Using Nmap for Network Discovery and Security Auditing

🛠 Security Tool Cheatsheet

Alex Morgan — Senior Penetration Tester

What is Nmap?

Nmap, short for Network Mapper, is a powerful open-source tool used for network discovery and security auditing. It allows users to discover hosts and services on a computer network by sending packets and analyzing the responses. Nmap is widely used by system and network administrators, as well as penetration testers, to ensure the security of their networks.

Installation

Nmap can be installed on various platforms including Windows, Linux, and macOS. To install Nmap:

• Linux: Most distributions include Nmap in their package manager. For example, on Debian-based systems, run: sudo apt install nmap.
• Windows: Download the installer from nmap.org and follow the installation instructions.
• macOS: Use Homebrew to install Nmap by executing: brew install nmap.

Basic Syntax

The basic syntax of Nmap consists of the following:

nmap [options] {target}

Where target can be an IP address, a range of IP addresses, or a hostname.

Discovery

Network discovery is a key feature of Nmap. Here are some common commands:

nmap -sn 192.168.1.0/24

This command performs a ping scan to identify live hosts in the specified subnet.

nmap -sP example.com

This performs a ping scan on the specified domain name.

Scanning

For more comprehensive scanning, use the following commands:

nmap -sS 192.168.1.1

This initiates a SYN scan on the target, efficiently checking for open ports.

nmap -sV -p 22,80,443 192.168.1.1

This scans the specified ports and attempts to determine the version of services running on those ports.

Exploitation

Nmap also offers features that help in preparing for exploitation:

nmap --script=vuln 192.168.1.1

This runs vulnerability detection scripts against the specified target.

Analysis

Analyzing the results from your scans can be made easier with these commands:

nmap -oN output.txt 192.168.1.1

This command saves the scan results in a normal text file for later analysis.

Evasion

Employ evasion tactics to avoid detection:

nmap -f 192.168.1.1

This fragments packets to evade intrusion detection systems.

Reporting

For reporting purposes:

nmap -oA full_report 192.168.1.1

This command outputs results in all formats (XML, grepable, and normal). It facilitates comprehensive reporting.

Quick Reference Table

Pro Tips

• Use -A flag for aggressive scan including OS detection, version detection, script scanning, and traceroute.
• Combine options for more tailored results: nmap -p- -A 192.168.1.1 scans all ports and gathers detailed information.
• Regularly update your Nmap scripts using nmap --script-updatedb to get the latest vulnerability detection scripts.

Real-World Examples

1. **Scanning a Remote Host for Open Ports:**

nmap -sS -p- 10.10.10.10

This SYN scan checks for open ports on `10.10.10.10`.

2. **Script Scanning for Vulnerabilities:**

nmap --script=vuln 10.10.10.10

This command checks for vulnerabilities on the specified IP.