I dedicate this new series tutorial for those of you who are training for careers in the field of cyber security.
When it comes to attacking devices on a network, you can't hit what you can't see. Nmap gives you the ability to explore any devices connected to a network, finding information like the operating system a device is running and which applications are listening on open ports. This information lets a hacker design an attack that perfectly suits the target environment.
Network Reconnaissance for Beginners
After gaining access to a Wi-Fi, Ethernet, or remote network, the first step for most ethical hackers is to conduct recon to explore the network and learn more about any available targets. You may be familiar with some devices that announce themselves on a network, like other computers advertising file sharing. While this is a useful way of discovering devices on the same network as most devices do not advertise their presence on the network.
The solution to the problem of exploring a network is network scanning, made possible by programs like Nmap and arp-scan. We're only interested in the Nmap, which allows for highly detailed exploration and mapping of local and remote networks, though we can use Nmap to perform an ARP scan as you'll see later on. With Nmap, you can see who is on the network, what applications or operating system a target is running, and what the available attack surface is.
Using Nmap for Local Networks
Running an Nmap scan is often the best way to discover the size of the network and the number of devices that are connected to it. Running a "fast" Nmap scan (-F) on a network range can produce a list of all of the IP addresses belonging to active hosts on the network, plus some extra information.
johnny@kali-20:~$ sudo nmap -F 192.168.234.0/24
Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-04 00:17 GMT
Nmap scan report for 192.168.234.1
Host is up (0.0017s latency).
All 100 scanned ports on 192.168.234.1 are filtered
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.234.2
Host is up (0.00084s latency).
All 100 scanned ports on 192.168.234.2 are closed
MAC Address: 00:50:56:F9:C9:83 (VMware)
Nmap scan report for 192.168.234.101
Host is up (0.00070s latency).
Not shown: 92 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
143/tcp open imap
443/tcp open https
445/tcp open microsoft-ds
8080/tcp open http-proxy
8081/tcp open blackice-icecap
MAC Address: 00:0C:29:C8:C4:5E (VMware)
Nmap scan report for 192.168.234.120
Host is up (0.00085s latency).
All 100 scanned ports on 192.168.234.120 are filtered
MAC Address: 00:50:56:FC:11:06 (VMware)
Nmap scan report for 192.168.234.128
Host is up (0.00073s latency).
Not shown: 82 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
25/tcp open smtp
53/tcp open domain
80/tcp open http
111/tcp open rpcbind
139/tcp open netbios-ssn
445/tcp open microsoft-ds
513/tcp open login
514/tcp open shell
2049/tcp open nfs
2121/tcp open ccproxy-ftp
3306/tcp open mysql
5432/tcp open postgresql
5900/tcp open vnc
6000/tcp open X11
8009/tcp open ajp13
MAC Address: 00:0C:29:2A:D1:CC (VMware)
Nmap scan report for 192.168.234.100
Host is up (0.000043s latency).
All 100 scanned ports on 192.168.234.100 are closed
The operation above was done on my virtual lab. As you can see in the screenshot above, nmap was able to detect devices connected on my network. The data provided, combined with some basic information about services a device is running, can be used by itself as a list of targets for other hacking tools, but the capabilities of Nmap go far beyond simple host discovery.
The amount of info on a local network an Nmap scan can gather is impressive, including the MAC address and manufacturer of connected devices, the operating system a device is using, and the version of any services that are running on the device. Once you know how many devices are on the network and roughly what they are, the next step is to scan and examine devices of interest on the network.
Another key function of Nmap is to allow for port scanning of either individual devices or ranges of IP addresses including many devices. This allows an attacker to learn the minute details of a device they have discovered on a network, including information about ports open and services running. Ports are gateways that another device can connect through, so finding a bunch of services running on open ports can be a huge benefit to a hacker, especially if one of them has a version that is out of date and vulnerable.
Using Nmap for Remote Networks
In addition to scanning local networks, Nmap can also show information about remote networks as well. In fact, you can run Nmap against a website you want to examine, and it will parse it and retrieve the IP address associated with that web domain.
After grabbing the IP address and taking note of the port numbers that are open, further Nmap scans can reveal the operating system (-O) being used to host a remote website.
Finally, we can even learn about the versions of operating system running on the system. If we see one that is vulnerable to a known attack, this could make our job on the network much easier. Using the IP address we discovered earlier, we can run another scan with -sV that reveals that httpd 2.0 is being used on the target machine.
These details combined; the IP address of a remote website or server, the operating system running on the device, and the version of any application running on open ports we discover — is everything an ethical hacker needs to get started attacking devices on an authorized network.
What You'll Need
To use Nmap, you'll need a system that supports it. Fortunately, Nmap is cross-platform and works on Windows, Linux, and macOS, and comes preinstalled on many Linux distros. If you don't have it, it's easy to install.
You'll also need a network to connect to and scan to try these techniques, I'll strongly suggest you create a virtual lab where you can install multiple operating systems on a virtual box or vmware workstation and practice these tutorials as you need a safe environment to practice and explore but be aware that scanning is often seen as a prelude to an attack and may be met with increased scrutiny therefore don't scan a network you're not authorize to. Suspicious behavior like scanning an entire network is a great way to gain attention.
Comments
Post a Comment