Nmap/Short Course/Lecture 4 - Revision history

Unknown user: /* Lab */

2025-05-29T01:48:16Z

Lab

← Older revision		Revision as of 01:48, 29 May 2025
Line 210:		Line 210:

	=Lab=		=Lab=

			Experiment with timing options to speed up scans in the Corporate Network (Scenario 1). Attempt basic firewall evasion techniques against a designated "filtered" segment in any scenario.

	[[Nmap/Short Course/Lab 4]]		[[Nmap/Short Course/Lab 4]]

Unknown user: /* Running Specific Scripts or Categories (--script) */

2025-05-28T15:30:10Z

Running Specific Scripts or Categories (--script)

← Older revision		Revision as of 15:30, 28 May 2025
Line 197:		Line 197:

	The lines prefixed with <code>\|_</code> or <code>\|</code> indicate output from NSE scripts like http-server-header and http-title.		The lines prefixed with <code>\|_</code> or <code>\|</code> indicate output from NSE scripts like http-server-header and http-title.

			===Finding Scripts and Getting Help===

			Nmap scripts are typically located in the scripts subdirectory of your Nmap installation path (e.g., /usr/share/nmap/scripts/ on Linux). You can list scripts or get help on a specific script:

			<pre>
			# Get help/description for the http-title script
			nmap --script-help http-title
			</pre>

			IMPORTANT: Always be aware of what a script does before running it, especially those outside the default or safe categories. Scripts in categories like exploit, intrusive, dos, or brute can have negative impacts on target systems or networks and should only be used with explicit authorization in controlled environments. The lab for this lecture will involve experimenting with some safe NSE scripts for discovery and further information gathering.

	=Lab=		=Lab=

Unknown user: /* Running Specific Scripts or Categories (--script) */

2025-05-28T15:29:36Z

Running Specific Scripts or Categories (--script)

← Older revision		Revision as of 15:29, 28 May 2025
Line 195:		Line 195:
	Nmap done: 1 IP address (1 host up) scanned in X.XX seconds		Nmap done: 1 IP address (1 host up) scanned in X.XX seconds
	</pre>		</pre>

			The lines prefixed with <code>\|_</code> or <code>\|</code> indicate output from NSE scripts like http-server-header and http-title.

	=Lab=		=Lab=

Unknown user: /* Running Scripts: Categories and default (-sC) */

2025-05-28T15:29:08Z

Running Scripts: Categories and default (-sC)

← Older revision		Revision as of 15:29, 28 May 2025
Line 157:		Line 157:

	The easiest way to use NSE is with the <code>-sC</code> option (or its equivalent <code>--script</code> default). This runs a curated set of scripts known as the "default" category. These scripts are generally considered safe (non-intrusive), useful for discovery and gaining more information, and tend not to be too noisy. <code>-sC</code> is often run alongside version detection (<code>-sV</code>).		The easiest way to use NSE is with the <code>-sC</code> option (or its equivalent <code>--script</code> default). This runs a curated set of scripts known as the "default" category. These scripts are generally considered safe (non-intrusive), useful for discovery and gaining more information, and tend not to be too noisy. <code>-sC</code> is often run alongside version detection (<code>-sV</code>).

			<pre>
			# Run default scripts along with SYN scan and version detection
			sudo nmap -sS -sV -sC <target_IP>
			</pre>

			===Running Specific Scripts or Categories (--script)===

			You can run specific scripts by name, scripts from a particular category, scripts matching a wildcard, or even all scripts (though running all scripts is generally not recommended as it can be very slow and intrusive).

			<pre>
			# Run all scripts in the 'discovery' category
			sudo nmap -sV --script discovery <target_IP>

			# Run a specific script, e.g., http-title (gets web page titles)
			sudo nmap -sV --script http-title <target_IP>

			# Run all scripts whose names start with 'smb-'
			sudo nmap -sV --script "smb-*" <target_IP>

			# Run scripts from a custom directory
			sudo nmap --script /path/to/my/custom_scripts/ <target_IP>
			</pre>


			<pre>
			[Instructor: Run 'sudo nmap -sS -sV -sC <your_lab_target_with_web_server>' and show output focusing on NSE script results]
			Starting Nmap X.XX ( https://nmap.org ) at YEAR-MM-DD HH:MM ZONE
			Nmap scan report for <target_IP>
			Host is up (0.0XXs latency).
			Not shown: XXX closed ports
			PORT STATE SERVICE VERSION
			80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
			\|_http-server-header: Apache/2.4.41 (Ubuntu)
			\|_http-title: Example Web Page Title

			Nmap done: 1 IP address (1 host up) scanned in X.XX seconds
			</pre>

	=Lab=		=Lab=

Unknown user: /* Firewall/IDS Evasion Techniques */

2025-05-28T15:28:13Z

Firewall/IDS Evasion Techniques

@@ Line 90: / Line 90: @@
 sudo nmap -sS --mtu 24 <target_IP>
 </pre>
 =Lab=

Unknown user: /* Nmap Timing Controls for Performance */

2025-05-28T15:20:43Z

Nmap Timing Controls for Performance

← Older revision		Revision as of 15:20, 28 May 2025
Line 63:		Line 63:
	* <code>--scan-delay <time></code>, <code>--max-scan-delay <time></code>: Instructs Nmap to wait at least the specified time between probes sent to a given host. Useful for rate-limiting evasion or reducing load on sensitive devices. For example, <code>--scan-delay</code> 1s waits 1 second between each probe.		* <code>--scan-delay <time></code>, <code>--max-scan-delay <time></code>: Instructs Nmap to wait at least the specified time between probes sent to a given host. Useful for rate-limiting evasion or reducing load on sensitive devices. For example, <code>--scan-delay</code> 1s waits 1 second between each probe.

			<pre>
			# Example: Scanning a large network, optimizing for speed
			sudo nmap -sS -T4 --min-hostgroup 100 --max-hostgroup 256 --min-parallelism 50 10.0.0.0/16

			# Example: Scanning a sensitive device, being very cautious
			sudo nmap -sS -T2 --max-retries 2 --scan-delay 2s <sensitive_device_IP>
			</pre>

			Aggressive timing can be detrimental if the network or target cannot handle the load, leading to inaccurate results. Always test timing options in a controlled environment first.

			==Firewall/IDS Evasion Techniques==

			These techniques are designed to make Nmap scans less detectable or to bypass certain types of network defenses. Their effectiveness varies greatly depending on the sophistication of the firewall/IDS.

			===Packet Fragmentation (-f, --mtu <offset>)===

			Concept: This technique splits the TCP header of Nmap's probe packets across several small IP fragments. The idea is that some older or poorly configured packet filters might not properly reassemble these fragments for inspection, or they might only inspect the first fragment, potentially missing the crucial TCP flags in subsequent fragments.

			Usage: The <code>-f</code> option tells Nmap to use small (8-byte data payload after IP header) fragments. You can specify -f again for 16-byte fragments. The <code>--mtu <offset></code> option allows you to specify a custom Maximum Transmission Unit size for the fragments. The offset must be a multiple of 8.

			<pre>
			# Use 8-byte fragments
			sudo nmap -sS -f <target_IP>

			# Use a specific MTU (e.g., 24 bytes per fragment)
			sudo nmap -sS --mtu 24 <target_IP>
			</pre>

	=Lab=		=Lab=

Unknown user at 15:03, 28 May 2025

2025-05-28T15:03:10Z

← Older revision		Revision as of 15:03, 28 May 2025
Line 4:		Line 4:

	=Summary and Objective=		=Summary and Objective=

			This 30-minute lecture will focus on fine-tuning scans, basic evasion tactics, and an initial look into the Nmap Scripting Engine (NSE).

			Objective: To introduce students to Nmap's performance tuning capabilities, fundamental firewall/IDS evasion techniques, and the basics of using the Nmap Scripting Engine (NSE) for enhanced and customized network scanning.

			=Notes=

			==Recap & Why Optimize/Evade/Customize?==

			===Quick Recap===

			In our last lecture, we explored advanced TCP scan types like FIN, Xmas, Null, and ACK scans, which are useful for firewall analysis and stealthier probing. We also delved into Nmap's OS detection (<code>-O</code>) capabilities for fingerprinting target operating systems and discussed the importance of managing Nmap's output using formats like Normal (<code>-oN</code>), XML (<code>-oX</code>), Grepable (<code>-oG</code>), and using Ndiff for comparing scan results over time.

			===Reasons for Optimization, Evasion, and Customization===

			* Optimization: When scanning large networks (hundreds or thousands of hosts), default Nmap settings might be too slow. Optimizing timing parameters can significantly speed up scans, saving valuable time during assessments. Conversely, on very unstable networks or against sensitive systems, you might need to slow Nmap down to ensure accuracy and avoid overwhelming targets.

			* Evasion: Network firewalls and Intrusion Detection/Prevention Systems (IDS/IPS) are designed to block or alert on suspicious scanning activity. Basic evasion techniques can help Nmap probes reach their targets or reduce the likelihood of detection during authorized penetration tests. It's crucial to remember that these techniques should only be used ethically and legally.

			* Customization: While Nmap is incredibly powerful out-of-the-box, the Nmap Scripting Engine (NSE) allows users to write (or use pre-written) scripts to automate a vast array of networking tasks. This extends Nmap's capabilities far beyond simple port scanning, enabling deeper discovery, vulnerability detection, and more.

			==Nmap Timing Controls for Performance==

			===Understanding Nmap's Default Timing & Templates===

			* <code>-T0</code> (paranoid) and <code>-T1</code> (sneaky): Very slow, used for IDS evasion (less relevant for basic host discovery usually).
			* <code>-T2</code> (polite): Slows down to consume less bandwidth and target resources.
			* <code>-T3</code> (normal): Default behavior.
			* <code>-T4</code> (aggressive): Speeds up scans, assuming a reasonably fast and reliable network. Good for quick sweeps when stealth isn't a primary concern.
			* <code>-T5</code> (insane): Very aggressive; may sacrifice accuracy for speed and can overwhelm networks or targets. For initial sweeps, -T4 is often a good balance if you are not worried about detection.

			<pre>
			# A fast scan using the aggressive template
			sudo nmap -sS -T4 192.168.1.0/24

			# A very slow, sneaky scan (for IDS evasion, not speed)
			sudo nmap -sS -T1 <target_IP>
			</pre>

			===Granular Timing Options for Fine-Tuning===

			Beyond templates, Nmap offers precise control with a number of timing-related options.

			Host Parallelism:
			* <code>--min-hostgroup <numhosts></code>, <code>--max-hostgroup <numhosts></code>: Nmap divides the target IP space into groups and scans one group at a time. These options control the minimum and maximum size of these groups. Larger groups can mean faster scans if your network and host can handle many concurrent probes.

			Probe Parallelism:
			* <code>--min-parallelism <numprobes></code>, <code>--max-parallelism <numprobes></code>: Controls how many probes Nmap sends in parallel to a single host (e.g., for port scanning or OS detection). Increasing this can speed things up but might overwhelm less robust hosts or trigger rate-limiting.

			Round Trip Time (RTT) Timeouts:
			* <code>--min-rtt-timeout <time></code>, <code>--max-rtt-timeout <time></code>, <code>--initial-rtt-timeout <time></code>: These control how long Nmap waits for a response before giving up on a probe or retransmitting. Adjusting these can be useful on high-latency or very low-latency networks. Nmap usually does a good job estimating RTT, but manual tuning is possible (e.g., 50ms, 1s).

			Retries:
			* <code>--max-retries <numretries></code>: Specifies the maximum number of times Nmap will retransmit a probe to a port if no response is received. Default is 10. Reducing this can speed up scans on unreliable networks but may miss ports if packets are dropped.

			Scan Delays:

			* <code>--scan-delay <time></code>, <code>--max-scan-delay <time></code>: Instructs Nmap to wait at least the specified time between probes sent to a given host. Useful for rate-limiting evasion or reducing load on sensitive devices. For example, <code>--scan-delay</code> 1s waits 1 second between each probe.


	=Lab=		=Lab=

Unknown user: Created page with "Main page: Nmap/Short Course Lab: Nmap/Short Course/Lab 4 =Summary and Objective= =Lab= Nmap/Short Course/Lab 4 =Flags= {{NmapShortCourseFlag}}"

2025-05-26T21:19:38Z

Created page with "Main page: Nmap/Short Course Lab: Nmap/Short Course/Lab 4 =Summary and Objective= =Lab= Nmap/Short Course/Lab 4 =Flags= {{NmapShortCourseFlag}}"

New page

Main page: [[Nmap/Short Course]]

Lab: [[Nmap/Short Course/Lab 4]]

=Summary and Objective=

=Lab=

[[Nmap/Short Course/Lab 4]]

=Flags=

{{NmapShortCourseFlag}}