# NMAP

{% hint style="success" %}
After you discover your ports with NMAP. Ether check the [Services](/initial-access/services.md) section for manual exploits or try some automated [NSE](/reconnaissance/active-scanning/nmap/nse.md) scripts.
{% endhint %}

## Simple Scans:

**My Favorite CTF Scan:** (Balance of info to speed for small IP sets) -A runs aggressive NSE scripts and can be taken off to speed up the scan.\ <mark style="color:green;">`nmap -sCVT -vv -A -p- 10.10.10.29`</mark>\
\
**NSE Vuln Scripts:**\ <mark style="color:green;">`nmap --script vuln 10.11.1.10`</mark>\
**Quick TCP Scan**\ <mark style="color:green;">`nmap -sC -sV -vv -oA quick 10.10.10.10`</mark>\
**Quick UDP Scan**\ <mark style="color:green;">`nmap -sU -sV -vv -oA quick_udp 10.10.10.10`</mark>\ <mark style="color:green;">`nmap -sU -sS -vv 10.10.10.10`</mark>

{% hint style="warning" %}
UDP scans, send empty UDP packets and if an ICMP packet comes back it means its closed. But no ICMP packet means that the port is open. However firewalls/routers/Win10 might drop ICMP packets as a security mech and the scan will return as all UDP ports "open".
{% endhint %}

**Top 20 port scan:**&#x20;

Ports can be edited in [/usr/share/nmap/nmap-services](file://\usr\share\nmap\nmap-services) to fit your needs.

`#`<mark style="color:green;">`nmap -sT -A --top-ports=20 10.11.1.1-254 -oG top-port-sweep.txt`</mark>

**Nmap Live Host Sweep:**\
`#`` `<mark style="color:green;">`nmap -v -sn 10.11.1.1-254 -oG ping-sweep.txt`</mark>\
`#`` `<mark style="color:green;">`grep Up ping-sweep.txt | cut -d " " -`</mark>`f 2`\
\
**DNS Host sweep:**\
`#`` `<mark style="color:green;">`nmap -sT -p53 172.16.5.1,5,6,10`</mark>\
\
**Sweeping specified ports:**\
`#`` `<mark style="color:green;">`nmap -p 80 10.11.1.1-254 -oG web-sweep.txt`</mark>\
`#`` `<mark style="color:green;">`grep open web-sweep.txt |cut -d" " -f2`</mark>\
or\
`#`<mark style="color:green;">`nmap -A -p80 --open 10.11.1.0/24 -oG nmap-scan_10.11.1.1-254`</mark>\
`#`<mark style="color:green;">`cat nmap-scan_10.11.1.1-254 | grep 80 | grep -v "Nmap" | awk '{print`</mark>\ <mark style="color:green;">`$2}'`</mark>

#### Large CIDR Scans

`#`<mark style="color:green;">`nmap -sn 172.16.64.0-255 -oG discovery.nmap`</mark>&#x20;

`#`<mark style="color:green;">`cat discovery.nmap | grep Host | awk '{print $2}' > IPs.txt`</mark>&#x20;

`#`<mark style="color:green;">`nmap -sCVT -Pn -A -iL IPs.txt -oN portmaps.nmap`</mark>&#x20;

`#`<mark style="color:green;">`nmap -sV -T4 -Pn --open -p- -iL IPs.txt -oN allports.nmap`</mark>

**Port knock ex:  (knocks on 7k, 8k, 9k)**\ <mark style="color:green;">`for x in 7000 8000 9000; do nmap -Pn --host_timeout 201 --max-retries 0 -p $x 10.10.10.10; done`</mark>

{% hint style="info" %}
Port knocking is rare in corporations and fuzzing **cannot** be done quietly. In your network traffic dumps, just include an offlined automated check for port knocking as it is a waist of time to manually hunt for it.&#x20;
{% endhint %}

### Flags:

<mark style="color:yellow;">-O</mark> OS fingerprinting (uses ttl and tcp windows sizes)

<mark style="color:yellow;">-sV</mark> banner grabbing/version detection. Check the help screen if you want to more aggressively banner grab with additional -sV arguments

<mark style="color:yellow;">-sT</mark> Connect scan

<mark style="color:yellow;">-sS</mark> syn scan (DEFAULT IF NOTHING IS SPECIFIED)

<mark style="color:yellow;">-sU</mark> UDP scan

<mark style="color:yellow;">-sA</mark> ack scan. scans firewall behavior (statefullness, filtering). Host responding with RST to our ACKs are considered unfiltered and those that don't are filtered. When we see the unfiltered response it means there are likely no fw rules in place for that port.&#x20;

<mark style="color:yellow;">-sO</mark> IP proto scan. This is not a port scan. Rather than enumerating the port field in the packets it enumerates the 8bit protocol field. This scans to see what protocols are enabled for a host. this will look for ICMP protocol unreachable messages rather than the port unreachable messages of a icmp port scan. &#x20;

<mark style="color:yellow;">-sI</mark> idle scan(zombie scan) //utilizes a zombie on the network and we look at the packet fragmentation id number to do scans. read below

<mark style="color:yellow;">-A</mark>  aggressive NSE service scripts, takes a long time, and triggers alerts

<mark style="color:yellow;">--open</mark>  for sweeps to only return info on open ports

<mark style="color:yellow;">-sn</mark> live host identification scan

<mark style="color:yellow;">-n</mark> no host lookup, faster and quieter for internals&#x20;

<mark style="color:yellow;">-b</mark> ftp bounce scan. This stealth scan is a way to hide the true scanning source. lets us do port scans from vulnerable ftp servers on the network utilizing the ftp PORT command.&#x20;

<mark style="color:yellow;">-f</mark> turns on fragmentation (see "staying quiet") //for a syn scan the mtu here is 42 bytes

<mark style="color:yellow;">--mtu</mark> like fragmentation but we can also specify the mtu size. (must be multiple of 8)

<mark style="color:yellow;">--source-port</mark> or <mark style="color:yellow;">-g</mark> is a port spoof

<mark style="color:yellow;">--max-retries</mark> if we get a time out how many times do we send the same packet

<mark style="color:yellow;">-oG</mark>   save scan results in grep format

<mark style="color:yellow;">-oN</mark>  normal output to file

<mark style="color:yellow;">-oG</mark> grepable output to file

### RFC compliant scans:

This depends on networks that follow this compliance as there are certain rules as to what to do with odd packets seen on the network. We then can make assumptions about the hosts we are scanning based on what they do with the packets. This is **NOT a stealth technique** and will likely trigger rules because of how odd the packets are. But it is a good last resort to look for live hosts/services. Also OS for windows/cisco/ibm may have different results for these scans along with various firewall rules that can affect results.&#x20;

<mark style="color:yellow;">-sN</mark> tcp null scan. No flag bits are set in the header.(all 0)

<mark style="color:yellow;">-sF</mark> FIN scan. Only sets the fin bit

<mark style="color:yellow;">-sX</mark> xmass tree scan. Sets the fin, psh, urg flags.

\\


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.hackbook.io/reconnaissance/active-scanning/nmap.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.