1 1 00:00:00,870 --> 00:00:03,150 Nmap discovery scans. 2 2 00:00:03,150 --> 00:00:06,360 In this lesson, we're going to start our coverage of Nmap, 3 3 00:00:06,360 --> 00:00:09,540 which is the world's most popular enumeration tool. 4 4 00:00:09,540 --> 00:00:12,090 Now, Nmap comes to us from the Nmap Project, 5 5 00:00:12,090 --> 00:00:14,460 which is an open source project that developed this tool 6 6 00:00:14,460 --> 00:00:17,250 and all the supporting resources that come with it. 7 7 00:00:17,250 --> 00:00:18,240 When we talk about Nmap, 8 8 00:00:18,240 --> 00:00:20,520 we're talking about the Nmap Security Scanner. 9 9 00:00:20,520 --> 00:00:22,200 It is a versatile port scanner 10 10 00:00:22,200 --> 00:00:24,990 that's used for topology, host, service 11 11 00:00:24,990 --> 00:00:27,840 and operating system discovery and enumeration. 12 12 00:00:27,840 --> 00:00:29,310 Now, in this lesson specifically, 13 13 00:00:29,310 --> 00:00:31,380 we're going to talk about discovery scans, 14 14 00:00:31,380 --> 00:00:34,740 and an Nmap discovery scan is used to footprint the network. 15 15 00:00:34,740 --> 00:00:35,910 So if you remember our last lesson, 16 16 00:00:35,910 --> 00:00:37,260 we talked about footprinting. 17 17 00:00:37,260 --> 00:00:38,580 This is the big overview. 18 18 00:00:38,580 --> 00:00:41,550 We want to figure out what hosts are sitting on this network. 19 19 00:00:41,550 --> 00:00:43,620 We want to figure out what this network looks like 20 20 00:00:43,620 --> 00:00:46,200 from a topology standpoint, and that would include things 21 21 00:00:46,200 --> 00:00:48,900 like IP addresses and things of that nature. 22 22 00:00:48,900 --> 00:00:51,750 Now, when we start talking about Nmap, if you want to use it 23 23 00:00:51,750 --> 00:00:54,060 in its most basic form, it's really easy. 24 24 00:00:54,060 --> 00:00:57,000 You just type in Nmap, the IP address you want to scan 25 25 00:00:57,000 --> 00:00:59,610 or nmap and the IP range you want to scan. 26 26 00:00:59,610 --> 00:01:03,430 For instance, if I type nmap 192.168.1.0/24, 27 27 00:01:05,340 --> 00:01:09,150 that's going to scan all 256 IPs in that range. 28 28 00:01:09,150 --> 00:01:12,120 Now, when you use Nmap in this basic syntax, 29 29 00:01:12,120 --> 00:01:14,070 this is the default configuration. 30 30 00:01:14,070 --> 00:01:16,440 It's going to have its default behavior being used 31 31 00:01:16,440 --> 00:01:18,240 and that default behavior is to ping 32 32 00:01:18,240 --> 00:01:23,190 and send a TCP acknowledgement packet to ports 80 and 443. 33 33 00:01:23,190 --> 00:01:24,023 This will determine 34 34 00:01:24,023 --> 00:01:26,370 whether a host is there and whether it's present. 35 35 00:01:26,370 --> 00:01:28,380 If that host is there and detected, 36 36 00:01:28,380 --> 00:01:31,170 Nmap will then perform a port scan against that host 37 37 00:01:31,170 --> 00:01:33,630 to determine which services it's actually running 38 38 00:01:33,630 --> 00:01:37,080 across the 1,000 most commonly used ports. 39 39 00:01:37,080 --> 00:01:39,150 Now, this port scanning can be time consuming 40 40 00:01:39,150 --> 00:01:41,220 because there's 1,000 ports it's checking, 41 41 00:01:41,220 --> 00:01:42,870 and if you have a very large range, 42 42 00:01:42,870 --> 00:01:44,880 this can take a lot of time. 43 43 00:01:44,880 --> 00:01:46,200 The other thing about using Nmap 44 44 00:01:46,200 --> 00:01:49,380 in this default configuration is it is not very stealthy. 45 45 00:01:49,380 --> 00:01:51,270 Most of your intrusion detection systems 46 46 00:01:51,270 --> 00:01:52,560 or intrusion prevention systems 47 47 00:01:52,560 --> 00:01:54,720 or firewalls will see this activity 48 48 00:01:54,720 --> 00:01:57,150 as scanning and they will try to block it. 49 49 00:01:57,150 --> 00:01:58,410 And so you need to make sure 50 50 00:01:58,410 --> 00:02:00,480 that you know all the different ways to use Nmap 51 51 00:02:00,480 --> 00:02:03,360 so you're not being blocked by these network devices. 52 52 00:02:03,360 --> 00:02:05,760 And that brings us into another way of doing things, 53 53 00:02:05,760 --> 00:02:08,310 which is what's called a host discovery scan. 54 54 00:02:08,310 --> 00:02:12,750 Now, a host discovery scan uses the flag -sn. 55 55 00:02:12,750 --> 00:02:15,300 This is what tells us we want to do a host discovery scan 56 56 00:02:15,300 --> 00:02:17,610 instead of using the default procedures. 57 57 00:02:17,610 --> 00:02:19,860 If you only want to perform the host discovery part 58 58 00:02:19,860 --> 00:02:21,570 and not that port scan, 59 59 00:02:21,570 --> 00:02:25,890 you can use nmap -sn, and then the IP range. 60 60 00:02:25,890 --> 00:02:28,860 This will suppress that 1,000 port scan that I talked about 61 61 00:02:28,860 --> 00:02:32,070 using the basic syntax, using that default behavior. 62 62 00:02:32,070 --> 00:02:34,290 Now, there are lots of other scanning options 63 63 00:02:34,290 --> 00:02:36,210 that you can utilize when using nmap, 64 64 00:02:36,210 --> 00:02:38,970 and they all rely on these things known as switches. 65 65 00:02:38,970 --> 00:02:41,310 That is that -sn that I just showed you 66 66 00:02:41,310 --> 00:02:43,680 but there's lots of different options as well. 67 67 00:02:43,680 --> 00:02:47,880 For instance, you might have a list scan, which is -sL 68 68 00:02:47,880 --> 00:02:49,560 and this will list the IP addresses 69 69 00:02:49,560 --> 00:02:51,390 from the supplied target range 70 70 00:02:51,390 --> 00:02:53,400 and it'll perform a reverse DNS query 71 71 00:02:53,400 --> 00:02:56,580 to discover any host names associated with those IPs. 72 72 00:02:56,580 --> 00:02:58,890 So think about this as a DNS lookup. 73 73 00:02:58,890 --> 00:03:00,540 That's essentially what we're doing here 74 74 00:03:00,540 --> 00:03:02,340 when we're doing a list scan. 75 75 00:03:02,340 --> 00:03:03,990 Now, the list scan is considered more 76 76 00:03:03,990 --> 00:03:05,250 of a passive method 77 77 00:03:05,250 --> 00:03:07,140 because you're not actually sending probes directed 78 78 00:03:07,140 --> 00:03:08,220 at the host. 79 79 00:03:08,220 --> 00:03:10,350 Instead, you're taking their IP range 80 80 00:03:10,350 --> 00:03:11,790 and you're asking the DNS server 81 81 00:03:11,790 --> 00:03:13,320 to do those reverse lookups for you, 82 82 00:03:13,320 --> 00:03:15,960 so you're never really touching the host themself. 83 83 00:03:15,960 --> 00:03:19,140 Now, another option you can use is what's known as -PS 84 84 00:03:19,140 --> 00:03:21,750 and this is a TCP SYN ping. 85 85 00:03:21,750 --> 00:03:23,580 Now, what this does is it's going to probe 86 86 00:03:23,580 --> 00:03:26,490 all the specific ports that you list in the command 87 87 00:03:26,490 --> 00:03:29,820 and it's going to do this using a TCP SYN packet. 88 88 00:03:29,820 --> 00:03:30,660 This is really helpful 89 89 00:03:30,660 --> 00:03:33,720 because some networks are going to block ICMP packets 90 90 00:03:33,720 --> 00:03:35,130 from being used for ping, 91 91 00:03:35,130 --> 00:03:37,560 and if you try to ping something using the ping command, 92 92 00:03:37,560 --> 00:03:41,190 it's going to come back as host not found or no response 93 93 00:03:41,190 --> 00:03:43,770 but by using something like -PS here, 94 94 00:03:43,770 --> 00:03:45,990 you can actually use a SYN packet to conduct that 95 95 00:03:45,990 --> 00:03:48,150 because when you send a SYN packet to somebody, 96 96 00:03:48,150 --> 00:03:51,330 they are going to send back a SYN/ACK and then normally, 97 97 00:03:51,330 --> 00:03:53,400 you'd send back an acknowledgement request 98 98 00:03:53,400 --> 00:03:54,360 as an ACK packet 99 99 00:03:54,360 --> 00:03:56,430 and that would finish the three-way handshake. 100 100 00:03:56,430 --> 00:03:58,860 Well, here what we're going to do is send out the SYN, 101 101 00:03:58,860 --> 00:04:00,150 we're going to get back the SYN/ACK 102 102 00:04:00,150 --> 00:04:01,770 and that tells us that host is alive 103 103 00:04:01,770 --> 00:04:04,230 and then we're not going to finish the three-way handshake. 104 104 00:04:04,230 --> 00:04:05,820 We're not going to send back the acknowledgement 105 105 00:04:05,820 --> 00:04:08,220 and that way, it's less information that can go 106 106 00:04:08,220 --> 00:04:10,920 towards that host to figure out who we are. 107 107 00:04:10,920 --> 00:04:12,660 Now, the next one we want to talk about 108 108 00:04:12,660 --> 00:04:14,430 is using sparse scanning. 109 109 00:04:14,430 --> 00:04:15,984 Now again, if you want to be more stealthy 110 110 00:04:15,984 --> 00:04:17,760 and you don't want to do a ping sweep 111 111 00:04:17,760 --> 00:04:19,890 or a port scan really quickly, 112 112 00:04:19,890 --> 00:04:21,930 you can actually spread out your timing. 113 113 00:04:21,930 --> 00:04:24,120 And if I do it over a long period of time, 114 114 00:04:24,120 --> 00:04:26,730 that can make it harder for detection to occur. 115 115 00:04:26,730 --> 00:04:30,000 So what we do is we use --scan-delay 116 116 00:04:30,000 --> 00:04:31,800 and the amount of time we want to wait. 117 117 00:04:31,800 --> 00:04:32,730 This this'll issue probes 118 118 00:04:32,730 --> 00:04:35,430 with significant delays to become much more stealthy 119 119 00:04:35,430 --> 00:04:38,670 and avoid detection by an IDS or an IPS. 120 120 00:04:38,670 --> 00:04:41,490 The next one we want to talk about is scan timing 121 121 00:04:41,490 --> 00:04:44,430 and this uses the flag -Tn. 122 122 00:04:44,430 --> 00:04:47,310 This is going to issue probes when using a timing pattern, 123 123 00:04:47,310 --> 00:04:50,040 with that n being the timing pattern you want to utilize. 124 124 00:04:50,040 --> 00:04:52,230 If you use a zero, that's going to be the slowest. 125 125 00:04:52,230 --> 00:04:54,600 If you use a five, that's going to be the fastest. 126 126 00:04:54,600 --> 00:04:56,970 If you use a three, it's somewhere in the middle. 127 127 00:04:56,970 --> 00:04:59,310 The idea here again is to try to evade detection 128 128 00:04:59,310 --> 00:05:01,980 by an IDS, IPS or firewall. 129 129 00:05:01,980 --> 00:05:05,100 The next flag we're going to talk about is dash -si, 130 130 00:05:05,100 --> 00:05:07,860 which is used for a TCP idle scan. 131 131 00:05:07,860 --> 00:05:09,630 This is another stealthy method 132 132 00:05:09,630 --> 00:05:11,430 and this is going to allow the scan to make it appear 133 133 00:05:11,430 --> 00:05:12,870 like it's coming from another machine, 134 134 00:05:12,870 --> 00:05:14,670 which we'll call a zombie. 135 135 00:05:14,670 --> 00:05:16,410 Now, this is going to allow that machine to pretend 136 136 00:05:16,410 --> 00:05:18,840 like it started the scan to hide the true identity 137 137 00:05:18,840 --> 00:05:20,220 of the scanning machine. 138 138 00:05:20,220 --> 00:05:21,720 Essentially, it's a redirection. 139 139 00:05:21,720 --> 00:05:23,970 We're trying to throw the defenders off our tail 140 140 00:05:23,970 --> 00:05:26,370 and be a little bit more stealthy as we go. 141 141 00:05:26,370 --> 00:05:28,650 The next thing we can use is fragmentation 142 142 00:05:28,650 --> 00:05:30,930 and this can be done using either of two flags, 143 143 00:05:30,930 --> 00:05:34,380 either -f or --mtu. 144 144 00:05:34,380 --> 00:05:36,810 This is a technique that splits that TCP header 145 145 00:05:36,810 --> 00:05:40,140 of each probe being sent through multiple IP datagrams 146 146 00:05:40,140 --> 00:05:42,090 and this will make it harder for an IDS 147 147 00:05:42,090 --> 00:05:43,860 or IPS to detect you. 148 148 00:05:43,860 --> 00:05:45,060 Notice a trend here. 149 149 00:05:45,060 --> 00:05:46,560 The last couple of things we've talked about 150 150 00:05:46,560 --> 00:05:48,630 were all about trying to be more stealthy 151 151 00:05:48,630 --> 00:05:51,420 so we can't be detected as an attacker. 152 152 00:05:51,420 --> 00:05:54,150 Now, the results of a discovery scan should be a list 153 153 00:05:54,150 --> 00:05:56,790 of IP addresses and whatever they responded to 154 154 00:05:56,790 --> 00:05:58,440 in regards to the probes. 155 155 00:05:58,440 --> 00:06:00,390 It'll look something like this. 156 156 00:06:00,390 --> 00:06:05,390 Notice here I have nmap -a -T4 scanme.nmap.org. 157 157 00:06:06,720 --> 00:06:10,230 Notice that -T4. Which type of scan was that? 158 158 00:06:10,230 --> 00:06:12,690 That's right, it's a scan timing type of scan. 159 159 00:06:12,690 --> 00:06:16,620 We're using -Tn, which tells us in this case, -T4, 160 160 00:06:16,620 --> 00:06:18,270 which means it's pretty darn fast. 161 161 00:06:18,270 --> 00:06:20,730 It's not the fastest, but it's pretty fast. 162 162 00:06:20,730 --> 00:06:22,290 Now, notice the results here. 163 163 00:06:22,290 --> 00:06:24,630 You'll see that we had two clients that were scanned. 164 164 00:06:24,630 --> 00:06:27,750 We had scanme.nmap.org, and dose. 165 165 00:06:27,750 --> 00:06:30,240 Once we scanned those, we got a response from them 166 166 00:06:30,240 --> 00:06:32,790 and they showed us what interesting packets there were. 167 167 00:06:32,790 --> 00:06:34,380 And this is giving us more information. 168 168 00:06:34,380 --> 00:06:36,180 We'll talk more about these port states 169 169 00:06:36,180 --> 00:06:38,850 and the different services and versions in a later lesson 170 170 00:06:38,850 --> 00:06:41,370 as we go through and learn more about Nmap. 171 171 00:06:41,370 --> 00:06:42,840 Now, another thing you got to think about 172 172 00:06:42,840 --> 00:06:45,630 is the way output is given to you in Nmap. 173 173 00:06:45,630 --> 00:06:48,030 For instance, this output you're seeing right now 174 174 00:06:48,030 --> 00:06:49,380 is displayed to the screen, 175 175 00:06:49,380 --> 00:06:51,600 and this is what is known as interactive. 176 176 00:06:51,600 --> 00:06:53,130 This is the default setting. 177 177 00:06:53,130 --> 00:06:55,620 Whenever you run a command, by default, it will display it 178 178 00:06:55,620 --> 00:06:58,170 to the screen, but you don't have to do that. 179 179 00:06:58,170 --> 00:07:00,600 You can actually send data to a file as well. 180 180 00:07:00,600 --> 00:07:02,190 You can do this in a normal method 181 181 00:07:02,190 --> 00:07:04,590 using the dash -oN command. 182 182 00:07:04,590 --> 00:07:07,500 This flag will say take what I saw on the screen 183 183 00:07:07,500 --> 00:07:10,320 and instead of putting it on the screen, put it in a file. 184 184 00:07:10,320 --> 00:07:13,320 You also can use XML using -oX 185 185 00:07:13,320 --> 00:07:16,020 and this will put it in an XML format to a file 186 186 00:07:16,020 --> 00:07:19,770 or you can use something that is grepable using -oG. 187 187 00:07:19,770 --> 00:07:22,890 This will allow a grepable format being sent to a file 188 188 00:07:22,890 --> 00:07:26,070 that you can later then use grep upon to find information. 189 189 00:07:26,070 --> 00:07:29,190 This is really helpful if you have really large datasets. 190 190 00:07:29,190 --> 00:07:32,550 Now, all of these things can be looked at by a human 191 191 00:07:32,550 --> 00:07:35,940 but XML in grepable output are much more useful 192 192 00:07:35,940 --> 00:07:37,500 if you're trying to integrate them in 193 193 00:07:37,500 --> 00:07:39,420 with most of your SIEM products. 194 194 00:07:39,420 --> 00:07:40,800 This allows you to take that information 195 195 00:07:40,800 --> 00:07:43,680 from those scans and put it into your SIEM database 196 196 00:07:43,680 --> 00:07:45,567 so you can correlate that with other information. 197 197 00:07:45,567 --> 00:07:46,890 And this is much more useful 198 198 00:07:46,890 --> 00:07:49,110 to you as a cybersecurity analyst. 199 199 00:07:49,110 --> 00:07:53,460 Now, let me give you a quick exam tip for the CySA+ exam. 200 200 00:07:53,460 --> 00:07:55,710 Now, you don't have to become an expert on Nmap. 201 201 00:07:55,710 --> 00:07:58,560 I know I covered a lot of different flags here. 202 202 00:07:58,560 --> 00:08:01,260 You don't have to memorize them all, but if you go 203 203 00:08:01,260 --> 00:08:04,200 into PenTest+, you will have to learn all these things 204 204 00:08:04,200 --> 00:08:05,550 and you're going to have to be very comfortable 205 205 00:08:05,550 --> 00:08:08,160 with scanning networks and hosts using Nmap. 206 206 00:08:08,160 --> 00:08:11,430 It is a listed objective inside of the PenTest+ exam 207 207 00:08:11,430 --> 00:08:12,840 and they go into a lot of depth 208 208 00:08:12,840 --> 00:08:14,580 and all the different flags. 209 209 00:08:14,580 --> 00:08:18,180 Here in CySA, you really just need to understand the concept 210 210 00:08:18,180 --> 00:08:20,340 of Nmap and what you use it for. 211 211 00:08:20,340 --> 00:08:22,170 As an analyst in the real world though, 212 212 00:08:22,170 --> 00:08:25,050 you are going to use Nmap a lot to do your job. 213 213 00:08:25,050 --> 00:08:26,880 So spending some time and getting comfortable 214 214 00:08:26,880 --> 00:08:30,000 with some basic Nmap information is very critical 215 215 00:08:30,000 --> 00:08:31,410 and that's why we're going to spend quite a bit 216 216 00:08:31,410 --> 00:08:32,860 of time on it in this course.