NMAP Flashcards
nmap help menu
nmap -h
man nmap
Which switch would you use for a “UDP scan”?
-sU
Which switch would you use for a Syn Scan”?
-sS
If you wanted to detect which operating system the target is running on, which switch would you use?
-O
Nmap provides a switch to detect the version of the services running on the target. What is this switch?
-sV
The default output provided by nmap often does not provide enough information for a pentester. How would you increase the verbosity?
-v
How would you set the verbosity level to two?
-vv
What switch would you use to save the nmap results in three major formats?
-oA
What switch would you use to save the nmap results in a “normal” format?
-oN
A very useful output format: how would you save results in a “grepable” format?
-oG
Sometimes the results we’re getting just aren’t enough. If we don’t care about how loud we are, we can enable “aggressive” mode. This is a shorthand switch that activates service detection, operating system detection, a traceroute and common script scanning.
-A
Nmap offers five levels of “timing” template. These are essentially used to increase the speed your scan runs at. Be careful though: higher speeds are noisier, and can incur errors!
How would you set the timing template to level 5?
-T5
How would you tell nmap to only scan port 80?
-p 80
How would you tell nmap to scan ports 1000-1500?
-p 1000-1500
How would you tell nmap to scan all ports?
-p-
How would you activate a script from the nmap scripting library ?
–script=
How would you activate all of the scripts in the “vuln” category?
–script=vuln
Three basic NMAP scan types and their commands
TCP Connect Scans (-sT)
SYN “Half-open” Scans (-sS)
UDP Scans (-sU)
TCP connect Scan
-sT
Syn half open scan
-sS
UDP Scans
-sU
TCP Null Scan
-sN
TCP FIN Scan
-sF
TCP Xmas Scans
-sX
What does a TCP Connect Scan do ?
Performs the three-way handshake with each target port in turn.
What will the response be to a TCP SYN flag if a port is closed ?
A Reset flag (RST)
What does it indicate if your SYN flag doesn’t receive a response ?
That port is being protected by a firewall
If a port is closed, which flag should the server send back to indicate this?
RST
What are SYN Scans also known as ?
Stealth Scans/Half-Open Scans
What does a SYN Scan reply with after receiving a SYN/ACK
RST
If a UDP port doesn’t respond to an Nmap scan, what will it be marked as?
open|filtered
When a UDP port is closed, by convention the target should send back a “port unreachable” message. Which protocol would it use to do so?
ICMP
Why are NULL, FIN and Xmas scans generally used?
Firewall Evasion
Why are NULL, FIN and Xmas scans generally used?
Firewall Evasion
How do you perform a Ping Sweep ?
We use the “-sn” switch in conjunction with IP ranges
How to to tell NMAP not to ping a host before scanning it ?
-Pn
