128 lines
3.7 KiB
Markdown
128 lines
3.7 KiB
Markdown
# nmap
|
||
|
||
## Scan Types
|
||
* ARP
|
||
* ICMP
|
||
* TCP
|
||
* UDP
|
||
|
||
## Port States
|
||
1. Open
|
||
2. Closed
|
||
3. Filtered
|
||
4. Unfiltered
|
||
5. Open|Filtered
|
||
6. Close|Filtered
|
||
|
||
## Usage
|
||
|
||
```sh
|
||
nmap -oA nmap-full -Pn -sS -T4 -p- --defeat-rst-ratelimit <IP>
|
||
```
|
||
```sh
|
||
nmap -oA nmap-vuln -Pn -script vuln -p <Port,Port,Port,...> <IP>
|
||
```
|
||
|
||
### combo with searchsploit
|
||
* nmap-full scan
|
||
```sh
|
||
sudo nmap -oA --nmap-full -sS -sC -sV -p- --defeat-rst-ratelimit <target-IP>
|
||
searchsploit --nmap ./nmap-full.xml --verbose
|
||
```
|
||
### Wordpress Enumeration
|
||
```sh
|
||
nmap --script http-wordpress-enum --scripts-args check-latest=true,search-limit=1500 -p 80 test.com
|
||
```
|
||
|
||
### Use List of Hosts
|
||
```sh
|
||
nmap -iL <ListofHosts>
|
||
```
|
||
* Show hosts, dns resolution included
|
||
```sh
|
||
nmap -sL -n 10.10.0.0/16
|
||
```
|
||
|
||
### ARP Scan Local Network
|
||
```sh
|
||
nmap -PR -sn 192.168.0.0/24
|
||
```
|
||
### ICMP Scans
|
||
* __Type 8__ (Ping Request)
|
||
```sh
|
||
nmap -PE -sn 10.10.0.0/16
|
||
```
|
||
* __Type 13__ (Timestamp Request)
|
||
```sh
|
||
nmap -PP -sn 10.10.0.0/16
|
||
```
|
||
* __Type 17__ (Address Mask Queries)
|
||
```sh
|
||
nmap -PM -sn 10.10.0.0/16
|
||
```
|
||
|
||
### TCP Scans
|
||
* `-PS23` Syn on port 23
|
||
* `-PA80-8080` ACK on port range 80-8080
|
||
|
||
#### TCP Scan Types
|
||
* __Null Scan__ `-sN`, port is open when there is no response. Otherwise the response is `RST/ACK`
|
||
* __FIN Scan__ `-sF` , same procedure as null scan.
|
||
* __Xmas Scan__ `-sX`, `FIN/PSH/URG` is sent. `RST/ACK` when port is closed.
|
||
* __Maimon Scan__ `-sM`, sends `FIN/ACK`. Packet is dropped when port is open. Only viable on old BSD networks.
|
||
* __ACK Scan__ `-sA`, sends `ACK`. Receives `RST` regardless of the state of the port. May be used to explore firewall rules.
|
||
* __Window Scan__ `-sW`, sends `ACK`, and receives `RST` as well. Inspects the window part of the response. Used to expose firewall rules.
|
||
* __Custom Scan__ `--scanflags RSTACKFIN`, set flags randomly.
|
||
|
||
### UDP SCans
|
||
* `-PU`
|
||
* May be answered by ICMP Type 3 if the port is not reachable
|
||
|
||
### DNS Scan
|
||
* No lookup `-n`
|
||
* Reverse lookup for every host `-R`
|
||
* Host discovery only `-sn`
|
||
|
||
### Spoofing
|
||
* IP `-S <spoofed-IP>`
|
||
* MAC `--spoof-mac <spoofed-MAC>`
|
||
* Disable ping scan `-Pn`
|
||
* Decoy addresses `-D <decoy-IP>,<decoy-IP>,<decoy-IP>,RND,RND,ME`
|
||
|
||
### Service Detection
|
||
* `-sV`
|
||
* `--version-intensity <level 0-9>`
|
||
* Intensity 2 `--version-light`
|
||
* Intensity 9 `--version-all`
|
||
|
||
## Scripts
|
||
Installed at `/usr/share/nmap/scripts`
|
||
* __auth__ Authentication related scripts
|
||
* __broadcast__ Discover hosts by sending broadcast messages
|
||
* __brute__ Performs brute-force password auditing against logins
|
||
* __default__ Default scripts, same as -sC
|
||
* __discovery__ Retrieve accessible information, such as database tables and DNS names
|
||
* __dos Detects__ servers vulnerable to Denial of Service (DoS)
|
||
* __exploit__ Attempts to exploit various vulnerable services
|
||
* __external__ Checks using a third-party service, such as Geoplugin and Virustotal
|
||
* __fuzzer__ Launch fuzzing attacks
|
||
* __intrusive__ Intrusive scripts such as brute-force attacks and exploitation
|
||
* __malware__ Scans for backdoors
|
||
* __safe__ Safe scripts that won’t crash the target
|
||
* __version__ Retrieve service versions
|
||
* __vuln__ Checks for vulnerabilities or exploit vulnerable services
|
||
|
||
## Tips & Tricks
|
||
* Scan the 100 most interesting ports via `-F`
|
||
* `--top-ports 100`
|
||
* One probe every 5 minutes via `-T0`
|
||
* A closed port responds with `RST/ACK` to a initial `SYN`
|
||
* Scan ports iteratively by using `-r`, not random
|
||
* Closed Port
|
||
* Control packet rate via `--min-rate` and `--max-rate`
|
||
* Control parallel probes via `--min-parallelism` and `--max-parallelism`
|
||
* Fragment packets `-f` 8 bytes, `-ff` 16 bytes or `--mtu`
|
||
* Zombie Scan `-sI <pwnd-device-IP>` via pwnd host inside the targets network
|
||
* `--reason`, `-d`, `-vv`
|
||
* `--traceroute`
|