7. Enumeration tools : Nmap

Summary

In this video, the presenter introduces the basics of using Nmap, a network scanning tool, to identify active services and open ports on a server. The video covers fundamental commands like scanning a domain with Nmap, using different options to gather detailed information about services and their versions, and utilizing scripts for deeper analysis. The presenter also demonstrates more advanced features, including outputting results to a file and exploring helpful commands through Nmap's help function. This video serves as a practical guide for beginners to intermediate users looking to improve their network scanning skills.

Takeaways

• 😀 Nmap is used to scan and gather information about open ports and services running on a server or asset.
• 😀 The basic Nmap command for scanning a domain, like 'nmap idn.id', scans 1000 well-known ports by default.
• 😀 Even though 'idn.id' is protected from scanning, Nmap still scans up to 65,000 ports in some cases.
• 😀 There are several useful options in Nmap, such as '-sT' for TCP connect scan and '-sV' for service version scanning.
• 😀 The '-v' option allows users to view detailed output, which shows open ports and the services running on them.
• 😀 The '-sC' option enables the use of Nmap scripts (NSE) to gather more detailed information about services on open ports.
• 😀 NSE scripts can be run on specific ports like port 80 to discover additional details about the service, like its application name.
• 😀 Users can scan specific ports, multiple ports, or ranges of ports using Nmap.
• 😀 The '-oN' option allows users to save the scan output to a file for later review or analysis.
• 😀 To get more help and explore additional commands, users can refer to Nmap's built-in help system using 'nmap --help'.

Q & A

What is the purpose of using nmap in this tutorial?

The purpose of using nmap is to perform network scanning, specifically to find open ports and services running on a server or network asset.

What is the basic nmap command shown in the tutorial?

The basic nmap command shown in the tutorial is `nmap idn.id`, which scans the domain `idn.id` for open ports.

How many ports does nmap scan by default?

By default, nmap scans 1000 well-known ports, not necessarily from port 1 to 1000 but from a selection of 1000 common ports.

What is the significance of using `-sS` in the nmap command?

`-sS` in the nmap command is used to perform a TCP SYN scan, which is a stealth scan that helps identify open ports without fully establishing a connection.

What does the `-A` option do in nmap?

`-A` enables aggressive scanning, which includes service version detection, OS fingerprinting, and script scanning, among other features.

What is the benefit of using the `-sV` option in nmap?

The `-sV` option is used to determine the version of the services running on open ports, which helps identify specific applications running on the server.

What does `nmap -sC` do in the context of this tutorial?

`nmap -sC` runs a set of default scripts (NSE - Nmap Scripting Engine) to gather additional information about the target, such as service details or vulnerabilities.

How can users limit the nmap scan to specific ports or a range of ports?

Users can limit the scan to specific ports or a range by specifying the ports directly in the nmap command, such as `nmap -p 80,443` for specific ports or `nmap -p 1-100` for a range of ports.

What is the use of the `-oN` option in nmap?

The `-oN` option is used to output the results of the nmap scan to a file in a human-readable format.

What is a useful way to explore additional nmap options?

A useful way to explore additional nmap options is by using the `nmap --help` command, which provides detailed information about the available flags and options.