Note: This is part of a series on BackTrack 5 tool reviews. It is not meant to be an exhaustive analysis of any tool, just a demonstration of the tool using real-world targets.
No, I'm not going to review "Nmap" in a single blog post; you could write an entire book about Nmap (Fyodor did, you should buy it).
This post is based upon a recent client experience: you run a UDP scan and you get the dreaded open|filtered. In the scan below, some UDP ports appear to be open (111, 177, 2049), but all others are open|filtered, which means Nmap doesn't know:
nmap -sU ###.###.###.### -p 1-65535
--- snip ---
PORT STATE SERVICE
67/udp open|filtered dhcps
69/udp open|filtered tftp
111/udp open rpcbind
123/udp open|filtered ntp
177/udp open xdmcp
514/udp open|filtered syslog
657/udp open|filtered rmc
832/udp open|filtered unknown
2049/udp open nfs
2279/udp open|filtered xmquery
3161/udp open|filtered unknown
32820/udp open|filtered unknown
32825/udp open|filtered unknown
32827/udp open|filtered unknown
32870/udp open|filtered unknown
32871/udp open|filtered unknown
32872/udp open|filtered unknown
32897/udp open|filtered unknown
-- snip --
Obviously, this isn't very useful. The goal here is to disambiguate open ports from filtered reports. One way to do that is to add service detection (-sV):
nmap -sU -sV ###.###.###.### -p 1-65535
-- snip --
PORT STATE SERVICE VERSION
67/udp open|filtered dhcps
69/udp open|filtered tftp
111/udp open rpcbind 2-4 (rpc #100000)
123/udp open|filtered ntp
177/udp open xdmcp XDMCP (willing; status: 6 users load: 14., 14., 12.)
514/udp open|filtered syslog
657/udp open|filtered rmc
832/udp open pcnfsd 1-2 (rpc #150001)
2049/udp open nfs 2-3 (rpc #100003)
2279/udp open|filtered xmquery
3161/udp open snmp Lexmark SNMP service
32820/udp open rpcbind 2-4 (rpc #100000)
32825/udp open pcnfsd 1-2 (rpc #150001)
32827/udp open cmsd 2-5 (rpc #100068)
32870/udp open mountd 1-3 (rpc #100005)
32871/udp open mountd 1-3 (rpc #100005)
32872/udp open status 1 (rpc #100024)
32897/udp open nlockmgr 1-4 (rpc #100021)
-- snip --
You can see here that a number of additional services are running which we could not detect with the simple UDP scan. One additional thing you can do is add the --reason switch, which describes which discovery test the port responded to:
nmap -sU -sV ###.###.###.### -p 1-65535 --reason
-- snip --
PORT STATE SERVICE REASON VERSION
67/udp open|filtered dhcps no-response
69/udp open|filtered tftp no-response
111/udp open rpcbind udp-response 2-4 (rpc #100000)
123/udp open|filtered ntp no-response
177/udp open xdmcp udp-response XDMCP (willing; status: 6 users load: 14., 14., 12.)
514/udp open|filtered syslog no-response
657/udp open|filtered rmc no-response
832/udp open pcnfsd udp-response 1-2 (rpc #150001)
2049/udp open nfs udp-response 2-3 (rpc #100003)
2279/udp open|filtered xmquery no-response
3161/udp open snmp udp-response Lexmark SNMP service
32820/udp open rpcbind udp-response 2-4 (rpc #100000)
32825/udp open pcnfsd udp-response 1-2 (rpc #150001)
32827/udp open cmsd udp-response 2-5 (rpc #100068)
32870/udp open mountd udp-response 1-3 (rpc #100005)
32871/udp open mountd udp-response 1-3 (rpc #100005)
32872/udp open status udp-response 1 (rpc #100024)
32897/udp open nlockmgr udp-response 1-4 (rpc #100021)
-- snip --
Lastly, a somewhat unrelated tip: I didn't include it here for reasons of space, but I always use the -v (verbose) option. Always nice to have more information, especially when documenting your penetration test.
Showing posts with label nmap. Show all posts
Showing posts with label nmap. Show all posts
07 March 2012
27 June 2009
Fast scanning a Class B
I'm looking to optimize a scan of a class B network. I do not need DNS resolution (-n) and I am only looking for one open port per IP address. The current ranges are overseas (although not always) thus the high max-rtt-timeout (1000). Also, I'm more concerned with speed than accuracy; in other words I'd rather get the scans done faster at the expense of maybe missing something (thus max-retries at one) Here is my command thus far:
This takes roughly 90-100 minutes per class B. Recommendations?
nmap -v -sS -PN -n -p# -oN ###-###.txt --max-rtt-timeout 1000 --max-retries 1 ###.###.0.0/16
This takes roughly 90-100 minutes per class B. Recommendations?
16 June 2009
Nmap scan of Red Flag Linux (live cd)
Starting Nmap 4.85BETA9 ( http://nmap.org ) at 2009-06-14 17:34 UTC
NSE: Loaded 28 scripts for scanning.
Initiating ARP Ping Scan at 17:34
Scanning 192.168.1.151 [1 port]
Completed ARP Ping Scan at 17:34, 0.01s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 17:34
Completed Parallel DNS resolution of 1 host. at 17:34, 0.04s elapsed
Initiating SYN Stealth Scan at 17:34
Scanning 192.168.1.151 [1000 ports]
Discovered open port 111/tcp on 192.168.1.151
Completed SYN Stealth Scan at 17:34, 1.91s elapsed (1000 total ports)
Initiating Service scan at 17:34
Scanning 1 service on 192.168.1.151
Completed Service scan at 17:35, 6.02s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against 192.168.1.151
NSE: Script scanning 192.168.1.151.
NSE: Starting runlevel 1 scan
Initiating NSE at 17:35
Completed NSE at 17:35, 0.08s elapsed
NSE: Script Scanning completed.
Host 192.168.1.151 is up (0.0048s latency).
Interesting ports on 192.168.1.151:
Not shown: 999 closed ports
PORT STATE SERVICE VERSION
111/tcp open rpcbind
| rpcinfo:
| 100000 2,3,4 111/udp rpcbind
| 100024 1 51586/udp status
| 100000 2,3,4 111/tcp rpcbind
|_ 100024 1 52983/tcp status
MAC Address: 00:0C:29:35:59:37 (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.9 - 2.6.27
Uptime guess: 0.016 days (since Sun Jun 14 17:12:20 2009)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=204 (Good luck!)
IP ID Sequence Generation: All zeros
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.65 seconds
Raw packets sent: 1021 (45.684KB) | Rcvd: 1017 (41.408KB)
NSE: Loaded 28 scripts for scanning.
Initiating ARP Ping Scan at 17:34
Scanning 192.168.1.151 [1 port]
Completed ARP Ping Scan at 17:34, 0.01s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 17:34
Completed Parallel DNS resolution of 1 host. at 17:34, 0.04s elapsed
Initiating SYN Stealth Scan at 17:34
Scanning 192.168.1.151 [1000 ports]
Discovered open port 111/tcp on 192.168.1.151
Completed SYN Stealth Scan at 17:34, 1.91s elapsed (1000 total ports)
Initiating Service scan at 17:34
Scanning 1 service on 192.168.1.151
Completed Service scan at 17:35, 6.02s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against 192.168.1.151
NSE: Script scanning 192.168.1.151.
NSE: Starting runlevel 1 scan
Initiating NSE at 17:35
Completed NSE at 17:35, 0.08s elapsed
NSE: Script Scanning completed.
Host 192.168.1.151 is up (0.0048s latency).
Interesting ports on 192.168.1.151:
Not shown: 999 closed ports
PORT STATE SERVICE VERSION
111/tcp open rpcbind
| rpcinfo:
| 100000 2,3,4 111/udp rpcbind
| 100024 1 51586/udp status
| 100000 2,3,4 111/tcp rpcbind
|_ 100024 1 52983/tcp status
MAC Address: 00:0C:29:35:59:37 (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.9 - 2.6.27
Uptime guess: 0.016 days (since Sun Jun 14 17:12:20 2009)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=204 (Good luck!)
IP ID Sequence Generation: All zeros
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.65 seconds
Raw packets sent: 1021 (45.684KB) | Rcvd: 1017 (41.408KB)
03 June 2009
Nmap scan of Kylin OS v2.1 installation
Starting Nmap 4.85BETA9 ( http://nmap.org ) at 2009-06-03 21:31 Eastern Daylight Time
NSE: Loaded 28 scripts for scanning.
Initiating ARP Ping Scan at 21:32
Scanning 192.168.1.150 [1 port]
Completed ARP Ping Scan at 21:32, 0.30s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 21:32
Completed Parallel DNS resolution of 1 host. at 21:32, 0.02s elapsed
Initiating SYN Stealth Scan at 21:32
Scanning 192.168.1.150 [1000 ports]
Discovered open port 22/tcp on 192.168.1.150
Discovered open port 6000/tcp on 192.168.1.150
Increasing send delay for 192.168.1.150 from 0 to 5 due to max_successful_tryno increase to 5
Completed SYN Stealth Scan at 21:32, 6.86s elapsed (1000 total ports)
Initiating Service scan at 21:32
Scanning 2 services on 192.168.1.150
Completed Service scan at 21:32, 6.02s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against 192.168.1.150
NSE: Script scanning 192.168.1.150.
NSE: Starting runlevel 1 scan
Initiating NSE at 21:32
Completed NSE at 21:32, 0.52s elapsed
NSE: Script Scanning completed.
Host 192.168.1.150 is up (0.00s latency).
Interesting ports on 192.168.1.150:
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.6.1p2 (protocol 1.99)
|_ sshv1: Server supports SSHv1
| ssh-hostkey: 1024 cd:e6:34:91:7a:67:f0:44:b4:56:5e:d5:b8:c3:55:67 (RSA1)
| 1024 0e:ed:49:15:ea:64:12:c8:27:b5:40:a7:e0:d0:64:cc (DSA)
|_ 1024 5d:30:80:4f:8e:7c:b2:fe:e5:2a:48:5d:98:cc:d4:d5 (RSA)
6000/tcp open X11 (access denied)
MAC Address: 00:0C:29:22:A2:A1 (VMware)
Device type: general purpose
Running: FreeBSD 5.X
OS details: FreeBSD 5.4 or 5.5 (x86)
Uptime guess: 0.197 days (since Wed Jun 03 16:48:28 2009)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=254 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Unix
Read data files from: C:\Program Files\Security Tools\Nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.72 seconds
Raw packets sent: 1353 (60.292KB) | Rcvd: 1018 (41.172KB)
NSE: Loaded 28 scripts for scanning.
Initiating ARP Ping Scan at 21:32
Scanning 192.168.1.150 [1 port]
Completed ARP Ping Scan at 21:32, 0.30s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 21:32
Completed Parallel DNS resolution of 1 host. at 21:32, 0.02s elapsed
Initiating SYN Stealth Scan at 21:32
Scanning 192.168.1.150 [1000 ports]
Discovered open port 22/tcp on 192.168.1.150
Discovered open port 6000/tcp on 192.168.1.150
Increasing send delay for 192.168.1.150 from 0 to 5 due to max_successful_tryno increase to 5
Completed SYN Stealth Scan at 21:32, 6.86s elapsed (1000 total ports)
Initiating Service scan at 21:32
Scanning 2 services on 192.168.1.150
Completed Service scan at 21:32, 6.02s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against 192.168.1.150
NSE: Script scanning 192.168.1.150.
NSE: Starting runlevel 1 scan
Initiating NSE at 21:32
Completed NSE at 21:32, 0.52s elapsed
NSE: Script Scanning completed.
Host 192.168.1.150 is up (0.00s latency).
Interesting ports on 192.168.1.150:
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.6.1p2 (protocol 1.99)
|_ sshv1: Server supports SSHv1
| ssh-hostkey: 1024 cd:e6:34:91:7a:67:f0:44:b4:56:5e:d5:b8:c3:55:67 (RSA1)
| 1024 0e:ed:49:15:ea:64:12:c8:27:b5:40:a7:e0:d0:64:cc (DSA)
|_ 1024 5d:30:80:4f:8e:7c:b2:fe:e5:2a:48:5d:98:cc:d4:d5 (RSA)
6000/tcp open X11 (access denied)
MAC Address: 00:0C:29:22:A2:A1 (VMware)
Device type: general purpose
Running: FreeBSD 5.X
OS details: FreeBSD 5.4 or 5.5 (x86)
Uptime guess: 0.197 days (since Wed Jun 03 16:48:28 2009)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=254 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Unix
Read data files from: C:\Program Files\Security Tools\Nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.72 seconds
Raw packets sent: 1353 (60.292KB) | Rcvd: 1018 (41.172KB)
Subscribe to:
Posts (Atom)