Nmap/Short Course/Lecture 3 - Revision history

Unknown user: /* Lab */

2025-05-29T01:47:25Z

Lab

← Older revision		Revision as of 01:47, 29 May 2025
Line 254:		Line 254:
	=Lab=		=Lab=

	~~The lab for this lecture will involve practicing these advanced scans,~~ OS detection~~, saving results~~ in ~~different~~ formats, ~~and using~~ Ndiff to ~~compare scans~~.		Perform OS detection on key systems in each scenario. Save scans in multiple formats. If previous scans exist (or can be simulated), use Ndiff to identify changes in the Web/Cloud Infrastructure (Scenario 3).

	[[Nmap/Short Course/Lab 3]]		[[Nmap/Short Course/Lab 3]]

Unknown user: /* Lab */

2025-05-26T21:58:12Z

Lab

← Older revision		Revision as of 21:58, 26 May 2025
Line 253:		Line 253:

	=Lab=		=Lab=

			The lab for this lecture will involve practicing these advanced scans, OS detection, saving results in different formats, and using Ndiff to compare scans.

	[[Nmap/Short Course/Lab 3]]		[[Nmap/Short Course/Lab 3]]

Unknown user: /* Ndiff Utility: Comparing Scans */

2025-05-26T21:58:03Z

Ndiff Utility: Comparing Scans

@@ Line 229: / Line 229: @@
 ndiff scan_last_week.xml scan_today.xml
 </pre>
 =Lab=

Unknown user: /* Output Formats & Ndiff */

2025-05-26T21:53:14Z

Output Formats & Ndiff

@@ Line 175: / Line 175: @@
 ===Common Output Formats===
-* Normal Output (<code>-oN <filespec></code>): This is the human-readable format you see on the screen by default. It's useful for quick review and manual inspection.
+Normal Output (<code>-oN <filespec></code>): This is the human-readable format you see on the screen by default. It's useful for quick review and manual inspection.
 =Lab=

Unknown user: /* How Nmap Performs OS Detection */

2025-05-26T21:50:16Z

How Nmap Performs OS Detection

@@ Line 131: / Line 131: @@
 * Explicit Congestion Notification (ECN) support.
 * Characteristics of TCP initial window sizes. Nmap compares the collected "fingerprint" of responses against its extensive database (nmap-os-db) of known OS fingerprints.
 =Lab=

Unknown user: /* OS Detection (-O) */

2025-05-26T21:48:08Z

OS Detection (-O)

← Older revision		Revision as of 21:48, 26 May 2025
Line 113:		Line 113:

	===Why Detect the Operating System?===		===Why Detect the Operating System?===

			Identifying the operating system and its version on a target host is a crucial piece of information for several reasons:

			* Vulnerability assessment: Known vulnerabilities are often OS-specific or even version-specific. Knowing the OS helps narrow down potential exploits.
			* Tailoring attacks: Payloads or exploits might need to be customized for the target OS.
			* Network inventory: Understanding the OS landscape of a network is vital for asset management.
			* Policy compliance: Verifying that only authorized operating systems are present on the network.

			===How Nmap Performs OS Detection===

			Nmap's OS detection (-O option) is a sophisticated process that involves sending a series of TCP, UDP, and ICMP probes to open and closed ports on the target host. Nmap analyzes the responses to these probes, looking for subtle differences in network protocol implementations across various operating systems. Some of the characteristics Nmap examines include:

			* TCP Initial Sequence Number (ISN) sampling and predictability.
			* TCP options support and ordering (e.g., Window Scale, Timestamps, Selective ACK).
			* IP ID (Identification) field sampling (e.g., all zeros, incremental, random).
			* Responses to various ICMP probes.
			* Explicit Congestion Notification (ECN) support.
			* Characteristics of TCP initial window sizes. Nmap compares the collected "fingerprint" of responses against its extensive database (nmap-os-db) of known OS fingerprints.

	=Lab=		=Lab=

Unknown user: /* Idle Scan (-sI zombiehost) */

2025-05-26T21:45:48Z

Idle Scan (-sI zombiehost)

← Older revision		Revision as of 21:45, 26 May 2025
Line 109:		Line 109:

	This is a very sophisticated scan type, often discussed more in penetration testing courses, but good for students to be aware of its existence.		This is a very sophisticated scan type, often discussed more in penetration testing courses, but good for students to be aware of its existence.

			==OS Detection (-O)==

			===Why Detect the Operating System?===

	=Lab=		=Lab=

Unknown user: /* Idle Scan (-sI zombiehost) */

2025-05-26T21:45:16Z

Idle Scan (-sI zombiehost)

← Older revision		Revision as of 21:45, 26 May 2025
Line 103:		Line 103:
	===Idle Scan (-sI zombiehost)===		===Idle Scan (-sI zombiehost)===

	TCP Idle Scan (-sI <zombie host> [options]):		TCP Idle Scan (<code>-sI <zombie host> [options]</code>):
	* This is an advanced and truly blind TCP port scanning method. It doesn't send packets to the target from your true IP address. Instead, it leverages an idle "zombie" host on the internet that has a predictable IP fragmentation ID (IPID) sequence. Nmap sends SYN packets to the target, spoofing the zombie's IP. If the target port is open, it sends a SYN/ACK back to the zombie. This causes the zombie's IPID to increment. Nmap then probes the zombie's IPID to see if it changed.		* This is an advanced and truly blind TCP port scanning method. It doesn't send packets to the target from your true IP address. Instead, it leverages an idle "zombie" host on the internet that has a predictable IP fragmentation ID (IPID) sequence. Nmap sends SYN packets to the target, spoofing the zombie's IP. If the target port is open, it sends a SYN/ACK back to the zombie. This causes the zombie's IPID to increment. Nmap then probes the zombie's IPID to see if it changed.
	** Pros: Ultimate stealth regarding the target (it never sees your IP).		** Pros: Ultimate stealth regarding the target (it never sees your IP).
	** Cons: Difficult to find suitable zombie hosts (must be idle, predictable IPID), can be slow, and complex to set up correctly. This is more of an expert technique.		** Cons: Difficult to find suitable zombie hosts (must be idle, predictable IPID), can be slow, and complex to set up correctly. This is more of an expert technique.

			This is a very sophisticated scan type, often discussed more in penetration testing courses, but good for students to be aware of its existence.

	=Lab=		=Lab=

Unknown user: /* Advanced TCP Scan Types */

2025-05-26T21:44:23Z

Advanced TCP Scan Types

← Older revision		Revision as of 21:44, 26 May 2025
Line 80:		Line 80:
	</pre>		</pre>

			===ACK Scan (-sA)===

			The ACK scan is primarily used to map out firewall rule sets and determine if a firewall is stateful or stateless. It does not typically determine if a port is open or closed.

			Mechanics:
			* Nmap sends TCP packets with only the ACK flag set to the specified ports.

			Purpose & Port States:
			* If an RST packet is returned, the port is classified as unfiltered. This means the target host received the ACK packet and responded, indicating that a firewall (if present) did not block it.
			* If nothing is returned, or if an ICMP unreachable error is received, the port is classified as filtered. This suggests a firewall is likely dropping the ACK packets. A stateful firewall will usually drop unsolicited ACK packets (marking ports as filtered), whereas a simple stateless firewall might pass them through, leading to RSTs from the target host (marking ports as unfiltered).

			<pre>
			# Perform an ACK scan (requires sudo/root)
			sudo nmap -sA <target_IP>

			# ACK scan common web ports to test firewall rules
			sudo nmap -sA -p 80,443,8080 <target_IP>
			</pre>

			This scan is valuable for reconnaissance against firewalls. For example, if <code>-sS</code> shows a port as filtered, but <code>-sA</code> shows it as unfiltered, it implies a stateful firewall is blocking incoming SYN packets but not necessarily other types.

			===Idle Scan (-sI zombiehost)===

			TCP Idle Scan (-sI <zombie host> [options]):
			* This is an advanced and truly blind TCP port scanning method. It doesn't send packets to the target from your true IP address. Instead, it leverages an idle "zombie" host on the internet that has a predictable IP fragmentation ID (IPID) sequence. Nmap sends SYN packets to the target, spoofing the zombie's IP. If the target port is open, it sends a SYN/ACK back to the zombie. This causes the zombie's IPID to increment. Nmap then probes the zombie's IPID to see if it changed.
			** Pros: Ultimate stealth regarding the target (it never sees your IP).
			** Cons: Difficult to find suitable zombie hosts (must be idle, predictable IPID), can be slow, and complex to set up correctly. This is more of an expert technique.

	=Lab=		=Lab=

Unknown user at 21:40, 26 May 2025

2025-05-26T21:40:47Z

← Older revision		Revision as of 21:40, 26 May 2025
Line 4:		Line 4:

	=Summary and Objective=		=Summary and Objective=

			Summary:
			* This 30-minute lecture will introduce more nuanced scanning techniques, delve into operating system identification, and cover Nmap's versatile output options.

			Objective:
			* To equip students with knowledge of advanced TCP scanning techniques useful for firewall analysis and stealth, the ability to perform and interpret OS detection, and proficiency in managing and utilizing Nmap's various output formats, including scan comparison with Ndiff.

			=Notes=

			==Recap and Introduction to Advanced Scanning==

			===Quick Recap of Essential Scans===

			In our previous lecture, we covered fundamental port scanning techniques, including TCP SYN (<code>-sS</code>) and Connect (<code>-sT</code>) scans for identifying TCP services, and UDP scans (<code>-sU</code>) for UDP services. We also emphasized the importance of interpreting port states (open, closed, filtered) and performing service and version detection (<code>-sV</code>) to understand exactly what software is running on discovered ports. These skills form the bedrock of network service enumeration.

			===Why Advanced Scans? Beyond the Basics===

			While SYN, Connect, and basic UDP scans are powerful, there are scenarios where more sophisticated techniques are needed. Advanced scans can help in:

			* Stealth: Attempting to gather information while minimizing the chances of detection by Intrusion Detection Systems (IDS) or vigilant administrators.
			* Firewall Analysis: Understanding firewall rule sets, such as determining if a firewall is stateful or stateless, and identifying which ports are specifically being blocked or allowed.
			* Evasion: Bypassing certain types of packet filters or less sophisticated IDS. These techniques often involve sending TCP packets with unusual flag combinations or leveraging indirect scanning methods.

			===Understanding Target and Firewall Reactions===

			The effectiveness of advanced scans hinges on how target operating systems and intermediary devices (like firewalls and IDS) respond to non-standard network probes. Different systems adhere to or deviate from TCP/IP RFCs (Request for Comments – the technical standards documents for the internet) in unique ways. Nmap exploits these differences to infer port states or device characteristics. For example, some scans are designed to elicit responses only from closed ports, or to see if a firewall drops certain packets silently versus rejecting them with an error.


			==Advanced TCP Scan Types==

			These scans manipulate TCP flags to probe targets in ways that can be less obvious or provide specific insights into filtering mechanisms.

			===Fin (-sF), Xmas (-sX), and Null (-sN) Scans===

			These are "stealth" scans because they don't use the SYN flag, which is how firewalls and logging systems typically monitor connection attempts.

			Mechanics:

			* FIN Scan (<code>-sF</code>): Sends a TCP packet with only the FIN (finish) flag set.
			* Xmas Scan (<code>-sX</code>): Sets the FIN, PSH (push), and URG (urgent) flags simultaneously (lighting the packet up like a Christmas tree).
			* Null Scan (<code>-sN</code>): Sends a TCP packet with no flags set.

			Expected Behavior (RFC 793):
			* According to TCP RFC 793, if a port is closed, the target system should respond with a TCP RST (reset) packet.
			* If the port is open, the target should drop these malformed packets without a response.

			Real world behavior:

			* If an RST packet is received, Nmap marks the port as closed.
			* If no response is received (after retransmissions), the port is marked open\|filtered. This ambiguity means it could be open, or a firewall could be dropping the probe.
			* If an ICMP unreachable error (e.g., type 3 code 1, 2, 3, 9, 10, or 13) is received, the port is marked filtered. These scans are generally effective against UNIX-based systems. However, Microsoft Windows systems (and some others like Cisco devices) don't strictly follow RFC 793 in this regard; they tend to send RST packets for both open and closed ports in response to these probes, making these scan types ineffective against them for determining open ports.

			<pre>
			# Perform a FIN scan (requires sudo/root)
			sudo nmap -sF <target_IP>

			# Perform an Xmas scan
			sudo nmap -sX <target_IP>

			# Perform a Null scan
			sudo nmap -sN <target_IP>
			</pre>

			<pre>
			[Instructor: Run 'sudo nmap -sF <your_lab_Linux_target_IP_with_known_ports>' and show output]
			Starting Nmap X.XX ( https://nmap.org ) at YYYY-MM-DD HH:MM ZONE
			Nmap scan report for <target_IP>
			Host is up (0.0XXs latency).
			Not shown: XXX closed ports
			PORT STATE SERVICE
			22/tcp open\|filtered ssh
			80/tcp open\|filtered http
			111/tcp closed rpcbind
			Nmap done: 1 IP address (1 host up) scanned in X.XX seconds
			</pre>




	=Lab=		=Lab=