Slide 1

Ana Chanaba
Robert Huylo
nmap “network mapper”
Security tool
- What does your system look like to someone
who is trying to break in
- Find the holes in your security before somebody
else does
nmapFE v3.81
- graphical frontend to nmap
- rpm available at
- lab102 & lab103
Basic nmap functions
1.) Host Discovery
- Which hosts are up (IP Addresses)
- Ping scans
2.) Port Scanning
- Which ports of a target host have servers
listening on them
- Allows a guess of software and services a
machine is running
3.) OS Detection
- TCP/IP fingerprinting
Anatomy of nmap argument
nmap –sS -PO -O -p 1-1024 134.198.161.*
-s_ : Scan type
-P_ : Ping type
-O : Optional OS detection
-p #-# : port range
IP range:,
1.) Host Discovery
Determine which hosts are up
- Does not include port scans or OS detection
nmap –sP 134.198.161.*
- Utilizes variety of messaging protocols
Firewall interference
- Firewalls check to see if packets are part of a
previously established connection
Used before portscan
- Ping sweep (-sP)
- Check to see if host is up before scanning ports
Customizing Pings
-PP : ICMP timestamp
-PM : Netmask request
-PB : (default) TCP ACK & ICMP
Ping specific ports:
nmap –sP –PO25 ….
2.) Port Scanning
Insight to what services a host may be
“Well-known” or “Interesting” ports
- 1-1024
- 65,535 total TCP & UDP ports
Scan displays (for each port)
Service name
Port number
Port State
Scanning Options
nmap –sS …
- TCP SYN scan
- default port scan for nmap user with root
- “half-open” – skips last step of 3-way
handshake and probes without actual connection
for stealth
nmap –sT …
- TCP connect() scan
- default port scan for default nmap user
- requires full connection – easily detectable
Port States
open: will accept connections
filtered: firewall or other network
obstacle is covering port
unfiltered or closed: determined to
be closed with no obstacles or
- most common case
Scanning Options
Avoid SYN scanning to probe beyond firewall
-sF : Stealth FIN scan
-sX : Xmas tree scan
-sN : Null scan
-sV : Version detection
-sU : UDP scan
-sI : Idlescan
-sA : ACK scan
-b : bounce attack (FTP)
3.) OS Detection
nmap –O …
TCP/IP fingerprinting
OS guess made by looking at the particulars of how a host
implements TCP/IP
- Includes possible range of versions and “uptime” test
Fingerprint compared to DB of known OS fingerprints
Nmap sends seven TCP/IP crafted packets (called tests)
and waits for the answer. Results are checked against a
database of known results (OS signatures database).
This database is a text file that contains the result
answered (signature) by each OS known.
OS Detection
Reasons to hide OS
Security: Hacker could base an attack on a host from
known weaknesses in the target OS
Revealing your OS makes things easier to find
and successfully run an exploit against any of
your devices.
Knowing your OS can also become more
dangerous, because people can guess which
applications are you running in that OS
It could be convenient for other software
companies, to offer you a new OS environment
OS Detection
Many techniques to fingerprint
networking stacks. If you combine
enough of these. You can narrow
down the OS very tightly.
You can start out as simply as
"nmap -O -sS targethost".
OS Detection
-O requires root privileges, it uses
this information to create a
fingerprint, and decide what type of
system you are scanning.
OS detection is far more effective if
at least one open and one close TCP
port are found.
Miscellaneous options
-A which turn on OS detection too.
-F tells nmap to scan only ports
registered in nmap-services.
-T4 causes nmap to go faster.
-I gives the username that owns
available processes
-iR Use this command to instruct
nmap to scan random hosts for you.
Misc. Options
-v verbose This is a highly recommended option and
it gives out more information. You can use it twice
for better effects.
-d debug mode
-p : port range,
what ports you want to specify
-T : scan timing or throttling options
- Addresses concerns about detection and crashing
nmap -0
nmap -A -T4 -F
nmap -A -T4
RPC services are treated with brute
force. RPC scanner to determine
nmap -sS -p 80 -O -v
nmap & nmapFE man pages
Text Chp 21.7

similar documents