NMAP POST PORT SCANS

In this post we will talk about the steps that follow port-scanning, including service detection, OS detection, Nmap scripting engine and saving the scan results.

Service Detection

Once Nmap discovers open ports, they can be probed to detect running services and therefore for vulnerabilities. Adding the -sV option to an Nmap scan will collect and determine service and version information for the open ports. --version-intensity LEVEL will specify the intensity of the scan, with 0 being lowest and 9 being highest.

Using -sV will force Nmap to use the TCP 3 way handshake. This is because Nmap needs to fully communicate with the target to get information and therefore cannot use the stealth scan -sS .

NOTE: In order to run -sV we need root privileges. 

OS Detection

Nmap can detect the OS based on its behaviour and any telltale signs in its responses by using the -O option. Whilst the OS detection is very convenient, many factors affect its accuracy. In order to have an accurate OS scan, Nmap needs at least one open and one closed port on the target. Furthermore, the guest OS fingerprints might get distorted due to the rising use of virtualisation and similar technologies. Therefore always take the OS version with a grain of salt. 

Traceroute

If we want to find the routers between us and a target, use the --traceroute option. Although it is worth noting that many routers are set to not send ICMP Time-to-Live exceeded, which would prevent us from getting their IP addresses.    

Scripting

List of Nmap scripts.

Functionality can be added to Nmap using scripting with the Lua language in order to add functionality that is not built in. A part of Nmap is the Nmap Scripting Engine (NSE) which allows Nmap to execute Nmap scripts written in Lua.

The Nmap default installation contains close to 600 scripts. The scripts are names starting with the protocol that they target. We can specify to use the default scripts by using --script=default or simply -sC . 

Categories of scripts available include:

• auth: Authentication related scripts.
• broadcast: Discover hosts by sending broadcast messages.
• brute: Performs brute-force password audits against logins.
• default: same as -sC
• discover: Retrieve accessible information such as database tables and DNS names.
• dos: Detects servers vulnerable to Denial of Service,
• exploit: Attempts to exploit vulnerable services.
• external: Checks third-party service, such as Geoplugin and Virustotal.
• fuzzer: Launch fuzzing attacks
• intrusive: Intrusive scripts such as brute-force and exploitation.
• safe: Safe scripts that wont crash a target
• version: Retrieve service versions.
• vuln: Check for or exploit vulnerabilities. 

In order to specify a script we need to use --script "SCRIPT_NAME" or a pattern such as --script "ftp*" which would include any scripts beginning with ftp, including ftp-brute .

In order to understand what a script does we can open it with a text editor. It is important to be careful when using scripts as some a very intrusive. Some scripts will only work under certain conditions (for specific servers, for example) so it is worth knowing exactly what the scripts will do and on what. 

Saving the Output

There are three main formats for saving Nmap scans:

1. Normal
2. grep
3. XML

NOTE: We can save the output in all three formats by -oA FILENAME .

Normal

Using the -oN FILENAME option. The N stands for normal.

Grepable

Using the -oG FILENAME option will use grepable format. Grep (Global Regular Expression Printer) makes filtering the scan for specific terms or keywords efficient. Whilst this format is more efficient when using grep , it makes it more difficult to be human readable.

In order to look for specific keywords in the new file, use grep KEYWORD FILE_NAME . 

XML

We can use the -oX option to save our Nmap scan in XML format. XML would be the most convenient to process the output in other programs.