RECONNAISSANCE
(Nmap - The Active Eye of The Pentester)
Table of Content
Who AM I
Reconnaissance (What is it)
Types of Reconnaissance
Nmap (The Active eye)
Nmap Switches
Nmap Script Engine (NSE)
Practicals
Questions
Who AM I
• ERIC NII SOWAH BADGER (NiiHack)
• S.O.C. Specialist (Pentest) at GCB Bank Ltd
• Consultant for Inveteck Global
• LinkedIn: Eric Nii Sowah Badger
• TWITTER: ens_nii
• Personal Website: [Link]
• Inveteck Global Website: [Link]
Reconnaissance – What it is
• Information Gathering and getting to know the target
systems is the first process in ethical hacking / the
cyber kill chain
• Reconnaissance is a set of processes and techniques
(Footprinting, Scanning & Enumeration) used to
covertly discover and collect information about a target
system
• Ethical hackers attempt to gather as much information
about a target system as possible during the
reconnaissance stage.
• Reconnaissance is always the eye of the Ethical Hacker
Types of Reconnaissance
PASSIVE
This is the process of gathering information where 1 ACTIVE
there is no direct connection to the target.
This is the process of directly
interacting or engaging with the
1 targeted system to gain information.
PASSIVE
This is a form of targeted information data collection that
takes place when an individual’s personal data, such as
2
password, is stolen without the targeted individual’s ACTIVE
knowledge. This type of recon gathers information
2 about the target by probing the
targeted system.
PASSIVE 3
This can take place when the hacker is sifting through the ACTIVE
target’s garbage in order to obtain discarded papers. This type of recon is faster to perform
3 and generally yields more actionable
information than passive recon
Passive Reconnaissance Tools
WIRESHARK GOOGLE
This is best known as network traffic analysis tool. This Google can provide a vast amount of
tool can be used to eavesdrop on the network traffic of
1 information on a variety of topic. By
a company using specialized google queries
(google dorking), you can gather
2 sensitive information for attacking your
[Link] target.
(eg. Index of /Hollywood)
This is one example of a variety of different websites 3
designed to help identify website that belong to an
organization. VIRUSTOTAL
4 This is a website designed to help with
analysis of potential malicious files.
SHODAN
5
This is a search engine for internet-connect devices.
Active Reconnaissance Tools
NMAP
This is probably the most well-known tool for active 1 NESSUS
network reconnaissance
This is a commercial vulnerability
scnner used to identify vulnerable
2 applications running on a system.
OPENVAS
This is a vulnerability scanner that was developed in
3
response to the commercialization of Nessus. NIKTO
This is a web server vulnerability scanner
4 that can be used for reconnaissance in a
manner similar to Nessus and OpenVAS.
METASPLOIT
5
This is primarily designed as an exploitation toolkit.
NMAP – The Active eye
• When it comes to hacking, knowledge is power. The more
knowledge you have about a target system or network, the
more options you have available.
• Nmap (Network Mapper) is a free and open source (license)
utility for network discovery and security auditing.
• Nmap was named “Security Product of the Year” by Linux
Journal, Info World, [Link], and Codetalker
Digest.
• Like most pentesting tools, nmap is run from the terminal.
Nmap is probably the most famous reconnaissance tool
among Pentesters and Hacker.
Nmap is …
POWERFUL EASY
FLEXIBLE FREE POPULAR
Nmap Switches
-h
Print a help 1 -sS
summary page Perform a TCP
2
-sU SYN scan
Perform a UDP scan 3 -sV
4 Probe open ports to determine
-O service/version info
Enable OS detection 5
-v
-oN
6 Enable verbosity
•Redirect normal output to 7
a given filename -oX
8 Produce output in a clean, XML
-p- format and store it in a given file
Perform a full port 9
scan -A
10 Enables “aggressive” scanning.
Nmap Script Engine (NSE)
1. SAFE
Won’t affect the target
6. BRUTE 2. INTRUSIVE
Try to brute force credentials for
Not safe: likely to affect the target
running services
Nmap
Script
Engine
5. AUTH 3. VULN
Scan for vulnerabilities
Attempt to bypass
authentication for running
services
4. EXPLOIT
Try to exploit a vulnerability
PRACTICALS
Practicals
Nmap Scanning using switches (-v –sV, -A , etc)
Nmap Scanning to detect anonymous ftp login
NSE scanning to exploit Eternal Blue Vulnerability
How to use nmap –h (help) switch to your advantage.
References
• Nmap - Switches and Scan Types in Nmap – JournalDev
• TryHackMe | Nmap
• Nmap: the Network Mapper - Free Security Scanner
• Ethical Hacking - Reconnaissance ([Link])
• Reconnaissance in The Cyber Kill Chain - Cyber Security
Insights ([Link])
• [Link]
Questions
Thank You