Nmap® Cookbook

[Pages:198]Nmap? Cookbook The fat-free guide to network scanning

2

Nmap? Cookbook The Fat-free Guide to Network Scanning

Copyright ? 2010 Nicholas Marsh All rights reserved.

ISBN: 1449902529 EAN-13: 9781449902520



BSD? is a registered trademark of the University of California, Berkeley CentOS is property of CentOS Ltd. Debian? is a registered trademark of Software in the Public Interest, Inc Fedora? is a registered trademark of Red Hat, Inc. FreeBSD? is a registered trademark of The FreeBSD Foundation Gentoo? is a registered trademark of The Gentoo Foundation Linux? is the registered trademark of Linus Torvalds Mac OS X? is a registered trademark of Apple, Inc. Windows? is a registered trademark of Microsoft Corporation Nmap? is a registered trademark of LLC Red Hat? is a registered trademark of Red Hat, Inc. Ubuntu? is a registered trademark of Canonical Ltd. UNIX? is a registered trademark of The Open Group

All other trademarks used in this book are property of their respective owners. Use of any trademark in this book does not constitute an affiliation with or endorsement from the trademark holder.

All information in this book is presented on an "as-is" basis. No warranty or guarantee is provided and the author and/or publisher shall not be held liable for any loss or damage.

3

4

Contents at a Glance

Introduction....................................................................................... 15 Section 1: Installing Nmap ..................................................................19 Section 2: Basic Scanning Techniques ..................................................33 Section 3: Discovery Options ..............................................................45 Section 4: Advanced Scanning Options................................................65 Section 5: Port Scanning Options ........................................................79 Section 6: Operating System and Service Detection.............................89 Section 7: Timing Options ..................................................................97 Section 8: Evading Firewalls..............................................................115 Section 9: Output Options ................................................................ 127 Section 10: Troubleshooting and Debugging......................................135 Section 11: Zenmap.......................................................................... 147 Section 12: Nmap Scripting Engine (NSE)........................................... 161 Section 13: Ndiff ..............................................................................171 Section 14: Tips and Tricks................................................................177 Appendix A - Nmap Cheat Sheet ....................................................... 187 Appendix B - Nmap Port States ......................................................... 191 Appendix C - CIDR Cross Reference ................................................... 193 Appendix D - Common TCP/IP Ports..................................................195

5

6

Table of Contents

Introduction....................................................................................... 15 Conventions Used In This Book.............................................................18

Section 1: Installing Nmap ..................................................................19 Installation Overview ............................................................................20 Installing Nmap on Windows................................................................21 Installing Nmap on Unix and Linux systems..........................................25 Installing Precompiled Packages for Linux........................................25 Compiling Nmap from Source for Unix and Linux ............................26 Installing Nmap on Mac OS X................................................................29

Section 2: Basic Scanning Techniques ..................................................33 Basic Scanning Overview.......................................................................34 Scan a Single Target...............................................................................35 Scan Multiple Targets............................................................................36 Scan a Range of IP Addresses................................................................37 Scan an Entire Subnet ...........................................................................38 Scan a List of Targets .............................................................................39 Scan Random Targets............................................................................40 Exclude Targets from a Scan..................................................................41 Exclude Targets Using a List ..................................................................42 Perform an Aggressive Scan..................................................................43 Scan an IPv6 Target ...............................................................................44

Section 3: Discovery Options ..............................................................45 Discovery Options Overview.................................................................46 Don't Ping ............................................................................................. 47 Ping Only Scan.......................................................................................48 TCP SYN Ping .........................................................................................49 TCP ACK Ping .........................................................................................50 UDP Ping ............................................................................................... 51 SCTP INIT Ping ....................................................................................... 52 7

ICMP Echo Ping..................................................................................... 53 ICMP Timestamp Ping .......................................................................... 54 ICMP Address Mask Ping ...................................................................... 55 IP Protocol Ping .................................................................................... 56 ARP Ping ............................................................................................... 57 Traceroute ............................................................................................ 58 Force Reverse DNS Resolution.............................................................. 59 Disable Reverse DNS Resolution........................................................... 60 Alternative DNS Lookup Method.......................................................... 61 Manually Specify DNS Server(s) ........................................................... 62 Create a Host List.................................................................................. 63 Section 4: Advanced Scanning Options................................................65 Advanced Scanning Functions Overview .............................................. 66 TCP SYN Scan ........................................................................................ 67 TCP Connect Scan ................................................................................. 68 UDP Scan .............................................................................................. 69 TCP NULL Scan ...................................................................................... 70 TCP FIN Scan ......................................................................................... 71 Xmas Scan............................................................................................. 72 Custom TCP Scan .................................................................................. 73 TCP ACK Scan ........................................................................................ 74 IP Protocol Scan .................................................................................... 75 Send Raw Ethernet Packets .................................................................. 76 Send IP Packets..................................................................................... 77 Section 5: Port Scanning Options ........................................................79 Port Scanning Options Overview .......................................................... 80 Perform a Fast Scan .............................................................................. 81 Scan Specific Ports................................................................................ 82 Scan Ports by Name.............................................................................. 83 Scan Ports by Protocol .......................................................................... 84

8

 ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download