Overview of Linux Tool: Nmap
Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing.
In Kali Linux, it is widely used for tasks such as:
1. Network Discovery: Nmap helps to identify active devices (hosts) on a network. It can detect hosts,
services, and the operating systems they are running by sending specially crafted packets and
analyzing the responses.
2. Port Scanning: Nmap scans the open ports on a target system to understand which services (e.g.,
HTTP, FTP, SSH) are running and accessible. This is crucial for both security assessments and
network troubleshooting.
3. Service Version Detection: Nmap can determine the version of the software running on open ports,
helping security professionals identify vulnerabilities related to outdated services or software.
4. Vulnerability Scanning: Through scripting (with the Nmap Scripting Engine, or NSE), it can check
for vulnerabilities and misconfigurations. This is often used in penetration testing to identify
exploitable weaknesses in the system.
5. Operating System Detection: By analyzing responses from hosts, Nmap can guess the operating
system and its version, helping in mapping the target network more effectively.
Common Nmap Usage in Kali Linux:
Penetration Testing: It's an essential tool for network reconnaissance during penetration testing
engagements. Security professionals use it to identify weaknesses in a target network.
Network Inventory: For network administrators, Nmap helps with inventorying devices on a
network, monitoring active services, and managing network security.
Security Audits: Nmap is useful in assessing the security of systems and services running on a
network, helping identify open ports, vulnerable services, and misconfigurations.
Firewall Evasion: It can be used to test the security of firewalls and routers by scanning for open
ports, or by evading detection through stealth scanning techniques (e.g., SYN scan).
IP /Target Port Number Scan Type Scan Timing Output Formatt
Host Discovery (-sn, -Pn)
Host Scanning Networks
Specific ip (nmap ip)
Subnet range (nmap ip/24)
Ip ranging (nmap ip-18)
Specific ips (nmap ip ip)
Domain nane (nmap domain name)
Text file (nmap -iL filename)
Ports Scanning
Single port scan ( nmap ip -p80)
Sequential port scan (nmap ip -p20-30)
Distributed port scan (namp ip -p20,33,11)
Service specific port scan (namp ip -p http -80)
Protocol specific port scan (namp ip -p T:22, U:53)
All Ports (nmap ip -p-65535)
Top Ports (nmap ip –top-ports 100)
Scan Types/Techniques
TCP connect scan (-sT)
TCP syn scan (-sS)
FIN scan (-sF)
XMAS scan (-sX)
Null scan (-sN)
Ping scan (-sP)
UDP scan (-sU)
ACK scan (-sA)
.
.
.
Etc.
Scan Status: Ports are open (listening), closed (no service), filtered (controlled by firewall) or unfiltered
.(can't determine whether it’s open or closed- just tells port is live)
Open ports
Close ports
Filtered ports
Open Filtered
Close Filtered
Unfiltered
Scan Timing
T0 (Paranoid)
T1 (sneaky)
T2 (Polite)
T3 (Normal)
T4 (Fast)
T5 (Insane )
Output Formatt Types
-ON (Text file)
-OX (XML Formatt)
-OG (Greppable Formatt)
-OS (Script Kiddies Formatt)
NSE (Nmap script engine): Nmap Scripting Engine (NSE) is one of the most powerful features in the Nmap
security scanner. While standard Nmap finds open ports and services (like a map), NSE allows Nmap to
actively interact with those services to do complex tasks, such as finding vulnerabilities or testing for
misconfigurations.
What is NSE?
Automation Tool: It lets you run custom scripts to automate advanced networking tasks.
Lua Language: Scripts are written in a simple programming language called Lua.
Pre-installed: Nmap comes with hundreds of pre-written scripts out of the box
(/usr/share/nmap/scripts/).
What Can NSE Do?
NSE scripts are organized into categories, enabling several advanced functionalities:
1. Vulnerability Detection (vuln): Check if a service is vulnerable to known security flaws (e.g., CVEs).
2. Sophisticated Enumeration (discovery): Gather detailed info, like listing database tables, scanning
for network shares, or identifying web application versions.
3. Brute Force Attacks (brute): Attempt to guess passwords for services like FTP, SSH, or Telnet.
4. Backdoor Detection (malware): Scan for infections or backdoors on a system.
5. Information Gathering (default & safe): Safe scripts that grab service banners or check for safe
misconfigurations without crashing the target.
How to Use NSE (Simple Examples)
You activate scripts using the --script flag.
Run Default Scripts: The -sC flag runs a set of standard, safe scripts (good for beginners).
nmap -sC [Link]
Run a Specific Script: Use a single script by name.
nmap --script http-title [Link] (Grabs the title of a web page)
Run a Category of Scripts:
nmap --script vuln [Link] (Runs all vulnerability-checking scripts).
Run Multiple Scripts: Separate names with commas.
nmap --script banner,http-auth [Link]
Service version scan (-sV)
OS detection scan (-O)
Verbosity scan (-v)
Aggressive scan (-A)