Hidden Nmap Capabilities for Pentest and OSINT: Effective Network Scanning

Nmap is a powerful cybersecurity tool that helps you analyze networks and find vulnerabilities. If you’re new to Nmap, this article will be a real godsend for you. We’ll look at 10 useful features that will make your testing more efficient and faster.

Nmap Scripting Engine (NSE): Extending nmap functionality with scripts

Nmap Scripting Engine (NSE) is a powerful tool that significantly extends the standard functionality of Nmap through the use of custom scripts. These scripts, written in Lua, allow you to automate a variety of tasks related to both pentesting and information gathering (OSINT). With NSE, you can perform in-depth network analysis, check for vulnerabilities, and optimize security testing processes.

NSE scripts can be divided into several categories:

1. Discovery: Discovery of additional information about target systems, such as open ports, running services, and applications.

2. Safe: Safe scripts that do not interact directly with target systems, but only analyze the information received.

3. Intrusive: Intrusive scripts that can cause instability or crashes in target systems.

4. Vuln: Scripts that detect vulnerabilities in target systems. They help identify known vulnerabilities and configuration flaws.

5. Auth: Scripts for testing authentication and authorization. These scripts can be used to check password strength, detect weak configurations, and identify opportunities for brute force attacks.

6. Exploit: Scripts to exploit discovered vulnerabilities. These scripts are used to gain unauthorized access to target systems.

7. Malware: Scripts to detect and analyze malicious software.

To run NSE scripts, use the –script option when scanning with Nmap. For example, to run a script to detect vulnerabilities in web servers, you can use the following command:

nmap --script http-vuln* -p 80,443 <target>

This command will execute all scripts with the prefix http-vuln, applying them to the target web server on ports 80 and 443.

Discovering servers that support the SMB protocol

To find servers using SMB (Server Message Block) and also check them for possible vulnerabilities, you can use the following command:

nmap --script smb-vuln* -p 139,445 <target>

This command will run all scripts starting with the prefix smb-vuln against the target server on ports 139 and 445.

nmap --script ssl-heartbleed -p <port> <target>

Here you need to specify the specific port on which the vulnerable service is running (usually 443 HTTPS).

Detecting web applications using WAF (Web Application Firewall): To detect web applications protected by WAF, you can use the following command:

nmap --script http-waf-* -p 80,443 <target>

This command will run all scripts that start with the prefix http-waf against the target web server on ports 80 and 443.

nmap --script http-shellshock -p 80,443 <target>

This command will run the http-shellshock script against the target web server on ports 80 and 443.

The Nmap Scripting Engine provides a flexible and powerful tool for automating and extending the functionality of Nmap, allowing you to effectively solve various IS-related tasks.

Analyzing Operating Systems with Nmap: Determining the OS and its Version

One of the most important features of Nmap is its ability to determine the operating system (OS) and its version on the target device. This information can be used to identify vulnerabilities, plan testing, and adapt attack strategies.

Nmap uses several methods to determine the operating system:

1. TCP/IP stack fingerprinting: Analyzes TCP/IP stack features, such as TTL values, TCP options, and other parameters. These features allow Nmap to make assumptions about the operating system type.

2. Port and protocol scanning: Analyzes open ports and running protocols that may be specific to certain operating systems.

3. Application version: Analyzes the versions of running applications and services that may indicate a specific operating system.

To determine the operating system using Nmap, you can use the following options:

• -O: Enables operating system detection. This option can be used in conjunction with the -v option to increase the verbosity of the output.

• –osscan-limit: Limits the operating system detection to only active hosts for which open ports have been detected. This reduces scan time and the number of false positives.

• –osscan-guess: Shows the most likely operating system, even if the confidence level of the result is below the specified threshold.

Example of using Nmap to determine the operating system:

nmap -O -v --osscan-limit <target>

This command will run the scan with OS detection enabled, limit it to active hosts only, and increase the verbosity of the output.

High-Probability OS Detection

You can use the –osscan-guess option to increase the accuracy of OS detection. This option displays the most likely OS, even if the confidence level of the result is lower than the specified threshold.

nmap -O --osscan-guess <target>

Determining the operating system and kernel version

For more detailed information about the operating system, including the kernel version, you can use the -A option. This option includes determining the operating system, application versions, port scans, and service scans.

nmap -A <target>

Determining the operating system without ping

In some cases, you may need to determine the operating system without sending ICMP packets (ping). You can use the Pn option to do this.

nmap -O -Pn <target>

Determining the operating system using a saved scan result

If you have already performed a port scan and saved the results to a file, you can use that file to determine the operating system without rescanning. To do this, you can use the –osscan-guess option in combination with the -iX option to read the scan results from an XML file.

nmap --osscan-guess -iX <scan_results.xml>

Determining the operating system using the user’s file signature

By default, Nmap uses an operating system signature database that contains information about many popular operating systems. However, if you want to use your own signature file, you can specify it with the –datadir option.

nmap -O --datadir=<custom_signature_file> <target>

These examples demonstrate the flexibility and power of Nmap when analyzing operating systems. Using various options and combinations, you can obtain accurate and detailed information about target systems, which is an important element of pentesting and OSINT.

Nmap Hidden Port Scan: Unique Features of the -sS, -sT, -sA Flags

One of the key features of Nmap is port scanning, which allows you to identify open ports and running services on a target device. When conducting a pentest or intelligence gathering (OSINT), it is important to remain discreet and avoid detection. To do this, Nmap provides several stealth port scanning methods that help minimize the risk of detection.

• SYN scan (-sS): The SYN scan is one of the most popular methods of stealth port scanning. In this method, Nmap sends SYN packets to the target ports but does not complete the full TCP handshake. If the port is open, the target host will send a SYN-ACK packet, and Nmap will complete the scan by sending a RST packet. This scanning method is difficult to detect because it does not establish a full TCP connection.

• Connect scan (-sT): The Connect scan is a more traditional port scanning method in which Nmap establishes a full TCP connection to the target port. This method is less stealthy than the SYN scan, but it can be more reliable when passing through firewalls and security measures.

• ACK scan (-sA): The ACK scan is the most stealthy method of port scanning in which Nmap only sends ACK packets to the target ports. This method does not determine whether a port is open, but it can help detect filtering firewalls and security measures.

Examples of using Nmap’s hidden port scanning methods:

SYN scan: To perform a SYN scan, you can use the following command:

nmap -sS <target>

This command will perform a SYN scan of all 1000 most common ports on the target device.

Connect scan: To perform a Connect scan, you can use the following command:

nmap -sT <target>

This command will perform a Connect scan of all 1000 most common ports on the target device.

ACK scan: To perform an ACK scan, you can use the following command:

nmap -sA <target>

This command will perform an ACK scan of all 1000 most common ports on the target device. As you can see from the results, each method gives a unique conclusion.

Nmap and Services: Identifying Program Versions with the -sV Flag

One of the important tasks during pentesting is to identify the versions of applications and services running on the target device. Knowing the exact versions can help identify vulnerabilities and plan further exploitation actions. Nmap provides a function to identify application versions using the -sV flag.

The -sV flag allows Nmap to scan for versions of applications and services running on open ports. In this case, Nmap sends specially crafted packets and analyzes the target device’s responses, trying to determine which services are running and their versions.

Scan application versions for all open ports

To scan program versions for all open ports, you can use the following command:

nmap -sV <target>

This command will scan the application versions for all open ports on the target device.

Scanning application versions for a specific port

You can use the following command to scan application versions for a specific port:

nmap -sV -p <port> <target>

Replace <port> with the port number for which you want to scan for application versions.

Scan for application versions with increased accuracy

You can use the following command to increase the accuracy of identifying application versions:

nmap -sV --version-all <target>

This command will list all possible versions of applications, not just the most likely one.

Scanning for Application Versions Using a User-Defined Signature File

By default, Nmap uses a database of application signatures that contains information about many known applications and services. However, if you want to use your own signature file, you can specify it with the –datadir option.

nmap -sV --datadir=<custom_signature_file> <target>

Automating Security Testing with Nmap

Nmap is not only a powerful tool for network scanning and information gathering, but also a great tool for automating security testing. With flexible command-line options, scripting support, and integration with other tools, Nmap allows security professionals to automate many routine tasks and improve testing efficiency.

Below are several ways to automate security testing using Nmap:

1. Scripting to automate scans: The Nmap Scripting Engine (NSE) allows you to create your own Lua scripts to automate various tasks related to security testing. Scripts can be used to automatically detect vulnerabilities, perform custom tests, and gather additional information about target systems.

2. Integrating Nmap with other tools: Nmap can be integrated with other security testing tools, such as Metasploit, Nessus, and Burp Suite. This allows you to automate the testing process, combining the capabilities of different tools and obtaining a more complete picture of the security of target systems.

3. Automation using the cron utility: The cron utility in Unix-like operating systems allows you to schedule periodic execution of commands. Using cron, you can configure automatic network scans using Nmap at a specified time or with a certain frequency.

4. Using Zenmap to create graphical reports: Zenmap is a graphical shell of Nmap that provides a convenient interface for managing scans and visualizing results. Zenmap allows you to create graphical reports in HTML or XML format, which can be used to automate the documentation and presentation of test results.

5. Use the Nmap API to integrate with applications: Nmap provides an API for integration with applications in Python, Perl, Ruby, and others. This allows you to create your own applications to automate security testing using Nmap’s capabilities.

Automatic network scanning using cron

To configure automatic network scanning using cron, you need to add the following line to crontab:

0 0 * * * nmap -sS -sV -O -oA scan_result <target>

This command will scan ports, application versions, and operating system detection every day at midnight, saving the results to a file named scan_result.

Using NSE scripts to automatically detect vulnerabilities

To automatically detect vulnerabilities using Nmap, you can use the following command:

nmap --script vuln <target>

This command will execute vuln scripts to detect vulnerabilities on the target device.

Automating scans using bash

You can create a bash script to automate scanning multiple targets, perform different types of scans, and save the results to files. Below is an example of such a script:

Bash:Копіювати в буфер обміну
#!/bin/bash


targets=("192.168.1.1" "192.168.1.100" "example.com")


for target in "${targets[@]}"
do
 echo "Scanning target: $target"
 nmap -sS -sV -O -oA "scan_results/$target" $target
done

msfconsole
db_import /path/to/nmap/scan/results.xml

Python:Копіювати в буфер обміну
import nmap

nm = nmap.PortScanner()
nm.scan('192.168.1.1', '22-443')

for host in nm.all_hosts():

  print('Host : %s (%s)' % (host, nm[host].hostname()))

  print('State : %s' % nm[host].state())

  for proto in nm[host].all_protocols():

    print('Protocol : %s' % proto)

    lport = nm[host][proto].keys()

    for port in lport:

      print('port : %s\tstate : %s' % (port, nm[host][proto][port]['state']))

nmap -sS -sV -O --exclude 192.168.1.100 192.168.1.0/24

nmap -sS -sV -O --exclude 192.168.1.100-200 192.168.1.0/24

nmap -sS -sV -O --exclude 192.168.1.100,192.168.1.200,192.168.1.300-400 192.168.1.0/24

nmap -sS -sV -O --exclude_file whitelist.txt 192.168.1.0/24

nmap -p 1723,500,1701,4500,1194 -sS -sV -O <target>

nmap -p 443 --script ssl-cert -sV <target>

nmap -sP <target>

nmap -sL <target>

nmap -sn -n -PR -PE -PP -PM <target>

nmap -sS -f <target>

nmap -sS --scan-delay 100ms <target>

nmap -sS --host-timeout 60s --max-retries 3 <target>

nmap -sS -D 192.168.1.100,192.168.1.101 <target>

nmap -sS -T4 <target>

nmap -sS --min-parallelism 10 --max-parallelism 50 <target>

nmap -sS --max-retries 3 <target>

nmap -sS --initial-rtt-timeout 50ms --host-timeout 60s <target>