You're reading from Network Scanning Cookbook

Product typeBook

Published inSep 2018

PublisherPackt

ISBN-139781789346480

Edition1st Edition

Tools

Nessus Nmap

Concepts

Network Security

Author (1)

Sairam Jetty

Port Scanning

In this chapter, we will cover the following recipes:

How to specify a target
How to perform host discovery
How to identify open ports
How to manage specification and scan order
How to perform script and version scan
How to detect operating system
How to detect and bypass network protection systems
How to use Zenmap

Introduction

In this chapter, we will be going through various recipes that explain how to make use of Nmap to perform various port scanning techniques. Each recipe will contain practical insights into performing Nmap scans on a test virtual machine, allowing you to understand the functionalities of the various switches supported by Nmap.

How to specify a target

The nmap command interprets any content appended without an associated switch as a target. The following is a basic syntax that specifies an IP address or a hostname to scan without any associated switches:

nmap 127.0.0.1 
nmap localhost

The hostname is resolved with the configured DNS server and the IP address is obtained to perform the scan. If multiple IP address are associated with one hostname, the first IP address will be scanned and the result will be displayed. The following syntax allows nmap to perform scans on all the IP addresses resolved with the hostname provided in the command:

nmap xyz.com*

Nmap also supports scanning the whole subnet, provided that you append the mask at the end of an IP address or hostname. Then, Nmap will consider all the resolved IP addresses in the range of the mask mentioned. For example, 10.0.0.1/24 would scan the...

How to perform host discovery

One of the basic techniques of identifying a running host is by sending an ICMP ping packet and analyzing the response to draw a conclusion. What if the host or the network is blocking ICMP packets at the network level or the host level? As per the ICMP technique, the host or the network will not pop up in the live host list. Host discovery is one of the core components of a network penetration test or vulnerability scan. A half-done host discovery can ignore hosts or networks from the scope and perform any further operation, thus leaving the network vulnerable.

Nmap provides various options and techniques to identify the live host by sending customized packets to satisfy specific network conditions. If no such options are provided, Nmap by default sends an ICMP echo to identify the live hosts. The provided probe options can be combined to increase...

How to identify open ports

The following are the six port states that are present in Nmap:

open: This means that the port is functioning and has a service running or accessing it. The service can thus accept any connections made as per the protocol and service in use on this port.
closed: A closed port is not being accessed by any service, there is no service running on it. Thus, no connections made externally will be successful on these ports.
filtered: This status is associated with ports from which no response was received due to the packet filtering mechanism present within the network. This might be caused by an intermediate network protection device.
unfiltered: This status is associated with the ports that Nmap was not able to determine whether they were open or closed. Mostly ACK scan labels ports to be in unfiltered state; moreover, scans such as SYN and FIN can help...

How to manage specification and scan order

Nmap provides various options to specify ports to be scanned in a random or sequential order. All the Nmap scans, without any ports specified or any specific NSE script provided as an argument, by default scan only the top 1,000 ports:

-p <port ranges>: This option can be used to configure the ports to be scanned in multiple formats. It can be a range or a list. General representation of the syntax would be –p1-65535 if you want to perform a full port scan or –p1, 2, 3, or 4 as a random list that can be non-serial in nature.
--exclude-ports <port ranges>: It is a tedious task to prepare a list of ports to be scanned when the requirement is a full port with a few exclusions. In such cases, you can use the exclude ports flag to exclude the ports that are not to be scanned.
-F (Fast (limited port) scan): The fast...

How to perform a script and version scan

While performing penetration tests, reconnaissance is really important for informing the next steps of testing. Even though Nmap provides the open ports and the version of the service running on the port, you will need to know the exact version or the name of the service that is running to prepare further exploits or to gain further knowledge of the system.

The Nmap-service-probes database contains specific packet construction techniques to probe specific services and analyze the responses received from them. Nmap provides information about the service protocol, the application name, the version number, the hostname, the device type, and the OS family. It also sometimes determines whether the service is open to connections or if any default logins are available for the service:

-sV (version detection): This flag enables Nmap to perform...

How to detect operating system

Nmap uses TCP/IP stack fingerprinting for OS detection.This is done by crafting custom TCP and UDP packets and analyzing their responses. After generating various such probes and comparing the results to the Nmap-os-db database of more than 2,600 known OS fingerprints and provides the OS version. The fingerprint provides details such as the vendor name, OS name, OS generation, device type, and also their Common Platform Enumeration (CPE) representation. Nmap also provides an option for the user to submit the fingerprint obtained if it is not present in the Nmap database of operating signatures:

-O (Enable OS detection): This enables OS detection for an Nmap scan. This flag further has options that can be used in conjunction with it.
--osscan-limit: This option will reduce the scan time when a list of hosts is being scanned by skipping the hosts...

How to detect and bypass network protection systems

The basic function of Nmap is to generate custom packets and analyze their response once they are sent to the remote hosts. This sometimes is not allowed by network protection systems such as firewalls and intrusion prevention and detection systems. In this recipe, we will discuss some of the methods that can be used to bypass these protections:

-f (Fragment packets): Most firewalls perform stateful and stateless packet inspection for which they examine the content of the packets and decide whether to allow the packet or drop it based on its contents. In order to bypass this, Nmap provides an option to fragment the packets so that the network device will not be able to construct the packet to read the correct contents, thereby bypassing the protection.
--mtu (Maximum transmission unit specification): This works similar to the...

How to use Zenmap

Zenmap is the graphical interface of Nmap. It is open source and comes in the same installation package as Nmap:

Sometimes, working with command-line tools can be tedious for administrators, thus Zenmap acts as an alternate GUI option.

How do it...

Here are the steps:

Open Zenmap from the list of programs.
Enter the target to be scanned in the text field provided, as shown here:

Select Quick scan from the Profile drop-down list, as shown here:

This will perform a fast scan with the –F option, thereby giving results for the top 100 ports along with a detailed analysis in different tabs, as shown in the following screenshot:

The Ports/Hosts tab shows the various open ports along with the services...

The rest of the chapter is locked

You have been reading a chapter from

Network Scanning Cookbook

Published in: Sep 2018Publisher: PacktISBN-13: 9781789346480

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

undefined

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at $15.99/month. Cancel anytime

Author (1)

Sairam Jetty

Sairam Jetty has more than 5 years of hands-on experience in many verticals of penetration testing, compliance, digital forensics, and malware research. He is currently working with Paladion Networks, Abu Dhabi, as a senior analyst and team lead. He has assisted and associated with various financial, telecom, and industrial institutions for testing and securing their applications and environments. Sairam has industry-standard certifications, such as OSCP, Digital Forensic Analyst, Digital Forensic Investigator, and Mobile Security Expert. He also specializes in source code review and mobile application security. He has acquired a great knowledge of SCADA/ICS and nuclear security from his corporate experience and self-learning.
Read more about Sairam Jetty

Other recommended products

Related to this chapter

Nmap Network Exploration and Security Auditing Cookbook

This book explores how Nmap is one of the most robust tools for network discovery and security auditing. You’ll focus on how you can use it to perform hundreds of different tasks, from OS detection and port scanning to advanced fingerprinting and vulnerability exploitation.

BookSep 2021436 pages

Kali Linux Network Scanning Cookbook

With the ever-increasing amount of data flowing in today’s world, information security has become vital to any application. This is where Kali Linux comes in. Kali Linux focuses mainly on security auditing and penetration testing. This step-by-step cookbook on network scanning trains you in important scanning concepts based on version 2016.2. It will enable you to conquer any network environment through a range of network scanning techniques and will also equip you to script your very own tools.

BookMay 2017634 pages

Nmap: Network Exploration and Security Auditing Cookbook

This is the second edition of ‘Nmap 6: Network Exploration and Security Auditing Cookbook’. A book aimed for anyone who wants to master Nmap and its scripting engine through practical tasks for system administrators and penetration testers. Besides introducing the most powerful features of Nmap and related tools, common security auditing tasks for local and remote networks, web applications, databases, mail servers, Microsoft Windows machines and even ICS SCADA systems are explained step by step with exact commands and argument explanations.

BookMay 2017416 pages

Learn Kali Linux 2019

The current trend of various hacking and security breaches displays how important it has become to pentest your environment, to ensure end point protection. This book will take you through the latest version of Kali Linux to efficiently deal with various crucial security aspects such as confidentiality, integrity, access control and authentication.

BookNov 2019550 pages

Practical Web Penetration Testing

Web Applications are the core of any business today, and the need for specialized Application Security experts is increasing these days. Using this book, you will be able to learn Application Security testing and understand how to analyze a web application, conduct a web intrusion test, and a network infrastructure test.

BookJun 2018294 pages

Kali Linux Cookbook

Kali Linux is a Linux distribution designed for penetration testing and security auditing. It is the successor to BackTrack, the world’s most popular penetration testing distribution. Kali Linux is the most widely used platform and toolkit for penetration testing. Security is currently the hottest field in technology with a projected need for millions of security professionals. This book focuses on enhancing your knowledge in Kali Linux for security by expanding your skills with toolkits and frameworks that can increase your value as a security professional.

BookSep 2017438 pages

Metasploit 5.0 for Beginners

Metasploit 5.x for Beginners will provide a good starting point to perform penetration testing and identify threats and vulnerabilities to secure your IT environment. You will be able to analyze, identify, and exploit threats and vulnerabilities to secure your IT environment.

BookApr 2020246 pages

Hands-On Web Penetration Testing with Metasploit

Metasploit is one of the best frameworks used for enumeration and exploitation of vulnerabilities. This book will not only give you a practical understanding of Metasploit but will also cover some less known modules and auxiliaries for pentesting Web Applications.

BookMay 2020544 pages

Kali Linux 2018: Assuring Security by Penetration Testing

This book is a fully focused, structured book providing guidance on developing practical penetration testing skills by demonstrating cutting-edge hacker tools and techniques. It offers you all of the essential lab preparation and testing procedures that reflect real-world attack scenarios from a business perspective, in today's digital age.

BookOct 2018528 pages

Security Automation with Ansible 2

Security automation is one of the most interesting skills to have nowadays. With over 750 automation modules, Ansible makes it easy for you to secure any part of your system—be it setting firewalls, providing authentication to users and groups, or setting custom security policies. It allows you to write automation procedures once and use them across your entire infrastructure. This book will teach you the best way to use Ansible for seemingly complex tasks by using the various building blocks available and creating solutions that are easy to teach others, store for later, perform version control on, and repeat.

BookDec 2017364 pages

Learn Penetration Testing

A penetration test, also known as a pen test, is a simulated cyberattack against your computer system to check for exploitable vulnerabilities. In the context of web application security, penetration testing is commonly used to augment a web application firewall (WAF). This book teaches you various penetration testing techniques in order to become a proficient Penetration tester.

BookMay 2019424 pages

Metasploit for Beginners

Metasploit for Beginners will provide a good starting point to perform penetration testing and identify threats and vulnerabilities to secure your IT environment. This book would help the reader absorb the essential concepts on using Metasploit framework for comprehensive penetration testing. By the end of the book, the reader would feel confident on having gained sufficient hands-on knowledge on effectively utilizing the framework in real world scenarios.

BookJul 2017190 pages

Personalised recommendations for you

Based on your interests and search pattern

Designing and Implementing Microsoft Azure Networking Solutions

Designing and Implementing Microsoft Azure Networking Solutions Exam Ref AZ-700 is an all-encompassing guide to the AZ-700 exam and contains all the information you need to succeed in the world of virtual networking with Azure. With this book, you will be fully prepared for the exam and the world of cloud networking.

BookAug 2023524 pages

Microsoft 365 Security, Compliance, and Identity Administration

The Microsoft 365 Security, Compliance, and Identity Administration is a comprehensive guide that helps you employ Microsoft 365's robust suite of features and empowers you to optimize your administrative tasks.

BookAug 2023630 pages

Zero Trust Overview and Playbook Introduction

Get started on Zero Trust with this step-by-step playbook and learn everything you need to know for a successful Zero Trust journey with tailored guidance for every role, covering strategy, operations, architecture, implementation, and measuring success. This book will become an indispensable reference for everyone in your organization.

BookOct 2023240 pages

The Self-Taught Cloud Computing Engineer

This self-study book helps you master multiple clouds, including AWS, Azure, and GCP, and serves as a roadmap to becoming a certified cloud computing expert. The book will guide you to develop a professional cloud career by helping you build a broad cloud knowledge base, developing hands-on cloud computing skills, and getting cloud certified.

BookSep 2023472 pages

Technology Operating Models for Cloud and Edge

This book will help you build and create ownership of a technology operating model, as well as connect your leadership with engineering and operations, keeping your internal and external customers in mind. It provides practical tips on why, where, and how to make the cloud and edge platform paradigm sing for you, your team, and your organization.

BookAug 2023228 pages

Azure Architecture Explained

Azure is the preferred platform to build mission-critical and secure apps. This book provides comprehensive coverage of essential Azure products, services, and solutions vital for every solution architect's success. Elevate your knowledge and master the critical components of Azure to excel in your role with Azure Architecture Explained.

BookSep 2023446 pages

Pentesting Active Directory and Windows-based Infrastructure

This practical guide helps you explore the pentesting of Microsoft infrastructure in detail, and enhances your offensive skillset by showing you the different ways to perform security assessment. This book will help blue teamers and IT engineers get up to speed with possible security issues they may encounter in their Windows environments.

BookNov 2023360 pages

Practical Ansible

In Practical Ansible, you'll work with the latest release of Ansible and learn to solve complex issues quickly with the help of task-oriented scenarios. You'll start by installing and configuring Ansible to automate monotonous and repetitive IT tasks and get to grips with concepts such as playbooks, inventories, plugins, collections, and network modules.

BookSep 2023420 pages

Windows 11 for Enterprise Administrators

Microsoft’s launch of Windows 11 is a step toward satisfying the enterprise administrator’s needs for better management and enhanced user experience customization. This book provides the enterprise administrator with the knowledge needed to fully utilize the advanced feature set of Windows 11 Enterprise.

BookOct 2023286 pages

The Linux DevOps Handbook

This book is for software and IT professionals seeking knowledge on Linux systems and DevOps practices. This book will provide you with guidance and tools to learn and gain proficiency in managing Linux-based infrastructures and knowledge of DevOps.

BookNov 2023428 pages2