Nmap Command for Penetration testing (II.)

In the "Nmap Command for penetration test (i)" In this blog post, has already introduced the NMAP command Common option has the basic use method, Next tells the Namp some other scans.

5. Other Scan 5.1 syn scan

Use the -sS option to launch a fully developed scan of our virtual machine Ubuntu (192.168.50.12). The results are as follows:
　　
The results show that at least 192.168.50.12 hosts have at least 3 ports open, to ensure that the target network is scanned with different types of scans, otherwise the loss of important information may result in a significant difference in test results.

5.2 Null Scan

Select the null scan, and then look at the results:
　　
As a result, we were disappointed that all the ports were in the open/filtered state. We can guess that the target host has a firewall installed, and from the results we are unable to obtain valid information.
　　Note : Ubuntu can use UFW to manage host-based iptables firewalls. This firewall is easy to configure and very stable.
　　$ sudo ufw enable #开启防火墙
　　 $ sudo ufw disable #关闭防火墙
　　
If we turn off the firewall of the test target host, the result is as follows:
　　
From the results, the null scan will also scan the results, only labeled open/filtered.

5.3 Ack Scan

In the case of a firewall, we do not get valid information from a NULL scan, and now we do an ACK scan.
　　
Still not scanned for valid information, in order to test the ACK scan and null scan, we add a setting that configures the HTTPS service on the target host and adds a rule to the firewall, allowing HTTPS access, i.e. open 443 port. (commands can be executed on Ubuntu sudo ufw allow 443 .) ）
The null scan remains the result, and no valid information is scanned. However, when you perform an ACK scan, the results are different.
　　
From the scan results, there was a 443 port that was not filtered out.

Summary

Using different scan types may result in different results and should be taken into consideration. Ideally, you want to do the most discreet scanning, depending on the results and the information gathered to proceed to the next step.
　　

Nmap Command for Penetration testing (II.)