nmap tutorial

Beginner's Guide to Nmap

hi,readers

Getting Nmap and Basic Use

You'll find Nmap packaged for most major Linux distros. [backtrack]

The basic syntax for Nmap is Nmap Scan Type Options target. Let's say you want to scan a host to see what operating system it is running. To do this, run the following:

nmap -O target.host.com

Note that Nmap requires root privileges to run this type of scan. The scan might take a minute or so to run, so be patient. When it finishes, you'll see something like this:

Starting Nmap 5.21 ( http://nmap.org ) at 2010-02-27 23:52 EST
Nmap scan report for 10.0.0.1
Host is up (0.0015s latency).
Not shown: 997 closed ports
PORT      STATE SERVICE
53/tcp    open  domain
5009/tcp  open  airport-admin
10000/tcp open  snet-sensor-mgmt
MAC Address: 00:11:24:6B:43:E2 (Apple Computer)
Device type: WAP|printer
Running: Apple embedded, Canon embedded, Kyocera embedded, Xerox embedded
OS details: VxWorks: Apple AirPort Extreme v5.7 or AirPort Express v6.3; Canon imageRUNNER printer (5055, C3045, C3380, or C5185); Kyocera FS-4020DN printer; or Xerox Phaser 8860MFP printer
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.21 seconds

As you can see, Nmap provides a lot of data. Here it takes a guess at the operating system that might be running on the system. I ran this particular scan against an Apple Airport Extreme router. As an added bonus, Nmap tells me that the device is one hop away, the MAC address of the device and manufacturer of the NIC, the open ports, and how long the scan took.

Here's the result of another scan, against a desktop machine running Ubuntu 9.10:

Starting Nmap 5.21 ( http://nmap.org ) at 2010-02-28 00:00 EST
Nmap scan report for 10.0.0.6
Host is up (0.0039s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
MAC Address: 00:17:08:2A:D6:F0 (Hewlett Packard)
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.19 - 2.6.31
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 3.40 seconds

Here we see that the system has an HP NIC (it's an HP workstation), running the Linux kernel somewhere between Linux 2.6.19 and 2.6.31. You may not be able to get an explicit identification of the operating system down to the version of Linux.

Practice Hosts

In the examples above, I chose a local router and one of my workstations in part because I have the permission to scan them. You can use Nmap to scan virtually any host. However, it's a bad idea to run many scans against hosts you're not in control of or don't have permission to scan. The Nmap folks have a test host at scanme.nmap.org that can be used for testing, so long as you're not running any tests of exploits or Denial of Service (DoS) attacks.

Some admins don't appreciate unexpected scans, so use best judgment and restrict scans to hosts that are on your own network or that you have permission to scan. It may also be against your ISP's terms of service to use some of Nmap's more aggressive scan features, so be careful out there!

Multiple Hosts

You can scan more than one host at a time using nmap. If you're using IP addresses, you can specify a range like 10.0.0.1-6 or a range like 10.0.0.0/24. The 10.0.0.1-6 would scan hosts 10.0.0.1, 10.0.0.2, 10.0.0.3 through 10.0.0.6. Using the /24 notation would scan the whole range of hosts from 10.0.0.0 to 10.0.0.255. For example, to scan 10.0.0.1 through 10.0.0.42 to learn what OS they might be running I'd use nmap -O 10.0.0.1-42.

If you have hostnames instead of IP addresses, you can separate them with a space on the command line, like so:

nmap -O host1.target.com host2.target.com

Checking Open Ports

If you give Nmap no options at all and just point it at a given host it will scan for open ports and report back those that are open, and what service is running on them. For instance, running nmaptarget.hostname.com might yield something like this:

Interesting ports on target.hostname.com (10.0.0.88):
Not shown: 1711 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
3306/tcp open  mysql

Nmap done: 1 IP address (1 host up) scanned in 0.228 seconds

Here you can see that there are three ports open: 22, 80, and 3306 which run SSH, HTTP, and MySQL respectively. Nmap recognizes six states: open, closed, filtered, unfiltered, open|filtered, and closed|filtered. These are mostly self-explanatory. See the Nmap docs for more on these states. If Nmap can tell what service is running, it will report it under the SERVICE column.

If you'd like a little more information, crank it up a notch by adding one or two -v options to the command. For example, using nmap -vv host.target.com would produce something like this:

Initiating Ping Scan at 11:44
Scanning 10.0.0.28 [1 port]
Completed Ping Scan at 11:44, 0.00s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 11:44
Completed Parallel DNS resolution of 1 host. at 11:44, 0.00s elapsed
Initiating Connect Scan at 11:44
Scanning host.target.com (10.0.0.28) [1714 ports]
Discovered open port 22/tcp on 10.0.0.28
Discovered open port 80/tcp on 10.0.0.28
Discovered open port 3306/tcp on 10.0.0.28
Completed Connect Scan at 11:44, 0.08s elapsed (1714 total ports)
Host host.target.com (10.0.0.28) appears to be up ... good.
Interesting ports on host.target.com (10.0.0.28):
Not shown: 1711 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
3306/tcp open  mysql

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.104 seconds

Nmap provides a lot more information when using the verbose (-v) option.

Service Scans

If you're really curious about what services a host might be running, try the -sV options. This will do a more aggressive scan to try to figure out what versions of services are running on a given host, and also might help determine more specifically what OS a host is running. For instance, I ran nmap -sV against a test server and got this in response:

Starting Nmap 5.21 ( http://nmap.org ) at 2010-02-28 00:15 EST

Nmap scan report for test.host.net (XX.XXX.XXX.XX)
Host is up (0.090s latency).
Not shown: 965 closed ports, 33 filtered ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)
80/tcp open  http    Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.10 with Suhosin-Patch)
Service Info: OS: Linux

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.43 seconds

As you can see, Nmap can "fingerprint" the packets and identify the versions of the software running on the SSH and HTTP ports. Here you can see that the system being pinged is a Ubuntu box with Apache 2.2.8 and OpenSSH 4.7p1. This can be useful for a number of reasons. A quick Nmap scan can identify systems that are running unpatched systems and therefore ones that might be vulnerable to known exploits.

What's on My Network?

Not quite sure what might be running on your network? Try using nmap -sP, which will run a ping scan on the specified network. For instance, nmap -sP 10.0.0.0/24 will scan the 256 hosts from 10.0.0.0 through 10.0.0.255 to see if they're available, and report back. You can also use a range, such as nmap -sP 10.0.0.1-15.

Zenmap

Finally, if all this command line fun is not your bag, Nmap has a GUI that you can use to build and execute commands. Called Zenmap, the GUI will let you specify targets, run scans, display the results and even save and compare them against one another.

When you open Zenmap, you can give it a target to scan and select one of the profile scans to get started. It includes your basic ping scan, quick scans, some more intense scans that include UDP services, and so forth. The Zenmap GUI is a good way to get acquainted with Nmap, but it's also a good idea to know how to use Nmap from the command line if you're going to be working with it often.

In a future tutorial we'll take a more in-depth look at Nmap and specific tasks you might want to do with Nmap. I hope this overview gave a good sense what Nmap can do and helps you get started working with Nmap.