Nmap Network Exploration and Security Auditing Cookbook Third Edition Network discovery and security scanning at your fingertips Paulino Calderon BIRMINGHAM—MUMBAI Nmap Network Exploration and Security Auditing Cookbook Third Edition Copyright © 2021 Packt Publishing All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews. Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author(s), nor Packt Publishing or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book. Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information. Group Product Manager: Wilson D'souza Publishing Product Manager: Rahul Nair Senior Editor: Arun Nadar Content Development Editor: Mrudgandha Kulkarni Technical Editor: Shruthi Shetty Copy Editor: Safis Editing Project Coordinator: Ajesh Devavaram Proofreader: Safis Editing Indexer: Rekha Nair Production Designer: Vijay Kamble First published: November 2012 Second edition: May 2017 Third edition: August 2021 Production reference: 1200721 Published by Packt Publishing Ltd. Livery Place 35 Livery Street Birmingham B3 2PB, UK. ISBN 978-1-83864-935-7 www.packt.com Special thanks to Fyodor for mentoring me back in the first GSoC program and to all the dev team, from whom I have learned a lot and who I now have the pleasure of knowing personally. Omar and Yael, for always supporting me and not only being my hermanos but also my brothers. Martha, for helping me be the best version of myself. Nothing but love to all my friends. It is impossible to list all of you, but know that I appreciate all your love and support. Contributors About the author Paulino Calderon (@calderpwn on Twitter) is a published author and international speaker with over 10 years of professional experience in network and application security. He cofounded Websec in 2011, a consulting firm securing applications, networks, and digital assets operating in North America. When he isn't traveling to security conferences or consulting for Fortune 500 companies with Websec, he spends peaceful days enjoying the beach in Cozumel, Mexico. His contributions have reached millions of users through Nmap, Metasploit, OWASP Mobile Security Testing Guide (MSTG), OWASP Juice Shop, and OWASP IoT Goat. To my father, Dr. Paulino Calderon Medina, who taught me that our only limitations are the ones we set up in our minds, and my mother, Edith Pale Perez, who supported me unconditionally and always believed in me. About the reviewer Nikhil Kumar has more than 7 years of experience in cyber security with national and multinational companies. His core expertise and passions are information security, vulnerability assessment, penetration testing on network/infrastructure, and DAST/SAST/ IAST on web and mobile applications. He is an avid blogger and regular speaker on cyber-related topics at many colleges and private and government firms. To reach his blogs or LinkedIn, visit the following sites: https://www.linkedin.com/in/nikhil-kumar-bb7a0590 https://blogs4all2017.blogspot.com https://iot4all2017.blogspot.com He is a postgraduate in computer science and holds numerous cyber certifications, including Certified Ethical Hacker from the EC Council, ISO 27001 Lead Auditor from the IRCA, Certified 365 Security Administrator from Microsoft, Certified Azure Security Engineer Associate from Microsoft, Cyber Crime Intervention Officer from ISAC India, and Network Security Expert from FORTINET. I would like to thank my family, who have always motivated me to grow in my life and career. I would like to thank my friends and employers, who have always stood by me. My friends, Aphin Alexander, Rajdeep Gogoi, Prafull Kurekar, and Kanchan Jhangiani, have always been there for me. I would also like to thank Anubhav Kumar Lal and Ravali Vangala for giving me a reason to continue learning and growing. Table of Contents Preface 1 Nmap Fundamentals Technical requirements 2 Using NSE scripts Building Nmap's source code 3 against a target host 22 Getting ready 3 How to do it... 23 How to do it... 4 How it works... 23 How it works... 5 There's more... 24 There's more... 5 Scanning random targets on the internet 28 Finding online hosts 6 How to do it... 28 How to do it... 6 How it works... 29 How it works... 8 There's more... 29 There's more... 8 Collecting signatures Listing open ports on a target 10 of web servers 30 How to do it... 10 How to do it... 30 How it works... 11 How it works... 31 There's more... 12 There's more... 31 Fingerprinting OSes and Scanning with Rainmap Lite 32 services running on a target 16 Getting ready 32 How to do it... 16 How to do it... 33 How it works... 18 How it works... 33 There's more... 19 There's more... 34 viii Table of Contents 2 Getting Familiar with Nmap's Family Monitoring servers remotely How it works... 45 with Nmap and Ndiff 36 There's more... 45 Getting ready 36 Discovering systems with How to do it... 36 weak passwords with Ncrack 45 How it works... 38 Getting ready 46 There's more... 39 How to do it... 46 Crafting ICMP echo How it works... 46 replies with Nping 39 There's more... 47 How to do it... 40 Using Ncat to diagnose How it works... 40 a network client 48 There's more... 41 How to do it... 48 Managing multiple scanning How it works... 50 profiles with Zenmap 41 There is more... 50 How to do it... 41 Defending against Nmap How it works... 43 service detection scans 50 There's more... 43 How to do it... 51 Running Lua scripts against a How it works... 51 network connection with Ncat 44 There's more... 51 How to do it... 44 3 Network Scanning Discovering hosts with There's more... 58 TCP SYN ping scans 54 Discovering hosts How to do it... 54 with UDP ping scans 58 How it works... 55 How to do it... 59 There's more... 56 How it works... 59 Discovering hosts There's more... 59 with TCP ACK ping scans 57 Selecting ports in UDP ping scans 59 How to do it... 57 Discovering hosts How it works... 58 with ICMP ping scans 60 Table of Contents ix How to do it... 60 There's more... 71 How it works... 60 Discovering hosts with There's more... 60 broadcast ping scans 72 Discovering hosts How to do it... 72 with SCTP INIT ping scans 61 How it works... 72 How to do it... 61 There's more... 73 How it works... 62 Scanning IPv6 addresses 74 There's more... 63 How to do it... 75 Discovering hosts with How it works... 75 IP protocol ping scans 63 There's more... 75 How to do it... 63 Spoofing the origin IP How it works... 64 of a scan 77 There's more... 65 Getting ready 78 Discovering hosts with How to do it... 78 ARP ping scans 66 How it works… 79 How to do it... 66 There's more... 79 How it works... 67 Using port scanning for There's more... 68 host discovery 80 Performing advanced How to do it... 80 ping scans 70 How it works... 81 How to do it... 70 There's more... 82 How it works... 71 4 Reconnaissance Tasks Performing IP address There's more... 89 geolocation 84 Obtaining traceroute Getting ready 85 geolocation information 90 How to do it... 85 How to do it... 90 How it works... 86 How it works... 91 There's more... 86 There's more... 91 Getting information Querying Shodan from WHOIS records 87 to obtain target information 92 How to do it... 87 Getting ready 93 How it works... 89