Nmap Basic Tutorial

---------------------------------------------------------------------------------------

[+] Nmap Basics - Tutorial

[+] Author: Neutralise

[+] Location: http://thesoftwareengineer.org/services/tuts/NmapBasics.txt

---------------------------------------------------------------------------------------

Intro:

The tool i will be teaching you to use is called nmap and you can find the site

for nmap and further documentation here:

http://insecure.org/nmap/

Nmap is the leading security scanner for network professionals.

For starters open up nmap, do this by double clicking the nmap shortcut button.

It is important to remember that nmap is a commandline tool, not a simple click

and scan tool like other port scanners.

Typing "nmap -help" will provide you with a FULL list of nmap's commands but since you

want to use it particularly for port scanning and finding what ports are open and

what runs on them i will only explian the relevant commands. As to explain them all

would take literally hours.

---------------------------------------------------------------------------------------

Firstly, to explain what it is we are doing. Ports are numbers that TCP/IP uses to

map packets to services.

For example some common ports are:

21 FTP

22 SSH

23 TELNET

25 SMTP

80 HTTP

110 POP3

Full ports list can be viewed here:

http://www.iss.net/security_center/advice/Exploits/Ports/

---------------------------------------------------------------------------------------

When scanning hosts there are a lot of options you may want to use to find more

information about the target. Here are the most commonly used options:

-sS TCP SYN scan

-sT TCP connect scan

-sU UDP port scans

-v Verbose output

-vv very verbose output

-O Detect operating system

-sV Service version detection

-P0 Dont ping, just scan

-p Choose your ports

-F Fast scan

For example by scanning:

nmap -vv -P0 192.168.0.3

Would scan the IP 192.168.0.3, print very verbose output, and to scan the machine

without pinging it.

nmap -O 192.168.0.3

This would do an OS version detection on the target host(TCP/IP finger-prinitng).

nmap -p 1234 -O -sV 192.168.0.3

This scan would scan port 1234 and see if it was open, as well as an OS version

detection.

---------------------------------------------------------------------------------------

You can also make nmap save log files when outputing commands. These options are:

-oN This logs to a normal file like you see on nmap (human readable).

-oX XML output (open with webbrowser)(i use this one).

For example by scanning:

nmap -oX mylog.xml 192.168.0.3

Would scan the host, then in the nmap program file folder save a file named mylog.xml,

with the results of the scan in it.

---------------------------------------------------------------------------------------

Nmap has some commands to decoy where your scan is coming from.

For example:

-D Add decoy IPs to confuse the target's logs

When the decoy option is used nmap will send spoofed packets from the IP address

that you specify. This will confuse targets logs as it will look like many different

machines are actually doing a port scan and it will make it hard for the administrator

to decipher which IP is actually doing the portscan (yours).

For example:

nmap -P0 -D microsoft.com,ME,google.com 192.168.0.3

This command wont ping, uses decoys of microsoft.com and google.com and ME is your

real IP address (required).

---------------------------------------------------------------------------------------

[+]^Neutralised.

---------------------------------------------------------------------------------------