Nmap Flashcards
Syn Scan
-sS
SYN scans sends back a RST TCP packet after receiving a SYN/ACK from the server. Referred to as “half-open” or stealth scans
UDP Scan
-sU
OS Detection
-O
Version of services running on target
-sV
Increase verbosity
-v, with more v’s meaning higher verbosity
Ex: -vv
Output scan in normal format
-oN
Output scan in XML format
-oX
Output scan in greppable format
-oG
Output scan in the three major formats at once
-oA
Activate aggressive mode
-A
This is a shorthand switch that activates service detection, operating system detection, a traceroute and common script scanning.
Increase speed of scan (and drawbacks)
-T(x) with x being 1-5 sets the speed.
Higher levels are noisier and can generate errors
Specify ports- single, range, all
Single: -p (x) [-p 80]
Range: -p (x)-(y) [1000-1500]
All: -p-
TCP Connect Scan
-sT
TCP Connect scan works by performing the three-way handshake with each target port in turn. In other words, Nmap tries to connect to each specified TCP port, and determines whether the service is open by the response it receives.
What does a “filtered” port indicate?
That it is protected by firewall, and the incoming packet was dropped.
If a port is closed, which flag should the server send back to indicate this?
RST
What are some drawbacks of Syn Scans?
Require Sudo permissions
Unstable services are sometimes brought down by them
What is the default scan Nmap uses?
If the user has sudo permissions: Syn Scan.
If user does not have sudo permissions: TCP Connect Scan.
Drawbacks of UDP Scans
UDP scans tend to be incredibly slow in comparison to the various TCP scans (in the region of 20 minutes to scan the first 1000 ports, with a good connection)
If a UDP port doesn’t respond to an Nmap scan, what will it be marked as?
Open|Filtered
When a UDP port is closed, by convention the target should send back a “port unreachable” message. Which protocol would it use to do so?
ICMP
Null Scan
-sN
TCP request is sent with no flags set at all. As per the RFC, the target host should respond with a RST if the port is closed.
FIN Scan
-sF
Request is sent with the FIN flag (usually used to gracefully close an active connection). Once again, Nmap expects a RST if the port is closed.
Xmas Tree Scan
-sX
Sends a malformed TCP packet and expects a RST response for closed ports. It’s referred to as an xmas scan as the flags that it sets (PSH, URG and FIN) give it the appearance of a blinking christmas tree when viewed as a packet capture in Wireshark.
Why are NULL, FIN and Xmas scans generally used?
Firewall Evasion
Ping Sweep
-sn
Sends ICMP packets to ping target IP addresses to determine which hosts are active
NSE
Nmap Scripting Engine
Written in Lua, extends the capabilities of nmap.
Can be used to do a variety of things: from scanning for vulnerabilities, to automating exploits for them.
ICMP is often blocked, requiring the use of what flag?
-Pn which tells Nmap to not bother pinging the host before scanning it.
