Have you checked your security logs recently only to find some script kiddie in Texas is hammering your server every 5 seconds? Is there a device on your network that responds to ping, but you’re not entirely sure what it is? Do one of your remote users have strange symptoms whilst online and you’d like to see what’s going on?
You can do all this and MUCH MUCH MORE with Insecure.org’s nmap or Network Map tool for Linux and Windows. If you’re a real man, you’ll install the *nix version and leave the Win32 stuff for the kids. Otherwise you can pick up your flinstone phone and sippy cup and download the Nmap executable installer for Windows. If you’re an apple polisher, there’s a DMG for OSX as well. Happy scanning!
Step 1: Install the binaries for your OS
Visit Download the Free Nmap Security Scanner for Linux/Mac/Windows and download your binary of choice, in this How-To we will be using the linux binary, personally, I’m a fan of Ubuntu and Debian for their package system. Use this command to install:
sudo apt-get install nmap
We won’t be using the front end in this document, if you’re lost without a GUI, you can use this command
sudo apt-get install zenmap
This should take care of installation.
Step 2: Simple Scan
To get your hands dirty, let’s try a simple scan of your local IP range. To initiate the most basic, user-level scan type nmap, then the IP range you’d like to scan. Like this:
timg@plethora:~$ nmap 192.168.0.1-254
After running the command, nmap will start a ping sweep on all hosts on 192.168.0.1 through 192.168.0.254, this can be done without root access. You will see several results scroll across your screen that look kind of like this:
Interesting ports on 192.168.0.119:
Not shown: 995 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
5900/tcp open vnc
5901/tcp open vnc-1
6000/tcp open X11
The command you used is just asking what ports are open on the target hosts. If you want detailed information like what OS, the services and their versions running on each port or even if the host is infected or infectable with Conficker, you’ll need to learn some of nmap’s command line switches. Some of these options are offered as easy radio buttons in the graphical front end for nmap (Xenmap/Zenmap), but that won’t make you l33t.
Step 3: Getting More Info
If you want to get some real information out of nmap, you’ll need root permissions on the linux box or be in the sudoers file.
To scan just one host that you know or believe to be windows, you can add several arguments to your nmap scan to find out what’s going on. My favorite general scan is the Stealth Version scan with a few arguments, here it is:
timg@plethora:~$ sudo nmap -sV -vv -PN ip.address
That will use nmap’s stealth version scan instead of the basic ping sweep (-sT or just nmap ip.address) the -vv tells nmap to be very verbose with its output and the -PN switch turns off pinging of the host. You get some more information with that scan, here is a sample from my network:
Interesting ports on test04.primarydc.local (192.168.0.79):
Not shown: 995 closed ports
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn
445/tcp open microsoft-ds Microsoft Windows XP
1151/tcp open msrpc Microsoft Windows RPC
42510/tcp open msrpc Microsoft Windows RPC
MAC Address: 00:24:E8:00:B9:DE (Unknown)
Service Info: OS: Windows
I truncated the data, but that’s a pretty typical result for a Windows XP machine. Using various combinations of these command line switches will help you find out more information about your target.
The above scan is helpful in identifying machines that keep connecting to you or your servers, finding out what services they’re running and on what port could tell you if they’re a zombie or just a bored high school kid.
There is far too much information about nmap to put in one how-to, so this should familiarize you with the scanner if you’ve never used it or haven’t used it much. You can always just type nmap into the command line for a list of arguments and switches to use. Nmap has such advanced features as source IP spoofing, FTP bounce and recently added scripting. You can send packets through firewalls and all sorts of crazy stuff if you just learn a few basic concepts.
I apologize for calling you a little girl for using the GUI version, because using it for a while (The windows version comes with profiles to pick from) will get you familiar with the various arguments. Scan for a while with zenmap, then give it a try through the terminal, it’s a blast.
![\"trinity-nmapscreen-hd-cropscale-418x250.jpg\"](\"https://us1.discourse-cdn.com/spiceworks/original/4X/7/c/5/7c5e0e1aa059a4abee4a5ac39d3c3f1473db8010.jpeg\")
<\/p>\n
