Downloaded 92 times
![Automating ISP Networks Using Ansible and IPAM as a Source of Truth [SoT]](https://cdn.slidesharecdn.com/ss_thumbnails/automatingispnetworksusingansibleandipamasasourceoftruthsot-v25-1-251124105117-d7d4ca24-thumbnail.jpg?width=640&height=640&fit=bounds)
NMAP
- 1. Basics of NMAP By: Prateek Aryan
- 2. What’s NMAP ? ->NMAP is a mapping or a footprinting tool. -> It is used for network exploration. -> NMAP collects information about target host. -> Target can be specified by IP Adress or Domain Name. -> command : nmap 192.168.10.1 or nmap www.google.com
- 3. What’s NMAP ? ->Host / Port / Service Discovery -> OS Version Detection -> Service Version Detection -> Vulnerability and Exploit detection using NSE -> Firewall and spoofing evasions.
- 4. Installing NMAP -> NMAPis available fo all cross platforms. -> In Linux distros we can install it by using sudo apt-get nmap.
- 5.
- 6. Target Specification -> Targetcan be a single host or multiple hosts. nmap 192.168.10.1 nmap 192.168.10.2 192.168.10.3 nmap 192.168.10.1-24 -> any random hosts nmap -iR 5
- 7. Target Specification ->CIDR Notation nmap192.168.10.0/24 - scans 192.168.10.0 -192.168.255 nmap 192.168.10.0/0 - scans whole internet
- 8. Target Specification -> inputfrom file name nmap -iL URL
- 9. Default Scan -> nmap192.168.10.0/24 ->ping phase : pings all the listed ip address. -> port scan phase : If ip address responds to ping i.e host is online then ->nmap scans all the ports of the ip address ( by default it scans 1000 ports ).
- 11.
- 12. Host Discovery -> Oneof the very first steps in any network expolartion mission is to reduce a (sometimes huge) set of IP ranges into a list of active hosts. -> Scanning every port of every single IP address is slow and usually unnecessary. -> Nmap offers a wide variety of options for customizing the techniques used.
- 13. Various Host DiscoveryTechniques -> List Scan ->no port scan -> No ping scan ->TCP SYN Ping -> TCP ACK Ping -> UDP Ping -> Traceroute
- 14. Varios Host DiscoveryTechniques -> ICMP Ping Types -> no dns resolution -> DNS Resolution for all targets
- 15. List Scan -> ListScan nmap -sL 192.168.43.0/24 -> simply lists each host of the network specified. -> it doesnt send any packets to the target hosts. -> does DNS resolution.
- 17. No port scan ->Does’t do port scan after host discovery ->only prints out the available hosts nmap -sn 192.168.10.0/24
- 19. No Ping This optionsskips the Nmap Discovery Stage nmap -Pn 192.168.10.0/24
- 21. TCP SYN Ping ->This option sends an empty TCP packet with the SYN flag set nmap -PS 192.168.10.0/24
- 23. TCP ACK Ping ->This option sends an empty TCP packet with ACK flag set. -> nmap -PA 192.168.10.0/24
- 25. UDP Ping -> Thisoption sends an empty UDP packets to hosts. -> Generally ACK and SYN packets are blocked by firewall. -> This option helps in bypassing firewall. nmap -PU 192.168.10.0/24
- 27. ICMP echo ping ->This options send ICMP echo request to hosts. nmap -PE 192.168.10.0/24
- 29. Other options -> --traceroute Tracespath to host. -> -n No DNS resolution
- 32.
- 33. Port Scanning -> aswe have found online hosts .. our next step will be targeting ports of active hosts. -> there are 65,535 ports -> nmap by default scans 1000 ports -> nmap recognizes ports in 6 states.
- 34. Port Scanning Six statesrezognized by nmap are : ->open ->closed -> filtered ->unfiltered ->open | filered -> close | filtered
- 35. Port Scanning Techniques ->TCP SYN Scan -> TCP ACK Scan -> TCP UDP Scan -> TCP Null Scan
- 36. TCP SYN Scan ->by defaut nmap scans ports by sending TCP packets with syn flag set nmap -sS 192.168.10.1
- 38. TCP ACK Scan ->sends empty TCP Packets with ACK flag set. nmap -sA 192.168.10.1
- 40. TCP UDP Scan ->sends UDP packets to ports nmap -sU 192.168.10.1
- 42. Other options -> -pport numbers We can specify which port we want to scan. -> -F Fast mode. It only scans 100 important ports.
- 43. Version and OSdetection
- 44. Service and versiondetection -> nmap can detect service and version of softwares running at ports of hosts. nmap -sV 192.168.10.1
- 46. OS version detection ->nmap can detect OS version of the host. nmap -O 192.168.10.1
- 48.
- 49. NMAP Script Engine ->TheNmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. -> It allows users to write (and share) simple scripts (using the Lua programming language) to automate a wide variety of networking tasks. -> NMAP also comes with premade scripts ->NSE can even be used for vulnerability exploitation
- 50. What’s a script? -> a script is basically a predefined code written using Lua Programming Language -> this predefined code helps in gathering more information about services running at the ports.
- 51. List of Scripts ->nmapcomes with premade scripts and are stored in the /usr/share/nmap/scripts -> we can list all the premade scripts ls /usr/share/nmap/scripts
- 53. List of scripts ->for different services we have different list of scripts available. -> we can list scripts available for a particular service using grep command. ls /usr/share/nmap/scripts | grep “service_name” -> for example We can list scripts available for http service ls /usr/share/nmap/scripts | grep http
- 55. Script Scanning -> defaultscript scanning : for different services default scripts are set -> when default script is run , nmap scan default scripts of services running at ports. nmap -sC scanme.nmap.org
- 57. Script Scannning nmap --script=”script_name”192.168.10.1 -> example nmap --script=http-brute.nse scanme.nmap.org //multiple scripts nmap -script=http-traceroute.nse,http-brute.nse scanme.nmap.org
- 60.
- 68.
- 69. OUTPUT -> we cansave our scan results in an output file. -> nmap -oN file_name 192.168.10.1 Outputs to given file name. -> nmap -oX file_name 192.168.10.1 -> XML Output to given file name.
- 70.
- 71. Miscellaneous Options -> verbosescanning Print more information about the scan in progress nmap -v 192.168.10.1 -> aggressive scanning Enables OS (-O) and service detection(-sV) , traceroute(-- traceroute), scriptscanning (-sC) . nmap -A 192.168.10.1
- 72.