You're reading from Nmap Network Exploration and Security Auditing Cookbook, Third Edition - Third Edition

Product typeBook

Published inSep 2021

PublisherPackt

ISBN-139781838649357

Edition3rd Edition

Tools

Nmap

Concepts

Network Security

Author (1)

Paulino Calderon

Chapter 4: Reconnaissance Tasks

The most important process during a security assessment is the information gathering phase, as you have probably heard from countless bug bounty hunters these days. In this phase, we discover assets and enumerate the attack surface of our target to learn as much as possible, since every bit of information could help. Normally, in this phase, we gather all the information we can find, including usernames, possible passwords, hostnames, IP addresses, external providers, and internal services, including version banners, among many other interesting bits of data. The information we discover could be invaluable in further stages of our security assessment.

There are thousands of reconnaissance tasks that you can perform during assessments. However, the Nmap Scripting Engine (NSE) has the advantage of having the internal results obtained from the scans, in addition to external data sources that complement the many standalone tools that help us complete...

Performing IP address geolocation

Identifying the location of an IP address may help system administrators or threat intelligence analysts identify the origin of a network connection. Nmap ships with several NSE scripts that help us perform geolocation of a remote IP address: ip-geolocation-maxmind, ip-geolocation-ipinfodb, ip-geolocation-geoplugin, ip-geolocation-map-bing, ip-geolocation-map-google, and ip-geolocation-map-kml.

This recipe will show you how to set up and use the geolocation scripts included with NSE.

Getting ready

From the scripts mentioned previously, only ip-geolocation-geoplugin does not require an API key. The ip-geolocation-maxmind script depends on a database that is not included in Nmap by default. Sign up and download Maxmind's GeoLite City database from http://dev.maxmind.com/geoip/legacy/geolite/ and place it in your local Nmap data folder (/nselib/data/). Note that the database format has changed, and it is no longer a plaintext .dat file....

Getting information from WHOIS records

WHOIS records contain useful information, such as the registrar/organization name, creation and expiration dates, geographical location, and abuse contact information among some potentially interesting fields. System administrators, IT staff, and other security professionals have been using WHOIS records for years now, and although there are many tools and websites available to query this information, Nmap can process IP ranges/target lists in many formats to perform this task in batch.

This recipe will show you how to retrieve the WHOIS records of an IP address or domain name with Nmap.

How to do it...

Open a terminal and enter the following command:
```
$nmap -sn --script whois-* <target>
```

The output will look similar to the following:

Host script results:
| whois-domain: 
| 
| Domain name record found at whois.mx
| \x0D
| Domain Name:       websec.mx\x0D
| \x0D
| Created On:   ...

Obtaining traceroute geolocation information

Nmap can map network paths by tracing the hops between the origin and destination. Geographical information can be useful when tracing events, and we can include it with Nmap's traceroute functionality with some help from the traceroute- geolocation NSE script.

In this recipe, we will use Nmap to obtain the traceroute geolocation information of a remote target.

How to do it...

To obtain the traceroute geolocation information of the intermediary hops, use the following command:
```
# nmap --traceroute --script traceroute-geolocation <target>
```

The remote hops will have geolocation information next to the hostname and IP address in the script output:

Host script results:
| traceroute-geolocation: 
|   HOP  RTT    ADDRESS                          ...

Querying Shodan to obtain target information

Shodan is one of the search engines for internet-connected devices. It is a useful source of information that even includes port and banner information of remote targets, among other bits of interesting data. One of the advantages of passively port scanning with Shodan is that we don't need to communicate directly with the target to obtain the list of open ports, protocols, and service banners.

In this recipe, you will learn how to use Shodan to enumerate services and their versions from remote hosts with Nmap.

Getting ready

The shodan-api NSE script needs an API key before it can be used. Shodan offers free developer API plans that you can obtain by signing up at https://developer.shodan.io/.

Once registered, copy your Shodan API key before continuing.

How to do it...

To obtain host information of a remote target from Shodan, use the following command:
```
$nmap -sn -Pn -n --script shodan-api --script-args shodan...
```

Collecting valid email accounts and IP addresses from web servers

Valid email accounts are useful in penetration testing engagements because they can be used for exploiting trust relationships in phishing attacks, password auditing of mail servers, and as usernames in many different systems.

This recipe illustrates how to find a list of public email accounts with Nmap.

How to do it...

Open your terminal and enter the following command:

$ nmap -p <Web Server Port> --script http-grep <target>

Nmap will crawl the web application and return any interesting information found, including email addresses:

PORT    STATE SERVICE                                                      ...

Discovering hostnames pointing to the same IP address

Web servers return different content depending on the hostname used in the HTTP request host header. By discovering new hostnames, penetration testers can access new target web applications that were inaccessible using the server's IP, thus expanding the attack surface.

This recipe shows how to discover new hostnames pointing to the same IP address.

How to do it...

To discover hostnames pointing to the same IP address, use the following Nmap command:
```
$nmap -sn --script hostmap-* <target>
```
The hostmap-crtsh script returns all records that match the given IP address by querying an external service from https://crt.sh. There were other hostmap scripts that at the moment are broken because of changes in the API, but are expected to work again in the future. If there are records on the public database, they will be included in the results:
```
Host script results:
| hostmap-crtsh: 
|   subdomains...
```

Discovering hostnames by brute-forcing DNS records

DNS records hold a surprising amount of information, and by brute-forcing or guessing them, we can reveal additional targets. DNS entry names often give away information; for example, a DNS record type A named mail indicates that we are dealing with a mail server, or a few years ago Cloudflare's default DNS entry named direct would usually point to the IP address that they were trying to protect.

This recipe shows how to discover DNS records using word lists with Nmap.

How to do it...

To discover new DNS entries, run the following Nmap command:
```
$nmap -sn --script dns-brute <target>
```

DNS entries will be listed for each of the targets:

Host script results:
| dns-brute: 
|   DNS Brute-force hostnames: 
|     ipv6.websec.mx - 104.28.4.21
|     ipv6.websec.mx - 104.28.5.21
|     ipv6.websec.mx - 172.67.129.81
|  ...

Matching services with public vulnerability advisories and picking the low-hanging fruit

Version discovery is essential to penetration testers and system administrators as they can use version banners to find public security vulnerabilities affecting a service. NSE allows us to match popular vulnerability databases with the versions of services obtained from our scan automatically.

This recipe shows how to list public security advisories that could possibly affect a service discovered with Nmap.

How to do it...

To match security advisories with the service versions obtained from the version detection engine, use the following command:
```
# nmap -sV --script vulners <target>
```

The NSE vulners script will return all security advisories that match the service version in the existing database from https://vulners.com:

Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.090s latency).
Other addresses for scanme.nmap.org (not scanned): 2600:3c01::f03c:91ff...

The rest of the chapter is locked

You have been reading a chapter from

Nmap Network Exploration and Security Auditing Cookbook, Third Edition - Third Edition

Published in: Sep 2021Publisher: PacktISBN-13: 9781838649357

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

undefined

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at $15.99/month. Cancel anytime

Author (1)

Paulino Calderon

Paulino Calderon (@calderpwn on Twitter) is the cofounder of Websec, a company offering information security consulting services based in Mexico and Canada. When he is not traveling to a security conference or conducting on-site consulting for Fortune 500 companies, he spends peaceful days in Cozumel, a beautiful small island in the Caribbean, learning new technologies, conducting big data experiments, developing new tools, and finding bugs in software. Paulino is active in the open source community, and his contributions are used by millions of people in the information security industry. In 2011, Paulino joined the Nmap team during the Google Summer of Code to work on the project as an NSE developer. He focused on improving the web scanning capabilities of Nmap, and he has kept contributing to the project since then. In addition, he has been a mentor for students who focused on vulnerability detection during the Google Summer of Code 2015 and 2017. He has published Nmap 6: Network Exploration and Security Auditing Cookbook and Mastering the Nmap Scripting Engine, which cover practical tasks with Nmap and NSE development in depth. He loves attending information security conferences, and he has given talks and participated in workshops in dozens of events in Canada, the United States, Mexico, Colombia, Peru, Bolivia, and Curacao.
Read more about Paulino Calderon

Other recommended products

Related to this chapter

Network Scanning Cookbook

Network Scanning Cookbook enables a reader to understand how to perform a Network Scan, which includes Discovery, Scanning, Enumeration, Vulnerability detection etc using scanning tools like Nessus and Nmap. If the reader is an auditor, they will be able to determine the security state of the client's network and recommend remediations accordingly.

BookSep 2018304 pages

Kali Linux Network Scanning Cookbook

With the ever-increasing amount of data flowing in today’s world, information security has become vital to any application. This is where Kali Linux comes in. Kali Linux focuses mainly on security auditing and penetration testing. This step-by-step cookbook on network scanning trains you in important scanning concepts based on version 2016.2. It will enable you to conquer any network environment through a range of network scanning techniques and will also equip you to script your very own tools.

BookMay 2017634 pages

Metasploit Penetration Testing Cookbook

Metasploit is the world's leading penetration testing tool and helps security and IT professionals find, exploit, and validate vulnerabilities. Metasploit allows penetration testing automation, password auditing, web application scanning, social engineering, post exploitation, evidence collection, and reporting. Metasploit's integration with InsightVM (or Nexpose), Nessus, OpenVas, and other vulnerability scanners provides a validation solution that simplifies vulnerability prioritization and remediation reporting. Teams can collaborate in Metasploit and present their findings in consolidated reports.

BookFeb 2018426 pages

Network Vulnerability Assessment

Being able to identify security loopholes has become critical to many businesses. That's where learning network security assessment becomes very important. This book will not only show you how to find out the system vulnerabilities but also help you build a network security threat model.

BookAug 2018254 pages

Industrial Cybersecurity

With ever-improving and ever-changing cyber threats, businesses need to be on their toes to ensure their safety. This comprehensive book takes you from understanding the basics of cyber security and industrial protocols to building robust industrial control systems. Through real-world scenarios, you will understand vulnerabilities and will be equipped with techniques to ward off all kinds of cyber threat.

BookOct 2017456 pages

Kali Linux 2018: Assuring Security by Penetration Testing

This book is a fully focused, structured book providing guidance on developing practical penetration testing skills by demonstrating cutting-edge hacker tools and techniques. It offers you all of the essential lab preparation and testing procedures that reflect real-world attack scenarios from a business perspective, in today's digital age.

BookOct 2018528 pages

Mastering Python for Networking and Security

Python’s latest updates feature numerous packages that can be used to perform critical missions. This Python networking and security book will help you to use Python packages to detect vulnerabilities in web apps and tackle networking challenges. You’ll explore a variety of techniques and tools for networking and security in Python.

BookJan 2021538 pages

Practical Web Penetration Testing

Web Applications are the core of any business today, and the need for specialized Application Security experts is increasing these days. Using this book, you will be able to learn Application Security testing and understand how to analyze a web application, conduct a web intrusion test, and a network infrastructure test.

BookJun 2018294 pages

Personalised recommendations for you

Based on your interests and search pattern

Designing and Implementing Microsoft Azure Networking Solutions

Designing and Implementing Microsoft Azure Networking Solutions Exam Ref AZ-700 is an all-encompassing guide to the AZ-700 exam and contains all the information you need to succeed in the world of virtual networking with Azure. With this book, you will be fully prepared for the exam and the world of cloud networking.

BookAug 2023524 pages

Microsoft 365 Security, Compliance, and Identity Administration

The Microsoft 365 Security, Compliance, and Identity Administration is a comprehensive guide that helps you employ Microsoft 365's robust suite of features and empowers you to optimize your administrative tasks.

BookAug 2023630 pages

Zero Trust Overview and Playbook Introduction

Get started on Zero Trust with this step-by-step playbook and learn everything you need to know for a successful Zero Trust journey with tailored guidance for every role, covering strategy, operations, architecture, implementation, and measuring success. This book will become an indispensable reference for everyone in your organization.

BookOct 2023240 pages

The Self-Taught Cloud Computing Engineer

This self-study book helps you master multiple clouds, including AWS, Azure, and GCP, and serves as a roadmap to becoming a certified cloud computing expert. The book will guide you to develop a professional cloud career by helping you build a broad cloud knowledge base, developing hands-on cloud computing skills, and getting cloud certified.

BookSep 2023472 pages

Technology Operating Models for Cloud and Edge

This book will help you build and create ownership of a technology operating model, as well as connect your leadership with engineering and operations, keeping your internal and external customers in mind. It provides practical tips on why, where, and how to make the cloud and edge platform paradigm sing for you, your team, and your organization.

BookAug 2023228 pages

Azure Architecture Explained

Azure is the preferred platform to build mission-critical and secure apps. This book provides comprehensive coverage of essential Azure products, services, and solutions vital for every solution architect's success. Elevate your knowledge and master the critical components of Azure to excel in your role with Azure Architecture Explained.

BookSep 2023446 pages

Pentesting Active Directory and Windows-based Infrastructure

This practical guide helps you explore the pentesting of Microsoft infrastructure in detail, and enhances your offensive skillset by showing you the different ways to perform security assessment. This book will help blue teamers and IT engineers get up to speed with possible security issues they may encounter in their Windows environments.

BookNov 2023360 pages

Practical Ansible

In Practical Ansible, you'll work with the latest release of Ansible and learn to solve complex issues quickly with the help of task-oriented scenarios. You'll start by installing and configuring Ansible to automate monotonous and repetitive IT tasks and get to grips with concepts such as playbooks, inventories, plugins, collections, and network modules.

BookSep 2023420 pages

Windows 11 for Enterprise Administrators

Microsoft’s launch of Windows 11 is a step toward satisfying the enterprise administrator’s needs for better management and enhanced user experience customization. This book provides the enterprise administrator with the knowledge needed to fully utilize the advanced feature set of Windows 11 Enterprise.

BookOct 2023286 pages

The Linux DevOps Handbook

This book is for software and IT professionals seeking knowledge on Linux systems and DevOps practices. This book will provide you with guidance and tools to learn and gain proficiency in managing Linux-based infrastructures and knowledge of DevOps.

BookNov 2023428 pages2