Nmap - Network Mapper

 

 Introduction Of Nmap

Nmap is released under a custom license, which is based on (but not compatible with) GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for full details.

The latest version of this software as well as binary installers for Windows, macOS, and Linux (RPM) are available from Nmap.org

Full documentation is also available on the Nmap.org website.

Questions and suggestions may be sent to the Nmap-dev mailing list.

How To Install (Already Present In Kali Linux Operating System) 

Ideally, you should be able to just type:

./configure
make
make install 

Use Of Nmap 

Nmap is a powerful tool for discovering information about machines on a network or the Internet. It allows you to probe a machine with packets to detect everything from running services and open ports to the operating system and software versions. 

Like other security tools, Nmap should not be misused. Only scan networks and machines that you own or have permission to investigate. Probing other machines could be seen as an attack and be illegal.

That said, Nmap can go a long way in helping to secure your own network. It can also help you to ensure that your servers are properly configured and don't have any open and unsecured ports. It will also report if your firewall is correctly filtering ports that should not be externally accessible.

Nmap Commands

1. Scan Specific Host

To scan a specific host (this assumes that you already have the host's IP or hostname)  and reveal basic information, use the command:

$ nmap  IP-address

For example,

$ nmap 192.163.43.103

The command above is quick and generates output within a short time

You can also scan using the hostname instead of the IP address for example

$ nmap ubuntu-server

To scan a range of IPs, use the syntax

$ nmap 192.163.43.1-103

The command will scan all hosts from IP 192.168.43.1 to 192.168.43.103

2. Perform a thorough scan on a system

You can reveal all the information about a host system using the -A flag as shown below. This will reveal all the information pertaining to the host system such as the underlying OS, open ports, services running and their versions, etc.

$ nmap  -A 192.163.43.103

From the output, you can see that the command performs os and service detection, giving you detailed information such as the type of service and its version, and the port it is running on.  The command usually takes a while to run but it is thorough and gives you all you need about the particular host system.

3. Scanning a particular port

To scan a specific port and check if it is open use the -p flag in the syntax below:

$ nmap  -p port_number IP-address

For example, to scan port 80 on a host system run:

$ nmap  -p 80  192.168.43.103

To scan a range of ports, for example between 80-433 use the syntax:

$ nmap  -p 25-443  192.168.43.13
or
$ nmap -p 80,443 192.168.43.13

4. Find Host service name and its version

To check basic information about the services running on a host, then  use the -sV flag as shown:

$ nmap  -sV 192.168.43.103

5. Scanning an entire network subnet

To scan devices in a network subnet, use the CIDR notation as shown

$ nmap  192.168.43.0/24

6. Exclude specific host on Scan

As you perform a full network scan, you can choose to exclude a specific host using the --exclude flag . In the example below, we shall exclude our Kali Linux machine from being scanned.

$ nmap 192.168.43.* --exclude 192.168.43.8

 

7. Display host interfaces and routes

To display interfaces and routes on a particular host use the --iflist flag as shown.

$ nmap 192.168.43.103 --iflist

8. Scan Remote Host using TCP ACK and TCP Syn

At times, firewalls can block ICMP requests interfering with the scan results. In that case, we use the TCP syn (PS)  and TCP ACK (PA) to achieve the desired results.

$ nmap -PS 192.168.43.103

$ nmap -PA 192.168.43.103

9. Scan to detect firewall settings

You can use the Nmap tool to perform a scan to show whether the firewall is open or not as shown

$ nmap  -sA  192.168.43.223

In the first instance, the firewall is disabled and therefore not running. (Ports are unfiltered). In the second instance, the firewall has been enabled and chances of discovering open ports will be minimal.

10. Scanning TCP or UDP ports

To scan TCP ports that are open on the host, use the -sT flag as shown:

$ nmap  -sT  192.168.43.103

 To scan UDP ports, use the -sU flag

$ nmap  -sU  192.168.43.103

11.  Save scan results in a file

After you have completed your scan, you can save the results in a text file using the -oN flag and specifying the output file as shown below:

$ nmap  -oN scan.txt 192.168.43.103

The file will be created in your current working directory. To view the view simply use the cat command as shown:

$ cat results.txt

Also, you can use the redirection symbol (>) greater than symbol to redirect the output to a different file for example,

$ nmap  192.168.43.103 > output.txt

12. Scan with a set of Nmap scripts

Nmap comes packed with numerous and powerful scripts that are used for vulnerability scanning and thereby pointing out weaknesses in a system. To get the location of NSE scripts simply run the command:

$ locate *nse

You can load an Nmap script using the --script option as shown.

$ nmap -sV --script=mysql-info.nse 192.168.43.103

To scan with the most default scripts use the syntax

$ nmap -sC  192.168.43.103

If you are looking for automation then NSE is the answer (NMAP Scripting Engine)