Nmap

From Grayhat cheatsheets
Jump to navigationJump to search

Nmap is the most popular port scanner. Next are described some common uses:

Standard scan on a single IP:

nmap 192.168.0.200

Scan an IP range, equivalent to a ping sweep, to discover which hosts are up (-sn = "Sweep Network"):

nmap -sn 192.168.0.200-250

Standard scan on a single IP, with greppable output, sent to a text file:

nmap -v -sn 192.168.1.200-250 -oG ping-sweep.txt

Look for hosts with port 80 open in a range of IPs, and send result to a text file:

nmap -p 80 192.168.1.100-200 -oG web-sweep.txt

Scan the 20 most common ports in a range of IPs, and use a connect() scan (-sT = TCP connect scan, which uses higher level packets, if SYN cannot be used):

nmap -sT -A --top-ports=20 192.168.1.200-250

Scan all ports:

nmap -p- 192.168.1.100

Scan a host and identify services running on the 1000 most common ports (-sV = services):

nmap -sV -sT 10.0.0.19

Scan the 1000 most common ports of a host and try to detect its OS (-O = OS discovery):

nmap 192.168.1.200 -O

Exhaustive analysis of a host (-A = detailed scan, OS, version, scripts and traceroute):

nmap 192.168.1.200 -A

Scan UDP port 161 in a range of IPs and save the open ports to a file (-sU = scan UDP ports):

nmap -sU --open -p 161 192.168.1.132-140 -oG mega-snmp.txt

Can help if some hosts are not up in a network sweep (--unprivileged):

nmap 192.168.1.0/24 -sP --unprivileged

Nmap allows timing options. Going faster is more supicious. Faster scans are achieved with the options -T4 and -T5, as opposed to slower scans with -T0 or -T1. The latter are super slow, only for paranoic users.

nmap -T5 192.168.1.200

Nmap scripting engine. Edit

Scripts are located in /usr/share/nmap/scripts

Run default scripts agains a host (-sC = default scripts):

nmap -sC 192.168.1.200

Run non intrusive scripts against a host.

nmap --script safe 192.168.1.200

Run vulnerability detecting scripts against a host.

nmap --script vuln 192.168.1.200

Run all relevant scripts against a host. Can be very slow and "noisy"

nmap --script all 192.168.1.200

Examples of specific scripts:

Scan a host and use SMB OS discovery script (--script = use specified script):

nmap 10.0.0.19 -p 139,445 -­-script smb-­os-­discovery.nse

Detect users using SMB:

nmap -p 139, 145 --script smb-enum-users 192.168.1.200

Check for known SMB vulnerabilities_

nmap -p 139,445 --script=smb-check-vulns --script-args=unsafe=1 192.168.1.200

Zone transfer against hosts running a DNS server:

nmap --script=dns-zone-­transfer -p 53 ns2.example.com

Script against a Coldfusion server to try to get admin password using directory traversal:

nmap -v -p 80 --script=http-vuln-cve2010-2861 192.168.1.139

Script to check if FTP server allows anonymous login:

nmap -v -p 21 --script=ftp-anon.nse 192.168.1.130-140