## the Network Mapper * * * Nmap is a free and open source utility for network discovery and security auditing. Network mapper was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer ( [ Zenmap ]() ), a flexible data transfer, redirection, and debugging tool ( [ Ncat ]() ), a utility for comparing scan results ( [ Ndiff ]() ), and a packet generation and response analysis tool ( [ Nping ]() ). Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters firewalls are in use, and dozens of other characteristics. While Nmap is commonly used for security audits, many systems and network administrators find it useful for routine tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. It was originally written by Gordon Lyon and it can answer the following questions easily: 1. What computers did you find running on the local network? 2. What IP addresses did you find running on the local network? 3. What is the operating system of your target machine? 4. Find out what ports are open on the machine that you just scanned? 5. Find out if the system is infected with malware or virus. 6. Search for unauthorized servers or network service on your network. 7. Find and remove computers which don’t meet the organization’s minimum level of security. Network Mapper is … * ** Flexible ** : Supports dozens of advanced techniques for mapping out networks filled with IP filters, firewalls, routers, and other obstacles. This includes many [ port scanning ]() mechanisms (both TCP & UDP), [ OS detection ]() , [ version detection ]() , ping sweeps, and more. See the [ documentation page ]() . * ** Powerful ** : Nmap has been used to scan huge networks of literally hundreds of thousands of machines. * ** Portable ** : Most operating systems are supported, including Linux, Microsoft Windows, FreeBSD, OpenBSD, Solaris, IRIX, Mac OS X, HP-UX, NetBSD, Sun OS, Amiga, and more. * ** Easy ** : While Nmap offers a rich set of advanced features for power users, you can start out as simply as “nmap -v -A _ targethost _ “. Both traditional command line and graphical (GUI) versions are available to suit your preference. Binaries are available for those who do not wish to compile Nmap from source. * ** Free ** : The primary goals of the Nmap Project is to help make the Internet a little more secure and to provide administrators/auditors/hackers with an advanced tool for exploring their networks. Nmap is available for [ free download ]() , and also comes with full source code that you may modify and redistribute under the terms of the [ license ]() . * ** Well Documented ** : Significant effort has been put into comprehensive and up-to-date man pages, whitepapers, tutorials, and even a whole book! Find them in multiple languages [ here ]() . * ** Supported ** : While Nmap comes with no warranty, it is well supported by a vibrant community of developers and users. Most of this interaction occurs on the [ Nmap mailing lists ]() . Most bug reports and questions should be sent to the [ nmap-dev list ]() , but only after you read the [ guidelines ]() . We recommend that all users subscribe to the low-traffic [ nmap-hackers ]() announcement list. You can also find Nmap on [ Facebook ]() and [ Twitter ]() . For real-time chat, join the #nmap channel on [ Freenode ]() or [ EFNet ]() . * ** Acclaimed ** : Nmap has won numerous awards, including “Information Security Product of the Year” by Linux Journal, Info World and Codetalker Digest. It has been featured in hundreds of magazine articles, several movies, dozens of books, and one comic book series. Visit the [ press page ]() for further details. * ** Popular ** : Thousands of people download Nmap every day, and it is included with many operating systems (Redhat Linux, Debian Linux, Gentoo, FreeBSD, OpenBSD, etc). It is among the top ten (out of 30,000) programs at the Freshmeat.Net repository. This is important because it lends Nmap its vibrant development and user support communities. The Nmap Scripting Engine (NSE) is one of Nmap’s most powerful and flexible features. It allows users to write (and share) simple scripts to automate a wide variety of networking tasks. Those scripts are then executed in parallel with the speed and efficiency you expect from Nmap. Users can rely on the growing and diverse set of scripts distributed with Nmap, or write their own to meet custom needs. NSE was designed to be versatile, with the following tasks in mind: * ** Network discovery ** This is Nmap’s bread and butter. Examples include looking up whois data based on the target domain, querying ARIN, RIPE, or APNIC for the target IP to determine ownership, performing identd lookups on open ports, SNMP queries, and listing available NFS/SMB/RPC shares and services. * ** More sophisticated version detection ** The Nmap version detection system ( [ Chapter 7, _ Service and Application Version Detection _ ]( "Chapter 7. Service and Application Version Detection" ) ) is able to recognize thousands of different services through its probe and regular expression signature based matching system, but it cannot recognize everything. For example, identifying the Skype v2 service requires two independent probes, which version detection isn’t flexible enough to handle. Nmap could also recognize more SNMP services if it tried a few hundred different community names by brute force. Neither of these tasks are well suited to traditional Nmap version detection, but both are easily accomplished with NSE. For these reasons, version detection now calls NSE by default to handle some tricky services. This is described in [ the section called “Version Detection Using NSE” ]( "Version Detection Using NSE" ) . * ** Vulnerability detection ** When a new vulnerability is discovered, you often want to scan your networks quickly to identify vulnerable systems before the bad guys do. While Nmap isn’t a comprehensive [ vulnerability scanner ]() , NSE is powerful enough to handle even demanding vulnerability checks. Many vulnerability detection scripts are already available and we plan to distribute more as they are written. * ** Backdoor detection ** Many attackers and some automated worms leave backdoors to enable later reentry. Some of these can be detected by Nmap’s regular expression based version detection. For example, within hours of the MyDoom worm hitting the Internet, Jay Moran posted an Nmap version detection probe and signature so that others could quickly scan their networks for MyDoom infections. NSE is needed to reliably detect more complex worms and backdoors. * ** Vulnerability exploitation ** As a general scripting language, NSE can even be used to exploit vulnerabilities rather than just find them. The capability to add custom exploit scripts may be valuable for some people (particularly penetration testers), though we aren’t planning to turn Nmap into an exploitation framework such as [ Metasploit ]() . Scripts are written in the embedded [ Lua programming language ]() . NSE is activated with the ` -sC ` option (or ` --script ` if you wish to specify a custom set of scripts) and results are integrated into Nmap normal and XML output. [ ![Network Mapper: Nmap documentation](https://d21ic6tdqjqnyw.cloudfront.net/wp-content/uploads/2016/04/08083124/documentation1.jpg) ]() ## Examples: * * * ## Scan a single host or an IP address (IPv4) ### Scan a single ip address ### nmap 192.168.1.1 ## Scan a host name ### nmap blackhole.n0where.net ## Scan a host name with more info### nmap -v blackhole.n0where.net ## Scan multiple IP address or subnet (IPv4) nmap 192.168.1.1 192.168.1.2 192.168.1.3 ## works with same subnet i.e. 192.168.1.0/24 nmap 192.168.1.1,2,3 You can scan a range of IP address too: nmap 192.168.1.1-20 You can scan a range of IP address using a wildcard: nmap 192.168.1.* Finally, you scan an entire subnet: nmap 192.168.1.0/24 ## Read list of hosts/networks from a file (IPv4) The -iL option allows you to read the list of target systems using a text file. This is useful to scan a large number of hosts/networks. Create a text file as follows: cat > /tmp/test.txt nmap -iL /tmp/test.txt ## Excluding hosts/networks (IPv4) When scanning a large number of hosts/networks you can exclude hosts from a scan: nmap 192.168.1.0/24 --exclude 192.168.1.5 nmap 192.168.1.0/24 --exclude 192.168.1.5,192.168.1.254 OR exclude list from a file called /tmp/exclude.txt nmap -iL /tmp/scanlist.txt --excludefile /tmp/exclude.txt ## Turn on OS and version detection scanning script (IPv4) nmap -A 192.168.1.254 nmap -v -A 192.168.1.1 nmap -A -iL /tmp/scanlist.txt ## Find out if a host/network is protected by a firewall nmap -sA 192.168.1.254 nmap -sA blackhole.n0where.net ## Scan a host when protected by the firewall nmap -PN 192.168.1.1 nmap -PN blackhole.n0where.net ## Scan an IPv6 host/address The -6 option enable IPv6 scanning. The syntax is: nmap -6 IPv6-Address-Here nmap -6 blackhole.n0where.net nmap -6 2607:f0d0:1002:51::4 nmap -v A -6 2607:f0d0:1002:51::4 ## Scan a network and find out which servers and devices are up and running This is known as host discovery or ping scan: nmap -sP 192.168.1.0/24 ## How do I perform a fast scan? nmap -F 192.168.1.1 ## Display the reason a port is in a particular state nmap --reason 192.168.1.1 nmap --reason blackhole.n0where.net ## Show host interfaces and routes nmap --iflist ## How do I scan specific ports? map -p [port] hostName ## Scan port 80 nmap -p 80 192.168.1.1 ## Scan TCP port 80 nmap -p T:80 192.168.1.1 ## Scan UDP port 53 nmap -p U:53 192.168.1.1 ## Scan two ports ## nmap -p 80,443 192.168.1.1 ## Scan port ranges ## nmap -p 80-200 192.168.1.1 ## Combine all options ## nmap -p U:53,111,137,T:21-25,80,139,8080 192.168.1.1 nmap -p U:53,111,137,T:21-25,80,139,8080 blackhole.n0where.net nmap -v -sU -sT -p U:53,111,137,T:21-25,80,139,8080 192.168.1.254 ## Scan all ports with * wildcard ## nmap -p "*" 192.168.1.1 ## Scan top ports i.e. scan $number most common ports ## nmap --top-ports 5 192.168.1.1 nmap --top-ports 10 192.168.1.1 ## How do I detect remote operating system? nmap -O 192.168.1.1 nmap -O --osscan-guess 192.168.1.1 nmap -v -O --osscan-guess 192.168.1.1 ## How do I detect remote services (server / daemon) version numbers? nmap -sV 192.168.1.1 ## The fastest way to scan all your devices/computers for open ports ever nmap -T5 192.168.1.0/24 ## Only show open (or possibly open) ports nmap --open 192.168.1.1 nmap --open blackhole.n0where.net ## Show all packets sent and received nmap --packet-trace 192.168.1.1 nmap --packet-trace blackhole.n0where.net ## Scan a host using TCP ACK (PA) and TCP Syn (PS) ping If firewall is blocking standard ICMP pings, try the following host discovery methods: nmap -PS 192.168.1.1 nmap -PS 80,21,443 192.168.1.1 nmap -PA 192.168.1.1 nmap -PA 80,21,200-512 192.168.1.1 ## Scan a host using IP protocol ping nmap -PO 192.168.1.1 ## Scan a host using UDP ping This scan bypasses firewalls and filters that only screen TCP: nmap -PU 192.168.1.1 nmap -PU 2000.2001 192.168.1.1 ## Find out the most commonly used TCP ports using TCP SYN Scan ### Stealthy scan ### nmap -sS 192.168.1.1 ### Find out the most commonly used TCP ports using TCP connect scan (warning: no stealth scan) ### OS Fingerprinting ### nmap -sT 192.168.1.1 ### Find out the most commonly used TCP ports using TCP ACK scan nmap -sA 192.168.1.1 ### Find out the most commonly used TCP ports using TCP Window scan nmap -sW 192.168.1.1 ### Find out the most commonly used TCP ports using TCP Maimon scan nmap -sM 192.168.1.1 ## Scan a host for UDP services (UDP scan) Most popular services on the Internet run over the TCP protocol. DNS, SNMP, and DHCP are three of the most common UDP services. Use the following syntax to find out UDP services: nmap -sU nas03 nmap -sU 192.168.1.1 ## Scan for IP protocol This type of scan allows you to determine which IP protocols (TCP, ICMP, IGMP, etc.) are supported by target machines: nmap -sO 192.168.1.1 ## Scan a firewall for security weakness The following scan types exploit a subtle loophole in the TCP and good for testing security of common attacks: ## TCP Null Scan to fool a firewall to generate a response ## ## Does not set any bits (TCP flag header is 0) ## nmap -sN 192.168.1.254 ## TCP Fin scan to check firewall ## ## Sets just the TCP FIN bit ## nmap -sF 192.168.1.254 ## TCP Xmas scan to check firewall ## ## Sets the FIN, PSH, and URG flags, lighting the packet up like a Christmas tree ## nmap -sX 192.168.1.254 ## Scan a firewall for packets fragments The -f option causes the requested scan (including ping scans) to use tiny fragmented IP packets. The idea is to split up the TCP header over several packets to make it harder for packet filters, intrusion detection systems, and other annoyances to detect what you are doing. nmap -f 192.168.1.1 nmap -f fw2.nixcraft.net.in nmap -f 15 fw2.nixcraft.net.in ## Set your own offset size with the --mtu option ## nmap --mtu 32 192.168.1.1 ## Cloak a scan with decoys The -D option it appear to the remote host that the host(s) you specify as decoys are scanning the target network too. Thus their IDS might report 5-10 port scans from unique IP addresses, but they won’t know which IP was scanning them and which were innocent decoys: nmap -n -Ddecoy-ip1,decoy-ip2,your-own-ip,decoy-ip3,decoy-ip4 remote-host-ip nmap -n -D192.168.1.5,10.5.1.2,172.1.2.4,3.4.2.1 192.168.1.5 ## Scan a firewall for MAC address spoofing ### Spoof your MAC address ## nmap --spoof-mac MAC-ADDRESS-HERE 192.168.1.1 ### Add other options ### nmap -v -sT -PN --spoof-mac MAC-ADDRESS-HERE 192.168.1.1 ### Use a random MAC address ### ### The number 0, means nmap chooses a completely random MAC address ### nmap -v -sT -PN --spoof-mac 0 192.168.1.1 ## How do I save output to a text file? nmap 192.168.1.1 > output.txt nmap -oN /path/to/filename 192.168.1.1 nmap -oN output.txt 192.168.1.1 [ ![Network Mapper: Nmap download](https://d21ic6tdqjqnyw.cloudfront.net/wp-content/uploads/2016/05/08082805/Download3-1024x154.png) ]()