Penetration Testing with Nmap

Best Boutique Penetration Testing Companies - Top Rated Pen Test Companies

Penetration Testing with Nmap

Penetration testing (or pen testing) is a type of cybersecurity test that identifies vulnerabilities, threats, and risks in networks, systems, and applications. While vulnerability scanning attempts to identify known vulnerabilities, a penetration test (or pen test) is intended to exploit the weaknesses to gain full situational awareness when it comes to cybersecurity including organizational risk, threats, vulnerabilities, and potential business impact.

Nmap is just one of many tools that a penetration tester may use during a penetration test.

Why Do I Need A Penetration Test?

Penetration testing is one of the best security practices that you can take.

Penetration testing can evaluate your security controls and provide you with recommendations to enhance your overall security posture. Penetration testing can include real-world security tests using advanced hacking methods to help you identify your weaknesses and improve your security posture. Advanced penetration tests can also simulate attacks on your network using similar techniques as malicious attackers to see if you can identify active attacks!

Penetration Testing Training

This article was created from Central InfoSec's 2018 Penetration Testing training course minus the labs and vulnerable devices.

Nmap Overview

Nmap

Nmap ("Network Mapper") is a free and open source utility for network discovery, security testing, and penetration testing. Nmap can be used to map a network, scan for live hosts, discover open ports, enumerate services, identify operating systems, and so much more!

Nmap Default Scan Settings

Scans the 1,000 most common ports
Randomizes the scanned port order
Normal scan timing (-T3)
Standard user - TCP Connect() (-sT)
Root user - TCP SYN (-sS)

Port Statuses

open - An application is actively accepting connections
closed - A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it
filtered - Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall
unfiltered - The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed. Only used for the ACK scan, which is used to map firewalls
open|filtered - Nmap is unable to determine whether a port is open or filtered. This occurs for scan types in which open ports give no response
closed|filtered - This state is used when Nmap is unable to determine whether a port is closed or filtered. It is only used for the IP ID idle scan

Print Version Number

Print the version number

nmap -V
nmap --version

Print Help Page

Print the help page

nmap -h
nmap --help

Scanning As Root

Certain Nmap scans must be run with root privileges.
You may receive an error: You requested a scan type which requires root privileges. QUITTING!
Add "sudo" to the command.

sudo nmap

Canceling A Running Scan

You may need to cancel a scan if the scan is taking a long time or if you accidently started a scan.

Ctrl + c

Nmap: Discovery & DNS Resolution

List Scan

The list scan id a degenerate form of host discovery. It lists each host without sending any packets. This still performs reverse DNS resolution to learn the names of the hosts.

nmap -sL 192.168.1.0/24

Ping Scan / Do Not Port Scan

The Ping scan (disable port scan / no port scan) does not run a port scan after host discovery. This is one step more intrusive than the list scan.

nmap -sn 192.168.1.0/24

No Ping / Disable Ping

The No Ping scan (disable ping scan) skips the discovery stage altogether and forcefully scans every IP address.

nmap -Pn 192.168.1.0/24

No DNS Resolution

The No DNS Resolution scan does not perform DNS resolution. DNS can be slow and this type of scan may improve scanning times.

nmap -n 192.168.1.0/24

DNS Resolution For All Targets

The DNS Resolution scan performs DNS resolution for all targets. Normally DNS resolution is only performed against online hosts.

nmap -R 192.168.1.0/24

Nmap: Common Options

Scan A Single IP Address

Scan a single IP address using the default settings.

nmap 192.168.1.1

Scan Multiple IP Addresses

Scan multiple IP addresses by separating them with spaces.

nmap 192.168.1.1 192.168.1.2 192.168.1.3

Scan A Range Of IP Addresses

Scan a range of IP addresses.

nmap 192.168.1.50-100
nmap 192.168.1-20.50-100

Scan A CIDR Block

Scan a CIDR block.

nmap 192.168.1.0/24

Scan A Single Port

Scan a single port. The space is optional.

nmap -p 21 192.168.1.0/24
nmap -p21 192.168.1.0/24

Scan Multiple Individual Ports

Scan multiple ports by separating them with commas.

nmap -p 21,22,23 192.168.1.0/24
nmap -p21,22,23 192.168.1.0/24

Scan A Range Of Ports

Scan a range of ports using a dash.

nmap -p 21-23 192.168.1.0/24
nmap -p21,22,23,100-200 192.168.1.0/24
nmap -p21-23,100-200 192.168.1.0/24

Fast Limited Port Scan

The Fast port scan only scans the top 100 ports instead of the default top 1,000 ports

nmap -F 192.168.1.0/24

Scan Top Ports

Scan a specific number of top ports.

nmap --top-ports 10 192.168.1.0/24
nmap --top-ports 100 192.168.1.0/24
nmap --top-ports 1000 192.168.1.0/24

Scan (Almost) All Ports

Scan ports 1 - 65,535.

nmap -p- 192.168.1.0/24

Scan All Ports Including "0"

Scan ports 0 - 65,535. Port zero is invalid but nothing stops someone from specifying it in the header field. Some malicious trojan backdoors listen on port zero. This is a stealthy way to allow access without appearing on most port scans.

nmap -p 0-65535 192.168.1.0/24
nmap -p0-65535 192.168.1.0/24

Do Not Randomize Ports

Do not randomize the order of the ports. By default, the port order is randomized.

nmap -r 192.168.1.0/24

Only Show Open Ports

Only show the open ports.

nmap --open 192.168.1.0/24

Nmap: Not Just Port Scanning

Service Version Detection

Service version detection interrogates open ports to determine what is actually running. By default, Nmap only shows the status of the ports. Version detection will verify the service and display the version.

nmap -sV 192.168.1.0/24

Operating System Detection

Operating system detection uses TCP/IP stack fingerprinting. It sends a series TCP and UDP packets and examines every bit in the responses, performing dozens of tests.

nmap -O 192.168.1.0/24

OS, Service Version, Scripts, & Traceroute

Enable OS detection, servie version detection, script scanning, and traceroute.

nmap -A 192.168.1.0/24

Nmap: Exclusions

Exclude Hosts

Exclude specific IP addresses and networks from being scanned.

nmap --exclude 192.168.1.1,192.168.1.2 192.168.1.0/24

Exclude Ports

Exclude specific ports from being scanned.

nmap --exclude-ports 21,22,23 192.168.1.0/24

Do Not Exclude Any Ports

Do not exclude any ports. By default, some ports may be excluded including TCP port 9100 because some printers simply print anything sent to that port, leading to dozens of pages of HTTP GET requests, binary SSL session requests, etc.

nmap --allports 192.168.1.0/24

Nmap: Input & Output Files

Scan Hosts From A File

Scan IP addresses and networks listed in a file. There should be one IP address or CIDR per line.

nmap -iL targets.txt

Exclude Hosts From A File

Exclude IP addresses and networks listed in a file. There should be one IP address or CIDR per line.

nmap --excludefile exclude.txt 192.168.1.0/24

Save The Output In Normal Format

Save the output in normal format.

nmap -oN results.nmap 192.168.1.0/24

Save The Output In XML Format

Save the output in XML format.

nmap -oX results.xml 192.168.1.0/24

Save The Output In Grepable Format

Save the output in grepable format. This is deprecated.

nmap -oG results.gnmap 192.168.1.0/24

Save The Output In ScRipT Kidd|3 Format

Save the output in ScRipT Kidd|3 format.

nmap -oS results.txt 192.168.1.0/24

Save The Output In All Formats

Save the output in all formats excluding script kiddie format.

nmap -oA results 192.168.1.0/24

Nmap: Scan Types

TCP SYN Scan

The TCP SYN scan (stealth scan) is unobtrusive and stealthy because it never completes TCP connections. This is the default scan type for root users.

nmap -sS 192.168.1.0/24

TCP Connect Scan

The TCP Connect scan completes the connection. This take longer than the TCP SYN scan. The target network more likely to log TCP Connect scans than TCP SYN scans. This is the default scan type for normal users.

nmap -sT 192.168.1.0/24

UDP Scan

While most popular services on the Internet run over the TCP protocol, UDP services are widely deployed. DNS, SNMP, and DHCP (registered ports 53, 161/162, and 67/68) are three of the most common. Because UDP scanning is generally slower and more difficult than TCP, some penetration testers ignore these ports. This is a mistake, as exploitable UDP services are quite common and attackers certainly don't ignore the whole protocol.

nmap -sU 192.168.1.0/24

Nmap UDP Probes

Nmap interprets responses to UDP scan probes by:

open - Any UDP response from target port (unusual)
open|filtered - No response received (even after retransmissions)
closed - ICMP port unreachable error (type 3, code 3)
filtered - Other ICMP unreachable errors (type 3, code 1, 2, 9, 10, or 13)

ICMP Destination Unreachable Type 3 Code Values

Nmap only cares about codes 0–3, 9, 10, and 13, which are marked with an asterisk.

0* - Network unreachable
1* - Host unreachable
2* - Protocol unreachable
3* - Port unreachable
4 - Fragmentation needed but don't-fragment bit set
5 - Source route failed
6 - Destination network unknown
7 - Destination host unknown
8 - Source host isolated (obsolete)
9* - Destination network administratively prohibited
10* - Destination host administratively prohibited
11 - Network unreachable for type of service (TOS)
12 - Host unreachable for TOS
13* - Communication administratively prohibited by filtering
14 - Host precedence violation
15 - Precedence cutoff in effect

SCTP INIT Scan

SCTP is a relatively new alternative to TCP and UDP. SCTP combines characteristics of TCP and UDP while adding new features. The SCTP INIT scan is the SCTP equivalent of the TCP SYN scan.

nmap -sY 192.168.1.0/24

TCP ACK Scan

The TCP ACK scan never determines "open" or "open|filtered". It maps out firewall rulesets to determine if they are stateful or not, and which ports are filtered.

nmap -sA 192.168.1.0/24

TCP ACK Scan Probes

Nmap interprets responses to TCP ACK scan probes by:

unfiltered - TCP RST response
filtered - No response received (even after retransmissions)
filtered - ICMP unreachable error (type 3, code 1, 2, 3, 9, 10, or 13)

TCP Window Scan

The TCP Window scan is the same as ACK scan except that it exploits an implementation detail of certain systems to differentiate open ports from closed ones, rather than always printing unfiltered when an RST is returned. It does this by examining the TCP Window value of the RST packets returned. On some systems, open ports use a positive window size (even for RST packets) while closed ones have a zero window.

nmap -sW 192.168.1.0/24

TCP Window Scan Probes

Nmap interprets responses to TCP Window scan probes by:

open - TCP RST response with non-zero window field
closed - TCP RST response with zero window field
filtered - No response received (even after retransmissions)
filtered - ICMP unreachable error (type 3, code 1, 2, 3, 9, 10, or 13)

NULL, TCP FIN, and Xmas Scans

The NULL, TCP FIN, and Xmas scans are the same in behavior except for the TCP flags set in the probe packets. These scan types are a little stealthier than even a SYN scan. Most modern IDS products can be configured to detect them. The key advantage to these scan types is that they can sneak through certain non-stateful firewalls and packet filtering routers. Such firewalls try to prevent incoming TCP connections (while allowing outbound ones) by blocking any TCP packets with the SYN bit set and ACK cleared.

Null Scan

The Null scan does not set any bits (TCP flag header is 0).

nmap -sN 192.168.1.0/24

FIN Scan

The FIN scan only sets the TCP FIN bit.

nmap -sF 192.168.1.0/24

Xmas Scan

The Xmas scan sets the FIN, PSH, and URG flags, lighting the packet up like a Christmas tree.

nmap -sX 192.168.1.0/24

Nmap NULL, FIN, Xmas Probes

Nmap interprets responses to NULL, FIN, and Xmas scan probes by:

open|filtered - No response received (even after retransmissions)
closed - TCP RST packet
filtered - ICMP unreachable error (type 3, code 1, 2, 3, 9, 10, or 13)

ICMP Destination Unreachable Type 3 Code Values

Nmap only cares about codes 0–3, 9, 10, and 13, which are marked with an asterisk.

0* - Network unreachable
1* - Host unreachable
2* - Protocol unreachable
3* - Port unreachable
4 - Fragmentation needed but don't-fragment bit set
5 - Source route failed
6 - Destination network unknown
7 - Destination host unknown
8 - Source host isolated (obsolete)
9* - Destination network administratively prohibited
10* - Destination host administratively prohibited
11 - Network unreachable for type of service (TOS)
12 - Host unreachable for TOS
13* - Communication administratively prohibited by filtering
14 - Host precedence violation
15 - Precedence cutoff in effect

TCP Maimon Scan

The Maimon scan is named after its discoverer, Uriel Maimon. This technique is the same as NULL, FIN, and Xmas scan, except that the probe is FIN/ACK. According to RFC 793 (TCP), an RST packet should be generated in response to such a probe whether the port is open or closed. However, Uriel noticed that many BSD-derived systems simply drop the packet if the port is open.

nmap -sM 192.168.1.0/24

TCP Maimon Scan Probes

Nmap interprets responses to TCP Maimon scan probes by:

open|filtered - No response received (even after retransmissions)
closed - TCP RST packet
filtered - ICMP unreachable error (type 3, code 1, 2, 3, 9, 10, or 13)

TCP Idle Scan

The TCP Idle scan is the ultimate stealth scan. It takes far longer than most other scan types. A 15 second SYN scan could take 15+ minutes as a TCP Idle scan. Targets will be scanned without sending packets from the attacking IP address. A side-channel attack bounces the scan off of a dumb "zombie host".

nmap -sI 192.168.1.0/24

Finding An Idle Scan Zombie Host

The first step in a TCP Idle scan is to find a zombie host. The zombie host needs to assign IP ID packets incrementally on a global basis instead of a per-host basis. There are many suitable zombie hosts on the Internet but using one is illegal without permission.

Technique 1: Perform a port scan and OS identification (-O) on the zombie candidate network rather than just a ping scan to help in selecting a good zombie host. As long as verbose mode (-v) is enabled, OS detection will usually determine the IP ID Sequence Generation type of "Incremental" or "Broken little-endian incremental".

nmap -O -v 192.168.1.0/24

Technique 2: Run the ipidseq NSE script against the zombie candidate network.

nmap --script ipidseq --script-args probeport=80

IP Protocol Scan

The IP Protocol scan determines which IP protocols (TCP, ICMP, IGMP, etc.) are supported by target machines. This isn't technically a port scan, since it cycles through IP protocol numbers rather than TCP or UDP port numbers. Yet it still uses the "-p" option to select scanned protocol numbers, reports its results within the normal port table format, and even uses the same underlying scan engine as the true port scanning methods. So it is close enough to a port scan that it belongs here.

nmap -sO 192.168.1.0/24

IP Protocol Scan Probes

Nmap interprets responses to IP Protocol scan probes by:

open - Any response in any protocol from target host
closed - ICMP protocol unreachable error (type 3, code 2)
filtered - ICMP unreachable error (type 3, code 1, 3, 9, 10, or 13)
open|filtered - No response received (even after retransmissions)

TCP FTP Bounce Scan

The TCP FTP bounce scan uses FTP servers to port scan other hosts.

nmap -b ftp.domain.com 192.168.1.0/24

Nmap: Cloaking & Spoofing

Cloak A Scan With Decoys

The Decoy scan cloaks a scan with decoy IP addresses. This still includes your source IP. An IDS may report multiple port scans from unique IP addresses.

nmap -D [,] 192.168.1.0/24

Spoof The Source IP Address

Spoof the source IP address. You must include "-Pn" and "-e".

nmap -S  192.168.1.0/24
nmap -Pn -e [eth0/lo] -S  192.168.1.0/24

Nmap: Advanced Options

Timing Template

Nmap offers six timing templates to allow you to specify how aggressive you would like to scan.

0 - paranoid
1 - sneaky
2 - polite
3 - normal
4 - aggressive
5 - insane

nmap -T[0-5] 192.168.1.0/24

Host Timeout

The host timeout sets the maximum time to spend on each host.

nmap --host-timeout 1m 192.168.1.0/24

Fragment Packets

Fragment packets use tiny fragmented IP packets to split up the TCP header over several packets. This makes it harder for a packet filter or IDS to detect the activity.

nmap -f 192.168.1.0/24

Verbosity

There are 9 levels of verbosity (-4 to 4).

nmap -v 192.168.1.0/24
nmap -vv 192.168.1.0/24
nmap -vvv 192.168.1.0/24
nmap -v3 192.168.1.0/24
nmap -v-3 192.168.1.0/24

Debugging

There are 7 levels of debugging (0 to 6).

nmap -d 192.168.1.0/24
nmap -dd 192.168.1.0/24
nmap -d2 192.168.1.0/24
nmap -d6 192.168.1.0/24

Runtime Interaction

Increase / decrease the verbosity level.

v / V

Increase / decrease the debugging level.

d / D

Turn on / off packet tracing.

p / P

Print a runtime interaction help screen.

Print out a status message.

Any other key

Nmap: Scripting Engine

Nmap Scripting Engine

The Nmap Scripting Engine (NSE) runs simple scripts built in the Lua programming language. These scripts can help automate tasks.

Listing Nmap Scripts

List Nmap scripts.

ls -l /usr/share/nmap/scripts/

List "http-*" scripts (Notice the space in the command " http-").

ls -l /usr/share/nmap/scripts/ | grep " http-"

List "http-*" scripts, excluding "cve"

ls -l /usr/share/nmap/scripts/ | grep " http-" | grep -v cve

Scripting Engine Usage 1

NSE scripts

--script |||[,...]
--script=|||[,...]

Script arguments

--script-args =,={=},={,}

Scripting Engine Usage 2

Select a specific script.

nmap --script=http-headers

Select a specific script, specifying port and version detection.

nmap -p80,443 -sV --script=http-headers

Use the '*' wildcard to run all "http-*" scripts.

nmap --script "http-*"

Scripting Engine Usage 3

Load scripts in the default category or the safe category or both.

nmap --script "default or safe"
nmap --script "default,safe"

Load scripts in both the default and safe categories.

nmap --script "default and safe"

Scripting Engine Usage 4

Load every script except for those in the intrusive category.

nmap --script "not intrusive"

Load scripts in the default or safe categories, except http

nmap --script "(default or safe) and not http-*"

Script Timeout

Set a script timeout.

nmap --script-timeout 5m 192.168.1.0/24

Nmap: Example Commands

Example Nmap Scans

No DNS resolution, fast scan, do not exclude any ports, version detection, OS detection, no external scripts.

sudo nmap -n -F -r --allports -A -sT -T5 --script "not external"

Add decoy IP addresses and a spoofed IP.

sudo nmap -n -F -r --allports -A -sT -T5 -D  -S  --script "not external"

Scan all ports.

sudo nmap -n -p- -r --allports -sV -O -sT -T5 -D  -S  --script "not external"

Zenmap

Zenmap is the official Nmap Security Scanner GUI. It is multi-platform, free and open source, and easy for beginners to use.

Best Pen Test Companies

Central InfoSec was rated the "best boutique penetration testing company" and the "best penetration testing firm" by two independent third-party organizations that review many contributing factors.

Professional Security Services Offered by Central InfoSec

Central InfoSec offers a variety of professional security services including:

Red Teaming

Attack simulation to test, measure, and improve your detection and response

Penetration Testing

Real-world security tests using advanced hacking methods to identify your weaknesses

Vulnerability Assessments

Identification of potential vulnerabilities in your network and applications

Application & API Testing

Testing of security controls and products to identify your gaps and weaknesses

vCISO Services

Virtual CISO (vCISO) services allowing immediate access to strategic security guidance

Cyber Risk Management

Cyber solutions to help address security threats and to help you reach your security initiatives

Phishing Assessment

Effective security awareness training through social engineering and phishing emails

Managed Phishing

Routine phishing campaigns to track and measure the security awareness of your employees

Password Audit

Detection of weak passwords to help you improve your password policies

C2 & Pivot Testing

Command and control (C2) communications, pivoting, and data exfiltration testing

Purple Team Tabletop

Targeted training exercises to measure people, processes, and technologies

Security Training

Fully customizable cyber security training and employee awareness support

Best Boutique Penetration Testing Company

Central InfoSec named Best Boutique Penetration Testing Company by the Global 100 Awards.

Best Penetration Testing Firm

Central InfoSec named Best Penetration Testing Firm by Corporate Vision's Corporate Excellence Awards.

Central InfoSec Best Penetration Testing & Security Consulting Firm

"Central InfoSec helps organizations by discovering network and web application vulnerabilities before the hackers do!"

Central InfoSec is an award-winning cyber security company that offers professional security services including Red Teaming, Penetration Testing, and Security Training.

The Central InfoSec team consists of skilled security professionals bringing a total of 20+ years of red teaming, penetration testing, web application, and exploitation experience. Central InfoSec team members have achieved industry leading professional certifications including CRTO, OSCP, OSWP, GXPN, GPEN, GCPN, GWAPT, GMOB, AWS-CSS, AWS-CCP, PenTest+, CEH, CISSP, and more.

The Central InfoSec team goes one step further and develops open-source tools including Burp Suite extensions, Cobalt Strike aggressor scripts, scripts tying into tools (including GoPhish, PhishMe, Slack, Lair), other custom-built security tools, and Capture The Flag (CTF) events!

Central InfoSec performs a variety of penetration tests including external-networks, internal-networks, web applications, and APIs. The company quickly informs clients of critical vulnerabilities by creating ad-hoc reports and hosting ad-hoc debriefs as necessary.

Best Penetration Testing & Security Consulting Firm

Central InfoSec Red Teaming
& Penetration Testing

Central InfoSec can quickly uncover critical vulnerabilities that have been missed for years. No automated scanning tool can replace high-quality security professionals. Utilizing Central InfoSec’s custom-built tools and manual analysis, Central InfoSec’s security experts have found numerous vulnerabilities within web applications including multiple 0-days allowing direct access to web servers hosting the applications. Once critical vulnerabilities are discovered, Central InfoSec’s experts work directly with application developers to address security flaws. With many success stories, Central InfoSec is constantly contributing to the community by sharing its knowledge through blogs, open-source projects, tool development, conferences, presentations, and local security meetups.

Every organization, at a minimum, should receive both network pen testing and web application pen testing, and cost should never be the reason that quality testing is not performed. Therefore, the company focuses on offering quality and affordable professional security services while increasing security awareness at organizations. The Central InfoSec team educates clients through security assessments and tailored security training while also helping with permanent resource staffing. We want to help organizations understand the core foundation to security, help businesses acquire the appropriate staff that they need, and help strengthen security postures through offensive security testing.

Central InfoSec Best Boutique Penetration Testing Firm - Top Rated Red Team Companies

Best Boutique Pen Test Company

Central InfoSec strengthens the security posture of businesses by reducing cyber risk through red teaming and pen testing.

Best Boutique Pen Test Company

Let’s Work Together

If you’d like to see why Global 100 selected Central InfoSec as the Best Boutique Pen Test Company, let's have a chat to see how you could benefit from Central InfoSec security services. It’s simple and easy. We’ll even include a free customized quote. Let’s get started: Contact Us

Central InfoSec offers a variety of other professional security services to help you test, measure, and improve your overall security posture. Security services offered include red teaming, pen testing, vulnerability assessments, web app testing, managed phishing, and other tailored security services to help you reduce risk to your organization.