You are on page 1of 467
NETWORK SCANNING NMAP Gordon “Fyodor” Lyon islet me elfe) Nmap.Org Nmap Network Scanning Official Nmap Project Guide to Network Discovery and Security Scanning Gordon “Fyodor” Lyon From port scanning basics for novices to the type of packet crafting used by advanced hackers, this book by Nmap's author and maintainer suits all levels of security and networking professionals. Rather than simply document what every Nmap option does, Nmap Network Scanning demonstrates how these features can be applied to solve real world tasks such as penetration testing, taking network inventory, detecting rogue wireless access points or open proxies, quashing network worm and virus outbreaks, and much more. Examples and diagrams show actual communication on the wire. This book is essential for anyone who needs to get the most out of Nmap, particularly security auditors and systems or network administrators. Nmap Network Scanning: Official Nmap Project Guide to Network Discovery and Security Scanning by Gordon “Fyodor” Lyon 2 978-0-979958 7-1-7 ISBN-10: 0-9799587-1-7 Library of Congress Control Number (LCN): 2008940582 Library Of Congress Subject Headings: 1. Computer networks--Security measures 2. Computer security Published by Insecure.Com LLC. For information on bulk purchases, special sales, rights, book distributors, or translations, please contact us directly Insecure.Com LLC 370 Altair Way #113 Sunnyvale, CA 94086-6161 United States Email: sales @insecure.com; Phone: +1-650-989-4206; Fax: +1-650-989-4206 December 2008 -Release: August 2008 ‘Zero-Day Release: May 2008 Copyright © 2008 by Insecure.Com LLC. All rights reserved. Except where noted otherwise in this work, no part may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner. Nmap is a registered trademark of Insecure.Com LLC. Other product and company names mentioned herein may be the trademarks of their respective owners. Where those designations appear in this book, and the publisher was aware of a trademark claim, the designations have been printed with initial capital letters or in all capitals The authors and publisher have taken care in the preparation of this book, but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for incidental or consequential damages in connection with or arising out ofthe use of the information or programs contained herein Table of Contents Preface ...... ai z xxi 1. Introduction .. xxi 2. Intended Audience and Organization - eeenee XXL 3. Conventions xxii 4, Other Resources ....... xxiii 5. Request for Comments... : ea see XIV 6. Acknowledgements r sevseeee XXIV 6.1. Technology Used to Create This Book * J a ey 7. TCPIP Reference .... : x aes eee, KYL 1, Getting Started with Nmap 1.1. Introduction 1.2, Nmap Overview and D 1.2.1, Avatar On 1.2.2, Saving the Human Race 1.2.3, MadHat in Wonderland 1.3. The Phases of an Nmap Scan 1.4, Legal Issues 1.4.1 Is Unauthorized Port Scanning a Crime? : 1.4.2. Can Port Scanning Crash the Target Computer/Networks? 1.4.3, Nmap Copyright 1.5. The History and Future of Nmap 2. Obtaining, Compiling, Installing, and Removing Nmap 2.1. Introduction 2.11. Testing Whether Nmap is Already Installed 2.12. Command-line and Graphical Interfaces 2.1.3. Downloading Nmap 2.14, Verifying the Integrity of Nmap Downloads 2.1.5. Obtaining Nmap from the Subversion (SVN) Repository 2.2. Unix Compilation and Installation from Source Code 3 2.1. Configure Directives 222. 1f You Encounter Compilation Problems 2.3. Linux Distributions .. ee yes 2.3.1. RPM-based Distributions (Red Hat, Mandrake, SUSE, Fedora) 2.3.2. Updating Red Hat, Fedora, Mandrake, and Yellow Dog Linux with Yum 2.3.3, Debian Linax and Derivatives such as Ubuntu 2.3.4. Other Linux Distributions 2.4. Windows eater 2.4.1. Windows 2000 Dependencies 2.4.2. Windows Self-installer 2.4.3. Command-line Zip Binaries Installing the Nmap zip binaries 2.4.4. Compile from Source Code 2.4.5. Executing Nmap on Windows .. 2.5. Sun Solaris, 2.6. Apple Mac OS X .. 2.6.1. Executable Installer = iii 2.6.2. Compile from Source Code .. ‘Compile Nmap from source code Compile Zenmap from source code... 2.6.3. Third-party Packages ... 2.6.4. Executing Nmap on Mac OS X 2.1. FreeBSD / OpenBSD / NetBSD .. 211. OpenBSD Binary Packages and Source Ports Instructions 2.7.2, FreeBSD Binary Package and Source Ports Instructions... Installation of the binary package Installation using the source ports tree 2.7.3. NetBSD Binary Package Instructions .... 2.8. Amiga, HP-UX, IRIX, and Other Platforms 2.9. Removing Nmap 3. Host Discovery (Ping Scanning) . 3.1. Introduction 3.2. Specifying Target Hosts and Networks ... 3.2.1. Input From List (iL) .. 3.2.2. Choose Targets at Random (iR ) 3.2.3. Excluding Targets (~exclude, -excludefile ) 3.2.4, Practical Examples Finding an Organization's IP Addresses 3.1. DNS Tricks ..... 33.2, Whois Queries Against IP Registries... 3.3.3. Internet Routing Information . DNS Resolution ... Host Discovery Controls. 3.5.1. List Scan (-sL) 3.5.2. Ping Scan (-sP) 3.5.3. Disable Ping (-PN) . Host Discovery Techniques 3.6.1. TCP SYN Ping (-PS) .. 3.6.2. TCP ACK Ping (-PA) 3.6.3. UDP Ping (-PU) .. 3.6.4. ICMP Ping Types (-PE, -PP, and -PM) .. 3.6.5. IP Protocol Ping (-PO

You might also like