS detection using TCP/IP fingerprinting. Nmap sends crafted packets and compares the responses to fingerprints to determine the likely OS. It has options for different scan types, port ranges, and detection methods and provides insights into network security and available services.

1. NMAP
Presented By:- DAKSH KHURANA
Presented To:- Pal Sir

2. nmap “network mapper”
 Security tool
- What does your system look like to someone
who is trying to break in
- Find the holes in your security before somebody
else does
 nmapFE v3.81
- graphical frontend to nmap
- rpm available at www.insecure.org/nmap
- lab102 & lab103

3. Basic nmap functions
1.) Host Discovery
- Which hosts are up (IP Addresses)
- Ping scans
2.) Port Scanning
- Which ports of a target host have servers
listening on them
- Allows a guess of software and services a
machine is running
3.) OS Detection
- TCP/IP fingerprinting

4. Anatomy of nmap argument
nmap –sS -PO -O -p 1-1024 134.198.161.*
-s_ : Scan type
-P_ : Ping type
-O : Optional OS detection
-p #-# : port range
IP range:
134.198.161.0/24, 134.198.161.1-254

5. 1.) Host Discovery
 Determine which hosts are up
- Does not include port scans or OS detection
nmap –sP 134.198.161.*
- Utilizes variety of messaging protocols
- ICMP/TCP/UDP
 Firewall interference
- Firewalls check to see if packets are part of a
previously established connection
 Used before portscan
- Ping sweep (-sP)
- Check to see if host is up before scanning ports

6. 2.) Port Scanning
 Insight to what services a host may be
running
 “Well-known” or “Interesting” ports
- 1-1024
- 65,535 total TCP & UDP ports
 Scan displays (for each port)
• Service name
• Port number
• Port State
• Protocol

7. Port States
 open: will accept connections
 filtered: firewall or other network
obstacle is covering port
 unfiltered or closed: determined to
be closed with no obstacles or
interference
- most common case

8. Scanning Options
 Avoid SYN scanning to probe beyond firewall
-sF : Stealth FIN scan
-sX : Xmas tree scan
-sN : Null scan
-sV : Version detection
-sU : UDP scan
-sI : Idlescan
-sA : ACK scan
-b : bounce attack (FTP)

9. 3.) OS Detection
 nmap –O …
 TCP/IP fingerprinting
 OS guess made by looking at the particulars of how a host
implements TCP/IP
- Includes possible range of versions and “uptime” test
 Fingerprint compared to DB of known OS fingerprints
 Nmap sends seven TCP/IP crafted packets (called tests)
and waits for the answer. Results are checked against a
database of known results (OS signatures database).
 This database is a text file that contains the result
answered (signature) by each OS known.

10. OS Detection
 Many techniques to fingerprint
networking stacks. If you combine
enough of these. You can narrow
down the OS very tightly.
 You can start out as simply as
"nmap -O -sS targethost".

11. OS Detection
 -O requires root privileges, it uses
this information to create a
fingerprint, and decide what type of
system you are scanning.
 OS detection is far more effective if
at least one open and one close TCP
port are found.

12. Miscellaneous options
 -A which turn on OS detection too.
 -F tells nmap to scan only ports
 registered in nmap-services.
 -T4 causes nmap to go faster.
 -I gives the username that owns
available processes
 -iR Use this command to instruct
nmap to scan random hosts for you.