Instructor: Nmap discovery scans. 2 2
In this lesson, we're going to start our coverage of Nmap, 3 3
which is the world's most popular enumeration tool. 4 4
Now, Nmap comes to us from the Nmap Project, 5 5
which is an open source project that developed this tool 6 6
and all the supporting resources that come with it. 7 7
When we talk about Nmap, 8 8
we're talking about the Nmap Security Scanner. 9 9
It is a versatile port scanner 10 10
that's used for topology, host, service 11 11
and operating system discovery and enumeration. 12 12
Now, in this lesson specifically, 13 13
we're going to talk about discovery scans, 14 14
and an Nmap discovery scan is used to footprint the network. 15 15
So if you remember our last lesson, 16 16
we talked about footprinting. 17 17
This is the big overview. 18 18
We want to figure out what hosts are sitting on this network. 19 19
We want to figure out what this network looks like 20 20
from a topology standpoint, and that would include things 21 21
like IP addresses and things of that nature. 22 22
Now, when we start talking about Nmap, if you want to use it 23 23
in its most basic form, it's really easy. 24 24
You just type in Nmap, the IP address you want to scan 25 25
or nmap and the IP range you want to scan. 26 26
For instance, if I type nmap 192.168.1.0/24, 27 27
that's going to scan all 256 IPs in that range. 28 28
Now, when you use Nmap in this basic syntax, 29 29
this is the default configuration. 30 30
It's going to have its default behavior being used 31 31
and that default behavior is to ping 32 32
and send a TCP acknowledgement packet to ports 80 and 443. 33 33
This will determine 34 34
whether a host is there and whether it's present. 35 35
If that host is there and detected, 36 36
Nmap will then perform a port scan against that host 37 37
to determine which services it's actually running 38 38
across the 1,000 most commonly used ports. 39 39
Now, this port scanning can be time consuming 40 40
because there's 1,000 ports it's checking, 41 41
and if you have a very large range, 42 42
this can take a lot of time. 43 43
The other thing about using Nmap 44 44
in this default configuration is it is not very stealthy. 45 45
Most of your intrusion detection systems 46 46
or intrusion prevention systems 47 47
or firewalls will see this activity 48 48
as scanning and they will try to block it. 49 49
And so you need to make sure 50 50
that you know all the different ways to use Nmap 51 51
so you're not being blocked by these network devices. 52 52
And that brings us into another way of doing things, 53 53
which is what's called a host discovery scan. 54 54
Now, a host discovery scan uses the flag -sn. 55 55
This is what tells us we want to do a host discovery scan 56 56
instead of using the default procedures. 57 57
If you only want to perform the host discovery part 58 58
and not that port scan, 59 59
you can use nmap -sn, and then the IP range. 60 60
This will suppress that 1,000 port scan that I talked about 61 61
using the basic syntax, using that default behavior. 62 62
Now, there are lots of other scanning options 63 63
that you can utilize when using nmap, 64 64
and they all rely on these things known as switches. 65 65
That is that -sn that I just showed you 66 66
but there's lots of different options as well. 67 67
For instance, you might have a list scan, which is -sL 68 68
and this will list the IP addresses 69 69
from the supplied target range 70 70
and it'll perform a reverse DNS query 71 71
to discover any host names associated with those IPs. 72 72
So think about this as a DNS lookup. 73 73
That's essentially what we're doing here 74 74
when we're doing a list scan. 75 75
Now, the list scan is considered more 76 76
of a passive method 77 77
because you're not actually sending probes directed 78 78
at the host. 79 79
Instead, you're taking their IP range 80 80
and you're asking the DNS server 81 81
to do those reverse lookups for you, 82 82
so you're never really touching the host themself. 83 83
Now, another option you can use is what's known as -PS 84 84
and this is a TCP SYN ping. 85 85
Now, what this does is it's going to probe 86 86
all the specific ports that you list in the command 87 87
and it's going to do this using a TCP SYN packet. 88 88
This is really helpful 89 89
because some networks are going to block ICMP packets 90 90
from being used for ping, 91 91
and if you try to ping something using the ping command, 92 92
it's going to come back as host not found or no response 93 93
but by using something like -PS here, 94 94
you can actually use a SYN packet to conduct that 95 95
because when you send a SYN packet to somebody, 96 96
they are going to send back a SYN/ACK and then normally, 97 97
you'd send back an acknowledgement request 98 98
as an ACK packet 99 99
and that would finish the three-way handshake. 100 100
Well, here what we're going to do is send out the SYN, 101 101
we're going to get back the SYN/ACK 102 102
and that tells us that host is alive 103 103
and then we're not going to finish the three-way handshake. 104 104
We're not going to send back the acknowledgement 105 105
and that way, it's less information that can go 106 106
towards that host to figure out who we are. 107 107
Now, the next one we want to talk about 108 108
is using sparse scanning. 109 109
Now again, if you want to be more stealthy 110 110
and you don't want to do a ping sweep 111 111
or a port scan really quickly, 112 112
you can actually spread out your timing. 113 113
And if I do it over a long period of time, 114 114
that can make it harder for detection to occur. 115 115
So what we do is we use --scan-delay 116 116
and the amount of time we want to wait. 117 117
This this'll issue probes 118 118
with significant delays to become much more stealthy 119 119
and avoid detection by an IDS or an IPS. 120 120
The next one we want to talk about is scan timing 121 121
and this uses the flag -Tn. 122 122
This is going to issue probes when using a timing pattern, 123 123
with that n being the timing pattern you want to utilize. 124 124
If you use a zero, that's going to be the slowest. 125 125
If you use a five, that's going to be the fastest. 126 126
If you use a three, it's somewhere in the middle. 127 127
The idea here again is to try to evade detection 128 128
by an IDS, IPS or firewall. 129 129
The next flag we're going to talk about is dash -si, 130 130
which is used for a TCP idle scan. 131 131
This is another stealthy method 132 132
and this is going to allow the scan to make it appear 133 133
like it's coming from another machine, 134 134
which we'll call a zombie. 135 135
Now, this is going to allow that machine to pretend 136 136
like it started the scan to hide the true identity 137 137
of the scanning machine. 138 138
Essentially, it's a redirection. 139 139
We're trying to throw the defenders off our tail 140 140
and be a little bit more stealthy as we go. 141 141
The next thing we can use is fragmentation 142 142
and this can be done using either of two flags, 143 143
either -f or --mtu. 144 144
This is a technique that splits that TCP header 145 145
of each probe being sent through multiple IP datagrams 146 146
and this will make it harder for an IDS 147 147
or IPS to detect you. 148 148
Notice a trend here. 149 149
The last couple of things we've talked about 150 150
were all about trying to be more stealthy 151 151
so we can't be detected as an attacker. 152 152
Now, the results of a discovery scan should be a list 153 153
of IP addresses and whatever they responded to 154 154
in regards to the probes. 155 155
It'll look something like this. 156 156
Notice here I have nmap -a -T4 scanme.nmap.org. 157 157
Notice that -T4. Which type of scan was that? 158 158
That's right, it's a scan timing type of scan. 159 159
We're using -Tn, which tells us in this case, -T4, 160 160
which means it's pretty darn fast. 161 161
It's not the fastest, but it's pretty fast. 162 162
Now, notice the results here. 163 163
You'll see that we had two clients that were scanned. 164 164
We had scanme.nmap.org, and dose. 165 165
Once we scanned those, we got a response from them 166 166
and they showed us what interesting packets there were. 167 167
And this is giving us more information. 168 168
We'll talk more about these port states 169 169
and the different services and versions in a later lesson 170 170
as we go through and learn more about Nmap. 171 171
Now, another thing you got to think about 172 172
is the way output is given to you in Nmap. 173 173
For instance, this output you're seeing right now 174 174
is displayed to the screen, 175 175
and this is what is known as interactive. 176 176
This is the default setting. 177 177
Whenever you run a command, by default, it will display it 178 178
to the screen, but you don't have to do that. 179 179
You can actually send data to a file as well. 180 180
You can do this in a normal method 181 181
using the dash -oN command. 182 182
This flag will say take what I saw on the screen 183 183
and instead of putting it on the screen, put it in a file. 184 184
You also can use XML using -oX 185 185
and this will put it in an XML format to a file 186 186
or you can use something that is grepable using -oG. 187 187
This will allow a grepable format being sent to a file 188 188
that you can later then use grep upon to find information. 189 189
This is really helpful if you have really large datasets. 190 190
Now, all of these things can be looked at by a human 191 191
but XML in grepable output are much more useful 192 192
if you're trying to integrate them in 193 193
with most of your SIEM products. 194 194
This allows you to take that information 195 195
from those scans and put it into your SIEM database 196 196
so you can correlate that with other information. 197 197
And this is much more useful 198 198
to you as a cybersecurity analyst. 199 199
Now, let me give you a quick exam tip for the CySA+ exam. 200 200
Now, you don't have to become an expert on Nmap. 201 201
I know I covered a lot of different flags here. 202 202
You don't have to memorize them all, but if you go 203 203
into PenTest+, you will have to learn all these things 204 204
and you're going to have to be very comfortable 205 205
with scanning networks and hosts using Nmap. 206 206
It is a listed objective inside of the PenTest+ exam 207 207
and they go into a lot of depth 208 208
and all the different flags. 209 209
Here in CySA, you really just need to understand the concept 210 210
of Nmap and what you use it for. 211 211
As an analyst in the real world though, 212 212
you are going to use Nmap a lot to do your job. 213 213
So spending some time and getting comfortable 214 214
with some basic Nmap information is very critical 215 215
and that's why we're going to spend quite a bit 216 216
of time on it in this course.