Prerequisite: IP, ICMP, IPv4, IPv6, TCP, UDP, TCP_IP_3_way_handshake
nmap is predominantly used for network mapping and diagnostics.
Linux> Netstat -antp
Windows> Netstat -ano
Port scanning using nmap.
Use Stealth scan to avoid getting detected. Use TCP scan in verification.
Use -Pn to avoid sending ping to system and clarify nmap not to verify if host is up or not.
Use -p- to scan all possible port range.
Use timing templates to adjust scan duration and avoid detection.
Once all open ports are identified, we can move on to service version and OS detection.
Use nmap to gather information regarding service versions and OS of machine. After detecting active machines, its better to perform OS detection before port detection so you target specific ports. After detecting open ports , perform service version detection on found open port.
Use -sV for version detection on open ports. Provide open ports number to perform scan faster.
Use -O for detection of host operating system. Use ‘–osscan-guess’ to get more info if nmap is not giving proper output.
Use -sC for running nmap scripts for further enumeration
Read nmap and Nmap Documentation.
If pings are blocked or scans are getting timeout, that indicates presence of firewall , IDS or other security measures. To avoid getting detected we can apply few methods.
Using -f and --mtu option in nmap to sent fragmented packets and set custom MTU ( Maximum Transmission Unit ).
We can set decoy IPs to avoid repeating or revealing our own IP address. We need to have either network logs or access to decoy machines to fetch response. We can use -D flag in nmap to set multiple decoy IPs.
We can also spoof port number from our end to evade firewall blocking request from repeative port number. We can use -g option in nmap to spoof port number.
In some circumstances, Nmap may not be able to determine your source address. In this situation, use -S with the IP address of the interface you wish to send packets through. This is replace spoofed IP in place of actual.
Optimizing Nmap scan is also important as getting result in short time while creating less traceable traffic is necessary. We should use timing template to red
We can use --host-timeout 5s to reduce timeout value. We can also delay scan to avoid flooding systems with --scan-delay.