1 / 19

nmap

nmap. Fyodor <fyodor@dhp.com> ( www.insecure.org ) Network Mapper Port scanner OS fingerprinter Scans a particular target for all open ports Very invasive and very powerful. nmap Uses. Network exploration tool and port scanner Security audits Network inventory Upgrade schedules

aletta
Download Presentation

nmap

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. nmap • Fyodor <fyodor@dhp.com> (www.insecure.org) • Network Mapper • Port scanner • OS fingerprinter • Scans a particular target for all open ports • Very invasive and very powerful

  2. nmap Uses • Network exploration tool and port scanner • Security audits • Network inventory • Upgrade schedules • Monitoring host/service uptime

  3. Example nmap Scan # nmap -A -T4 scanme.nmap.org playground Starting nmap ( http://www.insecure.org/nmap/ ) Interesting ports on scanme.nmap.org (205.217.153.62): (The 1663 ports scanned but not shown below are in state: filtered) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99) 53/tcp open domain 70/tcp closed gopher 80/tcp open http Apache httpd 2.0.52 ((Fedora)) 113/tcp closed auth Device type: general purpose Running: Linux 2.4.X|2.5.X|2.6.X OS details: Linux 2.4.7 - 2.6.11, Linux 2.6.0 - 2.6.11 Uptime 33.908 days (since Thu Jul 21 03:38:03 2005) Interesting ports on playground.nmap.org (192.168.0.40): (The 1659 ports scanned but not shown below are in state: closed) PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn 389/tcp open ldap? 445/tcp open microsoft-ds Microsoft Windows XP microsoft-ds 1002/tcp open windows-icfw? 1025/tcp open msrpc Microsoft Windows RPC 1720/tcp open H.323/Q.931 CompTek AquaGateKeeper 5800/tcp open vnc-http RealVNC 4.0 (Resolution 400x250; VNC TCP port: 5900) 5900/tcp open vnc VNC (protocol 3.8) MAC Address: 00:A0:CC:63:85:4B (Lite-on Communications) Device type: general purpose Running: Microsoft Windows NT/2K/XP OS details: Microsoft Windows XP Pro RC1+ through final release Service Info: OSs: Windows, Windows XP Nmap finished: 2 IP addresses (2 hosts up) scanned in 88.392 seconds

  4. nmap Options Summary and Syntax # nmap Usage: nmap [Scan Type(s)] [Options] {target specification} TARGET SPECIFICATION: Can pass hostnames, IP addresses, networks, etc. Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254 -Nmap 3.95 ( http://www.insecure.org/nmap/ ) iL <inputfilename>: Input from list of hosts/networks -iR <num hosts>: Choose random targets --exclude <host1[,host2][,host3],...>: Exclude hosts/networks --excludefile <exclude_file>: Exclude list from file HOST DISCOVERY: -sL: List Scan - simply list targets to scan -sP: Ping Scan - go no further than determining if host is online -P0: Treat all hosts as online -- skip host discovery -PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery to given ports -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes -n/-R: Never do DNS resolution/Always resolve [default: sometimes] SCAN TECHNIQUES: -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans -sN/sF/sX: TCP Null, FIN, and Xmas scans --scanflags <flags>: Customize TCP scan flags -sI <zombie host[:probeport]>: Idlescan -sO: IP protocol scan -b <ftp relay host>: FTP bounce scan PORT SPECIFICATION AND SCAN ORDER: -p <port ranges>: Only scan specified ports Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080 -F: Fast - Scan only the ports listed in the nmap-services file) -r: Scan ports consecutively - don't randomize

  5. nmap Syntax (cont) SERVICE/VERSION DETECTION: -sV: Probe open ports to determine service/version info --version_light: Limit to most likely probes for faster identification --version_all: Try every single probe for version detection --version_trace: Show detailed version scan activity (for debugging) OS DETECTION: -O: Enable OS detection --osscan_limit: Limit OS detection to promising targets --osscan_guess: Guess OS more aggressively TIMING AND PERFORMANCE: -T[0-5]: Set timing template (higher is faster) --min_hostgroup/max_hostgroup <msec>: Parallel host scan group sizes --min_parallelism/max_parallelism <msec>: Probe parallelization --min_rtt_timeout/max_rtt_timeout/initial_rtt_timeout <msec>: Specifies probe round trip time. --host_timeout <msec>: Give up on target after this long --scan_delay/--max_scan_delay <msec>: Adjust delay between probes FIREWALL/IDS EVASION AND SPOOFING: -f; --mtu <val>: fragment packets (optionally w/given MTU) -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys -S <IP_Address>: Spoof source address -e <iface>: Use specified interface -g/--source_port <portnum>: Use given port number --data_length <num>: Append random data to sent packets --ttl <val>: Set IP time-to-live field --spoof_mac <mac address/prefix/vendor name>: Spoof your MAC address

  6. nmap Syntax (cont) OUTPUT: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, and Grepable format, respectively, to the given filename. -oA <basename>: Output in the three major formats at once -v: Increase verbosity level (use twice for more effect) -d[level]: Set or increase debugging level (Up to 9 is meaningful) --packet_trace: Show all packets sent and received --iflist: Print host interfaces and routes (for debugging) --append_output: Append to rather than clobber specified output files --resume <filename>: Resume an aborted scan --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML --webxml: Reference stylesheet from Insecure.Org for more portable XML --no_stylesheet: Prevent associating of XSL stylesheet w/XML output MISC: -6: Enable IPv6 scanning -A: Enables OS detection and Version detection --datadir <dirname>: Specify custom Nmap data file location --send_eth/--send_ip: Send using raw ethernet frames or IP packets --privileged: Assume that the user is fully privileged -V: Print version number -h: Print this help summary page. EXAMPLES: nmap -v -A scanme.nmap.org nmap -v -sP 192.168.0.0/16 10.0.0.0/8 nmap -v -iR 10000 -P0 -p 80 SEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES

  7. Target Specification • 192.168.10.0/24 198.168.10.97/16 • 192.168.0-255.0/8 better 192.168.0-255.1-254 • 0-155.0-255.13.37 • Internet wide scan of all addresses ending in 13.37 • scanme.nmap.org/8 • Some available options: • iL <input_file_name> (Addresses from list) • iR <num hosts> (Choose random targets) • -excludefile <exclude_file>

  8. Host Discovery • Reduce the number of hosts on a network to be scanned • Specify how each host is to be identified as interesting • Firewall considerations • Default: Each requested IP address • Attempt – TCP ACK to port 80 • Attempt – ICMP Echo Request

  9. Host Discovery • Some available host discovery options: • sL (List Scan) • sP (Ping Scan) • Use only pings to scan the IP addresses specified • Prints all host responding to a ping • P0 (No Ping) • PS [port list] (TCP SYN Ping Scan) • TCP SYN Packet sent to port 80 for every IP • Else to every port in the list • PA [port list] (TCP ACK Ping Scan) • PU [port list] (UDP Ping Scan) • PE; -PP; -PM (ICMP Ping Scan) • PR (ARP Ping Scan)

  10. Port Scanning Basics • nmap scans more than 1660 ports • Most port scanners list ports as opened or closed • nmap recognizes 6 port states • Open • Accepting TCP connections or UDP packets • Closed • Host is up on the IP address • Accessible but no app is listening • Try later

  11. Port Scanning Basics • nmap recognizes 6 port states (cont’d) • Filtered • No response from probe • Firewall probably did a stealth drop • Forces nmap to retry many times • Unfiltered • Port is accessible but not whether open or closed • Used in mapping firewall rulesets • Try Window scan, SYN scan, FIN scan

  12. Port Scanning Basics • nmap recognizes 6 port states (cont’d) • open|filtered • When unable to determine whether port is open of filtered • closed|filtered • When unable to determine whether port is closed or filtered

  13. Port Scanning Techniques • Only one scan technique can be used at a time • Usually must have root privilege • Some available scan techniques: • sS (TCP SYN scan) • Default • Half-open scanning • The open request is never completed • sT (TCP connect() scan) • A full TCP connection is attempted • Firewalls tend to block incomplete TCP connect attempts • The scan control is handed over to the OS.

  14. Port Scanning Techniques (cont’d) • Some additional available scan techniques: • sU (UDP scan) • Picks up services like DNS, SNMP, DHCP • A UDP packet is sent with no data to all targeted ports • ICMP: port unreachable --> port is closed • ICMP: 3 code: 1,2,9,10 or 13 --> port is filtered • Responds with a UDP packet --> port is open • No response --> port is open|filtered • sN (TCP null scan) no flags set • sF (TCP FIN scan) only the FIN bit is set • sX (Xmas scan) FIN, PSH, & URG bits are set • RST packet received --> port is closed • No response --> port is open|filtered • ICMP unreachable (1,2,3,9,10,13) --> port is filtered

  15. Port Scanning Techniques (cont’d) • Some additional available scan techniques: • sA (TCP ACK scan) • No open ports are discovered • Does determine if the firewall is statefull • Unfiltered systems return a RST packet and labeled unfiltered • Noresponse of ICMP errors are labeled filtered • sW (TCP window scan) • sO (IP protocol scan) • Cycles through all of the IP protocols

  16. Service and Version Detection • Probes discovered ports • nmap-service-probes contains probes for querying options • sV (Version detection)

  17. OS Detection • Uses TCP and UDP scans • Compares to the nmap-os-fingerprints database • o (Enable OS detection) • A (Enable both OS and version detection)

  18. Output • Piles of output • Learn perl and grep • Many formats • oN <filespec> (Normal optput) • oX <filespec (XML output) • v (Increase verbosity level)

  19. Conclusion • nmap • Extremely powerful • Extremely invasive • Extremely obvious if you are not careful • Extremely illegal if not done correctly

More Related