NMAP TUTORIAL ++ BAB II

Other Scanning Techniques

In my opinion nmap is the most superior network scanner. But there are some newer technologies being developed that are worth mentioning.

Xprobe2 ICMP based fingerprinting

Xprobe is a ICMP based passive fingerprinting tool, this is a newer technique being used very successfully instead of the old TCP based fingerprinting. Xprobe uses a different ICMP response to determine what Operating system the host is running, very similar to TCP based fingerprinting it compares it's results to a database. Another advantage of ICMP based fingerprinting is it's very fast, in most cases all it needs is one packet, unlike nmaps TCP fingerprinting thats needs to build custom packets and is quite time consuming, ICMP does not need to craft any specific packets. Each operating system has small differences in implementations of there TCP stack and Xprobe has a database of those differences.

[root@REDHATBOX xprobe2-0.1]# xprobe2 -v 192.168.0.3

XProbe2 v.0.1 Copyright (c) 2002-2003 fygrave@tigerteam.net, ofir@sys-security.com

[+] Target is 192.168.0.3
[+] Loading modules.
[+] Following modules are loaded:
[x]ICMP echo (ping)
[x]TTL distance
[x]ICMP echo
[x]ICMP Timestamp
[x]ICMP Address
[x]ICMP Info Request
[x]ICMP port unreach
[+] 7 modules registered
[+] Initializing scan engine
[+] Running scan engine
[+] Host: 192.168.0.3 is up (Guess probability: 100%)
[+] Target: 192.168.0.3 is alive
[+] Primary guess:
[+] Host 192.168.0.3 Running OS: "Linux Kernel 2.4.5 and above" (Guess probability: 95%)
[+] Other guesses:
[+] Host 192.168.0.3 Running OS: "Linux Kernel 2.2.x" (Guess probability: 95%)
[+] Host 192.168.0.3 Running OS: "NetBSD 1.6" (Guess probability: 87%)
[+] Host 192.168.0.3 Running OS: "Linux Kernel 2.4.0 - 2.4.4" (Guess probability: 83%)
[+] Host 192.168.0.3 Running OS: "SCO OpenServer Release 5" (Guess probability: 83%)
[+] Host 192.168.0.3 Running OS: "OpenBSD 2.5" (Guess probability: 83%)
[+] Host 192.168.0.3 Running OS: "NetBSD 1.5.0" (Guess probability: 83%)
[+] Host 192.168.0.3 Running OS: "NetBSD 1.5.1" (Guess probability: 83%)
[+] Host 192.168.0.3 Running OS: "NetBSD 1.5.2" (Guess probability: 83%)
[+] Host 192.168.0.3 Running OS: "FreeBSD 4.5" (Guess probability: 79%)
[+] Host 192.168.0.3 Running OS: "FreeBSD 4.4" (Guess probability: 79%)
-------------------------------------SNIP---------------------------------------------------------

Xprobe has successfully identified the operating system as linux running kernel 2.45. Thats correct. This test took about 30-60seconds so its allot faster than Nmaps -O TCP fingerprinting. The next test was how it would go against a windows XP pro box.

NMAP TUTOR ++ BAB I

Introduction to Nmap

Nmap is the network exploration tool, it is essentially one of the most important tools to a security engineer or pen-tester. It is used as it's name suggests as a network exploration tool. With nmap you can probe a entire network and find out what services are listening on each specific port. Not only that but it incorporates fingerprinting that compares different fingerprints and gives you a estimate on what operating system the machine is running. Nmap has allot of options or flags that let you manipulate how it scans, you can simply do a tcp()connect scan that makes a full connection to the host or a syn scan also known as half connection, test firewall rules and distinguish if they are firewalls or packet filters, idle scan and spoof your ip through another machine or throw out decoys to make your presence less traceable. Nmap runs on linux/bsd and windows, although we will only be discussing it's usage under linux, the windows version is just a port from linux and can still be used as a supplement if you want but you do have access to the linux version in the attack lab.

Options and flags

The nmap options or flags are a set of inbuilt variables that help you modify how nmap probes machines.

By simply typing nmap at the command prompt you will get a breif explaination of each flag.

[root@REDHATBOX root]# nmap
Nmap 3.30 Usage: nmap [Scan Type(s)] [Options]
Some Common Scan Types ('*' options require root privileges)
* -sS TCP SYN stealth port scan (default if privileged (root))
-sT TCP connect() port scan (default for unprivileged users)
* -sU UDP port scan
-sP ping scan (Find any reachable machines)
* -sF,-sX,-sN Stealth FIN, Xmas, or Null scan (experts only)
-sR/-I RPC/Identd scan (use with other scan types)
Some Common Options (none are required, most can be combined):
* -O Use TCP/IP fingerprinting to guess remote operating system
-p ports to scan. Example range: '1-1024,1080,6666,31337'
-F Only scans ports listed in nmap-services
-v Verbose. Its use is recommended. Use twice for greater effect.
-P0 Don't ping hosts (needed to scan www.microsoft.com and others)
* -Ddecoy_host1,decoy2[,...] Hide scan using many decoys
-6 scans via IPv6 rather than IPv4
-T General timing policy
-n/-R Never do DNS resolution/Always resolve [default: sometimes resolve]
-oN/-oX/-oG Output normal/XML/grepable scan logs to
-iL Get targets from file; Use '-' for stdin
* -S /-e Specify source address or network interface
--interactive Go into interactive mode (then press h for help)
Example: nmap -v -sS -O www.my.com 192.168.0.0/16 '192.88-90.*.*'
SEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES

Syn/Stealth Scanning. -sS TCP SYN stealth port scan (default if privileged (root))