nmap quick cheatsheet

1. Checking and storing active devices in a range and store in a file "tnet"

sudo nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5

1. Scanning a list of hosts

sudo nmap -iL tnet

1. Show all packets sent and received by --packet-trace -PE : Performs the ping scan by using 'ICMP Echo requests' against the target.

sudo nmap 10.129.2.18 -sn -oA host -PE --packet-trace 

1. Display reason for a specific result --reason

2. We see here that Nmap does indeed detect whether the host is alive or not through the ARP request and ARP reply alone. To disable ARP requests and scan our target with the desired ICMP echo requests, we can disable ARP pings by setting the "--disable-arp-ping" option. Then we can scan our target again and look at the packets sent and received.

3. We can check TTL when we do a --disable-arp-ping and based on TTL know which OS it is. 128 - windows 64 - Linux/Mac 255 - network devices

4. To scan the "x" number of top ports (--top-ports=<number>)

5. -n: disables DNS resolution. Since DNS can be slow even with Nmap's built-in parallel stub resolver, this option reduces scanning times.

6. TCP Connect scan - The Connect scan (also known as a full TCP connect scan) is highly accurate because it completes the three-way TCP handshake, allowing us to determine the exact state of a port (open, closed, or filtered). However, it is not the most stealthy. In fact, the Connect scan is one of the least stealthy techniques, as it fully establishes a connection, which creates logs on most systems and is easily detected by modern IDS/IPS solutions. Eg:

   Connect Scan on TCP Port 443

   $ sudo nmap 10.129.2.28 -p 443 --packet-trace --disable-arp-ping -Pn -n --reason -sT 
   
   Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-15 16:26 CET
   CONN (0.0385s) TCP localhost > 10.129.2.28:443 => Operation now in progress
   CONN (0.0396s) TCP localhost > 10.129.2.28:443 => Connected
   Nmap scan report for 10.129.2.28
   Host is up, received user-set (0.013s latency).
   
   PORT    STATE SERVICE REASON
   443/tcp open  https   syn-ack
   
   Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds

7. Version scan = -sV

8. Script scan = -sC

9. Aggressive scan = -A

10. Nmap XML to GUI HTML report nmap <IP> -oA target xsltproc target.xml -o target.html

11. Firewall bypass - Decoy scan! -D RND:5

Firewall bypass

1. HTB Academy hard lab

Firewall and IDS/IPS Evasion - Hard Lab

Now our client wants to know if it is possible to find out the version of the running services on unknown port behind Firewall IDS/IPS. Identify the version of service our client was talking about and submit the flag as the answer.

Firewall and IDS/IPS Evasion - Hard Lab

Scanning Options and Description

• 10.129.2.28 Scans the specified target.

• -p 21,22,25 Scans only the specified ports.

• -sS Performs SYN scan on specified ports.

• -sA Performs ACK scan on specified ports.

• -Pn Disables ICMP Echo requests.

• -n Disables DNS resolution.

• --disable-arp-ping Disables ARP ping.

• --packet-trace Shows all packets sent and received.

Scan by Using Decoys

sudo nmap 10.129.2.47 -p 22,80,50000 -sV -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53 -e tun0 -D RND:10

Connect To The Filtered Port 50000 discovered, from a different source port of 53 to evade detection.

ncat -nv --source-port 53 10.129.2.47 50000

Additional techniques by targeting Firewall and IDS/IPS Evasion

Testing Firewall Rule

sudo nmap 10.129.2.28 -n -Pn -p445 -O

Scan by Using Different Source IP

sudo nmap 10.129.2.28 -n -Pn -p 445 -O -S 10.129.2.200 -e tun0

SYN-Scan From DNS Port

sudo nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53

1. Medium lab

nmap -Pn -T4 -A -v -sV 10.129.57.157 -p 53 -D RND:5 --stats-every=5s