Nmap Cheat Sheet: From exploration to exploit Part1

During the detection process, the initial stage of information collection is scanning.

What is investigation?

Reconnaissance is the collection of information about the target network as much as possible. From a hacker's point of view, information gathering can be very helpful for attacks, which generally collect the following information:

e-mail, port number, operating system, running service, traceroute or DNS information, firewall identification and escape, etc.

Introduction to Nmap

Nmap is a network-side scanning software used to scan Internet computers open Network connections. Determine which services are running on which connections, and infer which operating system the computer is running (this is also known as fingerprinting). It is one of the required software for network administrators and is used to evaluate network system security.

Nmap scripting engine

Nmap scripting engine is the most powerful and flexible feature of nmap. It allows users to write simple scripts that automate a variety of network tasks, basically written in the Lua language. Usually Nmap's scripting engine can do a lot of things, such as:

Network Discovery

This is the basic functionality of NMAP, examples include finding whois information for a target domain name, querying arin,ripe, or apnic on the destination IP, finding open ports, SNMP queries, and listing available NFS/SMB/RPC shares and services.

Vulnerability detection

When a new vulnerability is found, you want to quickly scan the network before intruders to identify vulnerable systems. Although Nmap is not a full-fledged vulnerability scanner, NSE is strong enough to handle harsh vulnerability checks. Many of the vulnerability scripts are available and plan to write more scripts.

Backdoor detection

Many attackers and some automated worms leave the back door for later re-entry. Some of these can be tested by nmap based on regular expressions.

Exploit exploits

As a scripting language, NSE can even exploit exploits, rather than just finding them. This feature of adding custom attack scripts may be valuable to some people (especially penetration testers), but they are not intended to develop nmap into something like the Metasploit framework.

As you can see, I have used the (-SC) option (or-script), which will perform a default script to scan the network. You can see that we get ssh, Rpcbind netbios-sn, but the port is filtered or off, so we can say that there might be some firewalls blocking our request. We'll discuss how to identify firewalls and try to evade them later.

Now I want to find out the mode of running ping scan (-sp–script discovery) so that it will try all possible methods to scan, so I will get more interesting information.

As you can see in the image, it is trying all possible methods based on the rules of the script. For more information, see next image.

Can you see interesting ports and protocols? You can see the Dns-bruteforce Discovery host contains some level two domain names such as blog,cms,sql,log,mail. Here we can execute SQL injection, the blog may be Wordpress,joomla etc., so we can take advantage of the publicly available CMS vulnerability.

Next I'll describe how to write my own Nmap script and call it through Nmap.

Basic Scanning technology

Here I will show the basic techniques for scanning the network/host. But before you do, you should know some basic things about the state of nmap after scanning.

Port status: After scanning, you may see some results, the port status is filtered, turned on, off, and so on. Let me explain this.

Open: This indicates that an application listens for connections on this port.

Off: This indicates that the probe was received, but no application listens on this port.

Filtered: This indicates that the probe was not received and the connection could not be established. It also indicates that the probe is discarded by certain filters.

Unfiltered: This indicates that the probe received but was unable to establish the connection.

Open/filter: This indicates that the port is filtered or opened, but Nmap cannot establish a connection.

Close/filter: This indicates that the port is filtered or closed, but Nmap cannot establish a connection.

Scan a single network

Perform a hostname such as Nmap 192.168.1.1 or www.baidu.com.

Scan multiple networks/destinations

To perform Nmap 192.168.1.1 192.168.1.2, Nmap will scan different IP addresses in the same network segment.

You can also scan multiple websites/domains at the same command at one time. See the picture below. This translates the domain name to its corresponding IP address and scan destination.

Scan successive IP addresses

Command: NMAP 192.168.2.1-192.168.2.100

Nmap can also be used to represent the entire subnet using CIDR (Classless Inter-domain route) notation.

Command: NMAP 192.168.2.1/24

Scan target List

If you have a large number of systems to scan, you can enter the IP address (or host name) in the text file and use that file as input.

Command: Nmap-il [LIST. TXT]

Scan random targets

The-ir parameter can be used to select a random Internet host for scanning. Nmap randomly generates a specified number of targets and attempts to scan them.

Syntax: Nmap-ir [number of hosts]

The-exclude option excludes the host from the scan used for Nmap.

Command: NMAP 192.168.2.1/24-exclude 192.168.2.10

Invasive scanning

The most common option for Nmap is to try to use a simple letter a instead of a long string. It also performs route tracking, and so on.

Command: NMAP-A Host

Explore with Nmap

Using Nmap to explore is very interesting and very helpful for penetration testing. In the discovery process can understand the service, port number, the existence of firewalls, protocols, operating systems, etc., we will be one after another discussion.

Do not ping

The-PN option instructs Nmap to skip the default discovery check and perform a full port scan of the target. This is useful when scanning a host that is protected by a firewall that is blocking ping probes.

Syntax: NMAP-PN target

Ping Scan only

Option-SP let Nmap ping only the host. This is useful when you want to probe a batch of IP addresses which are available. By specifying a specific target, you can get more information, such as a MAC address.

Command: NMAP-SP Target

TCP SYN Scan

Before we get started, we have to know what the SYN packet is.

Basically a SYN packet is used to initiate a connection between two hosts.

The TCP SYN ping sends a SYN packet to the target system and listens for the response. This alternative exploration method is useful for configurations that are configured to block standard ICMP ping message hosts.

The-PS option makes a TCP SYN Ping.

Command: Nmap-ps Host

TCP Ack Ping Scan

This type of scan will only scan for ACK packets.

Option-pa A TCP Ack ping scan of the specified host.

Command: NAMP-PA Target

UDP Ping Scan

Option-P makes a UDP Ack ping scan of the specified host.

SCTP Initializing Ping

Option-py indicates that Nmap performs a SCTP INIT Ping. This option will contain a minimum of SCTP packages for the init block. This exploration method attempts to find a host using the Flow Control Transport Protocol (SCTP). SCTP is typically used for IP-based telephony systems.

Command: Nmap-py Target

ICMP Echo Ping

Option-pe performs an ICMP (Internet Control Message Protocol) Echo Ping to the specified host.

Command: Nmap-pe Target

ICMP Timestamp Ping

Option-pp to perform an ICMP timestamp ping.

Command: NAMP-PP Target

ICMP Address Mask Ping

The-PM option is to ping the ICMP address mask.

Command: NMAP–PM Target

IP Protocol Ping

Option-po perform IP protocol ping scan

Command: NMAP-PO protocol target

A ping to an IP protocol sends packets with the specified protocol target. If no protocol is specified, the default protocol 1 (ICMP), 2 (IGMP), and 4 (IP in IP) are used.

ARP Ping

The option-PR is used to perform an ARP ping scan. The-PR option indicates that Nmap performs an ARP (address Resolution Protocol) Ping operation on the specified target.

Command: NMAP-PR Target

When you scan the local network, the-PR option is automatically enabled silently. This type of discovery is much faster than the other ping methods.

Route tracking

The option-traceroute can be used to track the host specified by the network path.

Syntax: Nmap-traceroute target

Forced Reverse DNS resolution

The option-R indicates that Nmap always performs reverse DNS resolution on the destination IP address.

Syntax: Nmap-r target

Option-r is useful for detecting an IP segment, and NMAP will attempt to query the reverse DNS information for each IP address.

Disable Reverse DNS Resolution

Option-n is used to disable reverse DNS resolution

Command: Nmap-n Target

Reverse DNS resolution can significantly slow down the process of nmap scanning. Using the-n option greatly reduces the scan time, especially when scanning a large number of hosts. This option is useful if you do not care about the DNS information of the target system and are willing to perform a scan to produce faster results.

Select DNS Lookup method

The option-system-dns indicates that NMAP uses the DNS parser that comes with the host system instead of its own internal methods.

Command: Nmap-system-dns Target

Manually specifying a DNS server

The option-dns-servers is used for scanning when manually specifying a DNS server for querying.

Syntax: nmap-dns-server Server1 server2 Target

Option-dns-servers allows you to specify one or more standby servers for Nmap queries, which is useful if you do not have DNS configured, or if you want to prevent your scan from finding a log file system that appears on your locally configured DNS server.

Checklist Scan

The option-SL displays a list and performs a reverse DNS lookup of the specified IP address.

Syntax: NMAP-SL target

In the next article, I'll discuss how to use different methods to discover services, hosts and Banner, and also discuss how and how to use NSE in Nmap to find and evade firewalls, and how to write your own nmap scripts. The most important part of Nmap is knowing how to look for vulnerabilities and try to exploit them. Please pay attention.

Nmap Cheat Sheet: From exploration to exploit Part1