Nmap/Short Course/Lecture 1 - Revision history

Unknown user: /* Lab */

2025-05-29T01:42:31Z

Lab

← Older revision		Revision as of 01:42, 29 May 2025
Line 256:		Line 256:

	=Lab=		=Lab=

			Lab Activities: Perform initial host discovery sweeps across segments of the Corporate Network (Scenario 1), the perimeter of the ICS network (Scenario 2), and the defined scope of the Web/Cloud Infrastructure (Scenario 3).

	[[Nmap/Short Course/Lab 1]]		[[Nmap/Short Course/Lab 1]]

Unknown user: /* Flags */

2025-05-26T20:47:22Z

Flags

← Older revision		Revision as of 20:47, 26 May 2025
Line 259:		Line 259:
	[[Nmap/Short Course/Lab 1]]		[[Nmap/Short Course/Lab 1]]

	==Flags==		=Flags=

	{{NmapShortCourseFlag}}		{{NmapShortCourseFlag}}

Unknown user: /* Lab */

2025-05-26T20:47:15Z

Lab

← Older revision		Revision as of 20:47, 26 May 2025
Line 255:		Line 255:
	Once you have a list of live hosts, the next logical step in a network assessment is typically port scanning to identify which services are running on those active machines. The output from <code>nmap -sn -oG -</code> (grepable output to stdout) can be easily parsed to extract live IPs, which can then be fed into another Nmap command for port scanning. For example, students will learn to take their list of discovered hosts and then perform targeted port scans on them in the upcoming lectures. This phased approach is efficient and organized.		Once you have a list of live hosts, the next logical step in a network assessment is typically port scanning to identify which services are running on those active machines. The output from <code>nmap -sn -oG -</code> (grepable output to stdout) can be easily parsed to extract live IPs, which can then be fed into another Nmap command for port scanning. For example, students will learn to take their list of discovered hosts and then perform targeted port scans on them in the upcoming lectures. This phased approach is efficient and organized.

	==Lab==		=Lab=

	[[Nmap/Short Course/Lab 1]]		[[Nmap/Short Course/Lab 1]]

Unknown user at 20:46, 26 May 2025

2025-05-26T20:46:59Z

← Older revision		Revision as of 20:46, 26 May 2025
Line 1:		Line 1:
	Main page: [[Nmap/~~2025~~ Short Course]]		Main page: [[Nmap/Short Course]]

	Lab: [[Nmap/~~2025~~ Short Course/Lab 1]]		Lab: [[Nmap/Short Course/Lab 1]]

Unknown user: /* Lab */

2025-05-26T20:34:50Z

Lab

← Older revision		Revision as of 20:34, 26 May 2025
Line 257:		Line 257:
	==Lab==		==Lab==

	[[Nmap/~~2025~~ Short Course/Lab 1]]		[[Nmap/Short Course/Lab 1]]

			==Flags==

			{{NmapShortCourseFlag}}

Unknown user: Admin moved page Nmap/2025 Short Course/Lecture 1 to Nmap/Short Course/Lecture 1 without leaving a redirect

2025-05-26T20:21:24Z

Admin moved page Nmap/2025 Short Course/Lecture 1 to Nmap/Short Course/Lecture 1 without leaving a redirect

← Older revision

Revision as of 20:21, 26 May 2025

Unknown user at 19:43, 26 May 2025

2025-05-26T19:43:20Z

← Older revision		Revision as of 19:43, 26 May 2025
Line 1:		Line 1:
	{{Main\|Nmap/2025 Short Course}}		Main page: [[Nmap/2025 Short Course]]

			Lab: [[Nmap/2025 Short Course/Lab 1]]


	=Summary and Objective=		=Summary and Objective=

Unknown user: /* Lab */

2025-05-26T19:40:15Z

Lab

← Older revision		Revision as of 19:40, 26 May 2025
Line 254:		Line 254:
	==Lab==		==Lab==

	~~The goal of this lecture's lab (done outside class) is to practice these host discovery techniques on the provided lab scenarios (Corporate, ICS, Web~~/~~Cloud) and get comfortable with specifying targets and interpreting basic "host up~~/~~down" results.~~		[[Nmap/2025 Short Course/Lab 1]]

Unknown user: /* Choosing the Right Discovery Method & Basic Timing */

2025-05-26T19:39:44Z

Choosing the Right Discovery Method & Basic Timing

← Older revision		Revision as of 19:39, 26 May 2025
Line 225:		Line 225:
	* <code>-T4</code> (aggressive): Speeds up scans, assuming a reasonably fast and reliable network. Good for quick sweeps when stealth isn't a primary concern.		* <code>-T4</code> (aggressive): Speeds up scans, assuming a reasonably fast and reliable network. Good for quick sweeps when stealth isn't a primary concern.
	* <code>-T5</code> (insane): Very aggressive; may sacrifice accuracy for speed and can overwhelm networks or targets. For initial sweeps, -T4 is often a good balance if you are not worried about detection.		* <code>-T5</code> (insane): Very aggressive; may sacrifice accuracy for speed and can overwhelm networks or targets. For initial sweeps, -T4 is often a good balance if you are not worried about detection.

			<pre>
			# Aggressive host discovery sweep of a subnet
			nmap -sn -T4 192.168.1.0/24
			</pre>

			<code>-T4</code> can still be noisy, and should be used judiciously on production networks.

			==Interpreting Results & Next Steps==

			When Nmap reports "Host is up," it means one of its discovery probes received a positive response. If a host doesn't appear in the "up" list, it means Nmap received no replies from that IP address using the chosen discovery methods. This doesn't always mean the host is offline. It could be protected by a very restrictive firewall that drops all probe types, it might be configured not to respond, or there could be network issues. For example, a host might only respond to TCP SYN packets on an obscure port not probed by default.


			Common issues and troubleshooting:

			* Firewalls: The most common reason for hosts not appearing. Stateful firewalls can block SYN packets to non-listening ports, and stateless firewalls or packet filters might block specific probe types like ICMP.

			* Host-based Protection: Personal firewalls on endpoints (like Windows Firewall or iptables on Linux) can also block probes.

			* Network Configuration: Incorrect network masks or routing issues can prevent probes from reaching the target or replies from returning.

			* Nmap Privileges: Remember that unprivileged users have limited discovery options (typically only TCP connect to ports 80/443). Running as a privileged user (e.g., <code>sudo nmap ...</code>) enables raw packet sending and more discovery techniques.

			==Next Steps: From Discovery to Deeper Scans==

			Once you have a list of live hosts, the next logical step in a network assessment is typically port scanning to identify which services are running on those active machines. The output from <code>nmap -sn -oG -</code> (grepable output to stdout) can be easily parsed to extract live IPs, which can then be fed into another Nmap command for port scanning. For example, students will learn to take their list of discovered hosts and then perform targeted port scans on them in the upcoming lectures. This phased approach is efficient and organized.

			==Lab==

			The goal of this lecture's lab (done outside class) is to practice these host discovery techniques on the provided lab scenarios (Corporate, ICS, Web/Cloud) and get comfortable with specifying targets and interpreting basic "host up/down" results.

Unknown user: /* ARP scans of the local network */

2025-05-26T19:36:08Z

ARP scans of the local network

← Older revision		Revision as of 19:36, 26 May 2025
Line 161:		Line 161:

	Note: <code>-PR</code> is implied when using <code>-sn</code> on a local Ethernet network as a privileged user.		Note: <code>-PR</code> is implied when using <code>-sn</code> on a local Ethernet network as a privileged user.

			==Target Specification & Initial Sweep Strategies==

			===Defining Scan Targets Accurately===

			Nmap offers flexible ways to define the scope of your scan, which is crucial for both efficiency and ensuring you are only scanning authorized targets.

			Single IP Address or Hostname: The simplest form. Nmap will resolve hostnames via DNS if provided.

			<pre>
			nmap 192.168.1.1
			nmap scanme.nmap.org
			</pre>

			CIDR Notation: Classless Inter-Domain Routing notation is a common way to specify network blocks, e.g., <code>192.168.1.0/24</code> represents all 256 IPs from <code>192.168.1.0</code> to <code>192.168.1.255</code>.

			<pre>
			nmap -sn 192.168.1.0/24
			nmap -sn 10.0.0.0/8
			</pre>

			Ranges and Lists: You can specify octet ranges or comma-separated lists.

			<pre>
			nmap -sn 192.168.1.1-100 # Scans 192.168.1.1 through 192.168.1.100
			nmap -sn 192.168.1.1,2,10,50 # Scans specific IPs
			nmap -sn 192.168.1,2,3.1-254 # Scans .1 through .254 for 192.168.1.x, .2.x, and .3.x
			</pre>

			Input from a File (<code><nowiki>-iL <filename></nowiki></code>): For large numbers of targets or irregularly spaced targets, you can list them in a file (one target per line) and feed it to Nmap.

			<pre>
			# targets.txt might contain:
			# 192.168.1.5
			# company-server.com
			# 10.10.0.0/28
			nmap -sn -iL targets.txt
			</pre>

			===Excluding Targets===

			Sometimes you need to scan a large range but explicitly exclude certain sensitive hosts or known friendly systems.

			<pre>
			# Scan the /24 range but exclude .1 and .100
			nmap -sn 192.168.1.0/24 --exclude 192.168.1.1,192.168.1.100

			# Exclude targets listed in a file
			nmap -sn 192.168.1.0/24 --exclude-file dontscan.txt
			</pre>

			This is crucial for avoiding accidental scans on critical infrastructure or out-of-scope systems during an engagement.

			===Choosing the Right Discovery Method & Basic Timing===

			The best discovery method depends on your network position and the target environment. On a local LAN, <code>-PR</code> (often automatic with <code>-sn</code>) is best. For external networks, <code>-PS</code> (e.g., <code>-PS80,443,8080</code>) or <code>-PA</code> might be more effective than ICMP-based probes if firewalls are restrictive. If you know nothing, Nmap's default multi-probe approach with <code>-sn</code> is a good start.

			Nmap offers timing templates (<code><nowiki>-T<0-5></nowiki></code>) that control aggressiveness:

			* <code>-T0</code> (paranoid) and <code>-T1</code> (sneaky): Very slow, used for IDS evasion (less relevant for basic host discovery usually).
			* <code>-T2</code> (polite): Slows down to consume less bandwidth and target resources.
			* <code>-T3</code> (normal): Default behavior.
			* <code>-T4</code> (aggressive): Speeds up scans, assuming a reasonably fast and reliable network. Good for quick sweeps when stealth isn't a primary concern.
			* <code>-T5</code> (insane): Very aggressive; may sacrifice accuracy for speed and can overwhelm networks or targets. For initial sweeps, -T4 is often a good balance if you are not worried about detection.