Target Specification

Nmap is designed to scan a variety of target types, from a single host to large networks. Nmap supports Classless Inter-Domain Routing (CIDR) notation, octet ranges, Domain Name Server (DNS) names, IPv6 addressing, random targets, and exclude lists directly on the command line. You can also use combinations of target specification methods on the same command line. For example, to scan the entire 192.168.1.0 Class C network using CIDR notation, along with selected systems from 192.168.100.0 using octet ranges, and a single host using the DNS name myhost.xyz.com, you could use the following command:

nmap 192.168.1.0/24 192.168.100.10-25 myhost.xyz.com

You can also specify selected octet ranges using a comma-separated list, for example to scan the following hosts:

■ 192.168.5.10

■ 192.168.5.20

■ 192.168.10.10

■ 192.168.10.20

■ 192.168.15.10

■ 192.168.15.20

■ 192.168.16.10

■ 192.168.16.20

you would use the command:

nmap 192.168.5,10,15-16.10,20

Another great Nmap feature is the exclude list. If you are interested in scanning your public-facing subnet or demilitarized zone (DMZ), to look for rogue hosts, but you don’t want to scan your known Web, DNS, and mail servers, you could use the following command:

nmap –sP ––exclude web.xyz.com,dns.xyz.com,mail.xyz.com 192.168.100.0/24

Nmap also supports target specification from an input file and excluded targets from an exclude file. The targets must be tab, space, or newline delimited. To perform a software version inventory of your Windows servers use the following command:

nmap –sV –iL windows_servers.txt

The file windows_servers.txt has a list of your known Windows servers from your asset database. A good way to audit a network for rogue hosts is to use an exclude file of known IP addresses from your asset database. For example:

nmap ––excludefile asset_database.txt 192.168.0.0/16

Another good input file (or exclude file, depending on your purpose) to use for asset management is your list of currently leased Dynamic Host Configuration Protocol (DHCP) addresses.

A less used, but still interesting target specification option is the ability to scan random targets using the -iR command-line option. The option accepts a value for the number of target addresses to generate. For example, to scan 10 random targets for a Hypertext Transfer Protocol Secure (HTTPS) service, use the following command:

nmap –p 443 –iR 10

A value of 0 supplied to the random option produces an infinite scan.

Table 4.1 summarizes the target specification command-line options. As you can see already, Nmap is very flexible at handling input on the command line and from a file. This flexibility offers you a lot of control over the targets that are scanned or not scanned. It also offers the flexibility to use exported host data from other enterprise applications as input to Nmap.

Basic Port Scanning

By default, Nmap performs a TCP SYN scan (-sS) against the specified target, when run with root or administrator privileges. SYN scanning is quick and provides reliable results for open, closed, and filtered ports. SYN scanning was once considered a stealthy scan method, however, most host- and network-based intrusion detection systems can now detect SYN scans. Ports are considered open if the port responds to the SYN packet with a SYN/ACK packet, and ports are closed if the system responds with a RST packet. A filtered port indicates an ICMP unreachable error or no response was received. Although Nmap performs a SYN scan by default, you can also perform it with the following command-line option:

# nmap -sS 192.168.2.3
Starting Nmap 4.50 (http://insecure.org) at 2007-12-28 09:46 Eastern Standard Time
Interesting ports on 192.168.2.3:
Not shown: 1707 closed ports

Nmap done: 1 IP address (1 host up) scanned in 26.248 seconds

What we are interested in here is the ports table, which includes the port number and protocol, the state, and the service. Unless you are using version detection, the service that is displayed is just a guess since it is pulled from the nmap-services file, a list of well know services and the ports they run on.

If a user doesn’t have root or administrator privileges, Nmap will perform the TCP connect scan (-sT ) by default. This is because Nmap uses the underlying OS to establish a connection with the target instead of using its built-in ability to create and send raw packets. This scan method tends to be less efficient since Nmap has less control than it does when creating raw packets. TCP connect scans are more likely to be logged since they complete a full TCP connection. System administrators should monitor logs for a large number of connection attempts to multiple ports, since this activity may indicate a port scan. TCP connect scans can also cause unwanted effects, such as causing DoS conditions for systems that do not efficiently close TCP connections. In our example, running a TCP connect scan against the same target detects additional open ports:

# nmap -sT 192.168.2.3
Starting Nmap 4.50 (http://insecure.org) at 2007-12-28 09:52 Eastern Standard Time
Interesting ports on 192.168.2.3:
Not shown: 1704 closed ports

Nmap done: 1 IP address (1 host up) scanned in 365.014 seconds

This may be because the target host is running a host-based firewall that may have been interfering with the results of the SYN scan method.

Many notable exploits (SQL slammer worm) have occurred because of security weaknesses on UDP services. UDP is used by many popular services including DNS, Simple Network Management Protocol (SNMP), Trivial File Transfer Protocol (TFTP), NFS, DHCP, Kerberos, and Syslog. The Nmap UDP scan (-sU) sends an empty UDP header to the target port. The target responds with an ICMP port unreachable error if the port is closed. Other ICMP errors indicate that the port is blocked by a packet filter. UDP services on open ports will respond with a UDP packet, however, some UDP services will not send a response. Because of this lack of response, Nmap performs several retries, which makes UDP scanning very slow. If Nmap cannot determine if the port is blocked by a packet filter it will indicate open|filtered for the port status. In this case, try performing a version scan (-sV ) to gather additional information to determine if the port is actually open. The following is an example of a UDP scan and associated output:

# nmap -sU 192.168.2.3
Starting Nmap 4.50 (http://insecure.org) at 2007-12-28 10:04 Eastern Standard Time
All 1488 scanned ports on 192.168.2.3 are open|filtered (1334) or closed (154)
Nmap done: 1 IP address (1 host up) scanned in 20.670 seconds

In this case, the UDP port scan may be filtered by the host-based firewall, or there may not be any open UDP ports. Let’s scan another target and view the results:

# nmap -sU 192.168.100.4
Starting Nmap 4.50 (http://insecure.org) at 2007-12-28 10:15 Eastern Standard Time
Interesting ports on 192.168.100.4:
Not shown: 1483 closed ports

MAC Address: 00:30:65:0D:28:32 (Apple Computer)
Nmap done: 1 IP address (1 host up) scanned in 56.742 seconds

This is more of what we are looking for. There are five UDP services that may be open on this target. You need to perform additional testing, with the version detection (-sV ) and other manual tests, to determine actual open services and versions. Version detection is covered later in this chapter.

Nmap provides the ability to analyze IP protocols with the IP protocol scan (-sO). This isn’t technically a port scan, however, it does use the same underlying port scan engine and reports its results in the port table. The IP protocol scan allows you to see which IP protocols are supported by the target system. The response to this scan is an ICMP protocol unreachable for unsupported protocols. Other ICMP responses cause the protocol to be reported as filtered, and no response is reported as open|filtered. The following is an example of an IP protocol scan and associated output:

# nmap -sO 192.168.2.3
Starting Nmap 4.50 (http://insecure.org) at 2007-12-28 12:24 EST
Interesting protocols on 192.168.2.3:
Not shown: 250 closed protocols

MAC Address: 00:11:25:D6:DA:C7 (IBM)
Nmap done: 1 IP address (1 host up) scanned in 1.649 seconds

Advanced Port Scanning

Nmap includes several advanced port scanning options that manipulate the raw packet in a variety of ways to solicit responses from the target. According to the TCP Request For Comment (RFC), any packet not containing a SYN, RST, or ACK flag will result in a returned RST if the port is closed and no response if the port is open (reported as open|filtered). Nmap includes the following three scan options to take advantage of this characteristic:

■ TCP Null scan The TCP Null scan (-sN ) does not set any flag bits in the TCP header.

■ TCP FIN scan The TCP FIN scan (-sF ) sets only the FIN flag.

■ Xmas scan The Xmas scan (-sX ) sets the FIN, PSH, and URG flags.

If Nmap receives an ICMP unreachable error it will report the port as filtered. These advanced port scanning options are stealthy and may bypass firewalls and other security controls. However, most host- and network-based intrusion detection systems (IDSes) will detect this type of scan activity. Keep in mind that OSes that don’t follow the TCP RFC may send misleading responses.

Nmap includes an advanced port scan option that is used to scan firewalls to determine their connection state and rulesets. The TCP ACK scan (-sA) creates and sends a packet to the target with only the ACK flag set. Unfiltered systems will respond with a RST packet for both open and closed ports. If an ICMP error message or no response is received, the port is considered filtered by a firewall.

A similar technique to the TCP ACK scan is the TCP Window scan (-sW ). The Window scan sends a packet with only the ACK flag set, but also analyzes the TCP Window field in the RST response to determine if the port is open or closed. The TCP window size is an implementation detail of a few types of systems. Some systems will use a positive window size if the port is open, and a zero window size if the port is closed.

The Maimon scan (-sM ), named after the discoverer Uriel Maimon, sets the FIN and ACK flags in the port scan packet. The target system will generate a RST packet for a port that is open or closed. More information on this scan technique can be found in Phrack Magazine issue #49 (November 1996), www.phrack.org/issues.html?issue=49&id=15-article.

Another advanced port scanning technique is the Idle scan (-sI ). The idle allows you to specify another system to use in the scanning, known as a zombie host. The zombie host is used to mask your IP address and to analyze IP fragmentation ID sequence generation to determine open ports on the target. The idle scan is a very stealthy, blind TCP port scan. A blind scan spoofs your real IP address as another host, so your scanning system will not see any responses from the target, since they are sent to the spoofed host. The trick is to analyze the spoofed host to conclude responses from the target. Fyodor has a great write up on the idle scan including examples at http://insecure.org/nmap/idlescan.html. The idle scan uses TCP port 80 by default if no ports are specified.

Another stealthy scan method is the FTP bounce scan (-b). The FTP bounce scan uses the FTP proxy feature on an FTP server to scan a target from the FTP server instead of your system. The FTP proxy feature allows you to log into an FTP server and request a file to be sent to another system. By sending files to a target system and port you can determine whether a port is open or closed. Most FTP servers no longer support this functionality, but some are still available. The FTP bounce scan can be used to bypass firewalls by scanning from an organization’s FTP server, which may be on an internal network, or allowed to the internal network by the firewall rules.

To have even more control over packet creation, Nmap provides the --scanflags command-line option to allow you to specify TCP flags to set in the packet. This allows you to solicit a variety of responses from targets, as well as evade IDSes. You can use numerical flag values or symbolic names in any order. For example, to set the URG and PSH flags you would use the following option:

––scanflags URGPSH

You can provide a TCP scan type to tell Nmap how to interpret the results. For example, supplying the -sA command-line option along with the --scanflags tells Nmap to use the specified flags but to interpret the results the same way an ACK scan would. By default, Nmap uses the SYN scan for result interpretation.

Nmap has two other less used port scanning command-line options that provide valuable information. The --traceroute command-line option is performed after the scan and works with all scan types except the TCP connect scan (-sT ) and idle scan (-sI ). It uses Nmap’s own traceroute algorithm and timing characteristics to determine the mostly likely port and protocol to reach the target. The --reason command-line option shows more detail about the responses from the target host, including the type of packet that was received in response to the probe. This option is also automatically enabled by the nmap debug (-d ) command-line option.

Specifying Ports

Now that we have covered all of the port scanning techniques, let’s take a look at how you can specify the ports to scan. By default, Nmap scans ports 1 through 1024 and those listed in the nmap-services file for the protocol being scanned (TCP or UDP). Its worth taking a look at the nmap-services file to see the ports, especially the higher numbered ports, that Nmap includes. Nmap also allows you to specify the ports to scan and whether to scan them sequentially or randomized. By default, Nmap randomizes the order of ports scanned. You can scan sequentially by using the -r command-line option. To specify ports, use the -p < port range > command-line option. The port range parameter can be a single port or a range of ports. To scan for hosts with port 80 you could use the following:

nmap –p 80 192.168.100.0/24
Starting Nmap 4.50 (http://insecure.org) at 2007-12-28 12:58 Eastern Standard Time
Interesting ports on 192.168.100.1:
PORT STATE SERVICE
80/tcp open http
MAC Address: 00:14:6C:19:F8:45 (Netgear)
Interesting ports on 192.168.100.2:
PORT STATE SERVICE
80/tcp closed http
MAC Address: 00:30:65:0D:28:29 (Apple Computer)
Nmap done: 256 IP addresses (3 hosts up) scanned in 28.291 seconds

You can also specify a range of ports to scan. The following only scans ports 130 to 140 (since no scan methods are included, Nmap uses the SYN scan by default):

# nmap -p 130–140 192.168.2.3
Starting Nmap 4.50 (http://insecure.org) at 2007-12-28 13:05 EST
Interesting ports on 192.168.2.3:

MAC Address: 00:11:25:D6:DA:65 (IBM)
Nmap done: 1 IP address (1 host up) scanned in 0.158 seconds

Nmap also includes notation to scan from port 1 to a specified port. The following example scans from port 1 to port 100:

nmap –p -100 192.168.100.0/24

Keeping in similar syntax, Nmap can scan from a specified port to port 65535. The following example scans from port 60000 to port 65535:

nmap –p 60000- 192.168.100.0/24

Combining syntax allows you to scan all 65535 ports by using the following:

nmap –p– 192.168.100.0/24

If you are performing both TCP and UDP scans, you may want to specify different ports for each protocol. The following example shows the syntax to do just that:

nmap –sU –sS –p U:53,T:80,134–139 192.168.100.0/24

This Nmap command will perform a UDP scan on port 53, and a TCP SYN scan on ports 80 and 134 to 139. You can also specify port names instead of numbers. Make sure you use the port names included in the nmap-services file. Nmap also supports wildcards (^⁎ and ?) in port names. The following scans the FTP port and all HTTP ports:

nmap –p ftp, http* 192.168.100.0/24

By viewing the nmap-services file, you can see that this scan includes the following ports:

Nmap also provides syntax to scan port ranges in the nmap-services file. For example, you can scan all ports that are included in the nmap-services file between port 6000 and port 6100:

nmap –p [6000–6100] 192.168.100.0/24

By viewing the nmap-services file, you can see that this scan includes the following ports:

The port specification command-line option is also used with the IP scan technique to specify the protocol numbers (0–255) to scan. The following example shows the use of the IP protocol scan with the TCP protocol:

# nmap -sO -p 6 192.168.100.0/24
Starting Nmap 4.50 (http://insecure.org) at 2007-12-28 13:34 Eastern StandardTime
Interesting protocols on 192.168.100.1:

MAC Address: 00:14:6C:19:F8:65 (Netgear)
Interesting protocols on 192.168.100.4:

MAC Address: 00:30:65:0D:28:34 (Apple Computer)
Nmap done: 256 IP addresses (3 hosts up) scanned in 39.747 seconds

Another port specification command-line option is the fast scan (-F), which scans only for ports listed in the nmap-services file. To make this option even more efficient, you can specify your own customized nmap-services file using the –servicedb command-line option, for example:

nmap —servicedb /home/me/my-services 192.168.100.0/24

Table 4.3 summarizes the port scanning command-line options. We are really starting to see the power and versatility of the Nmap scanner. One thing to keep in mind in terms of port scanning is that Nmap uses its built in nmap-services file to correlate ports and services to output in the results. Most of the time, these are actually the services running on these ports, however, in some cases it may be a different service or even a Trojan application. Luckily, Nmap also has the ability to probe active services for more information. The next two sections show you how to perform Nmap OS detection, and service and application version detection.

Nmap Scripting Engine

The Nmap Scripting Engine (NSE) extends Nmap’s capabilities to enable it to perform a variety of tasks and report the results along with Nmap’s normal output. Some examples of NSE scripts include:

■ Enhanced Network Discovery Perform whois lookups, perform additional protocol queries, and act as a client for the listening service to collect information such as available network shares.

■ Enhanced Version Detection Perform complex version probes and attempt service brute-force cracking.

■ Vulnerability Detection Execute probes to check for specific vulnerabilities.

■ Malware Detection Execute probes to discover Trojan and worm backdoors.

■ Vulnerability Exploitation Execute scripts to exploit a detected vulnerability.

NSE scripts are written in the Lua scripting language and named with the extension .nse. They are stored in the scripts subdirectory of the main Nmap directory. The script. db file is also located in the main Nmap directory, and it contains the list of all NSE scripts and their associated categories (safe, intrusive, malware, backdoor, version, discovery, vulnerability). The NSE script will first determine whether it should be run against the target host (does the target host meet certain criteria such as an open port or running service), by analyzing Nmap’s scan output before it executes the actions of the script. The quickest way to start using NSE is to use the -sC command-line option:

nmap -sC 192.168.100.0/24

This option will perform a script scan of all safe and intrusive scripts. You can use the --script option to have more granular control over the specific scripts and categories that are executed. For example, to execute all scripts in the vulnerability category you can use the following:

nmap --script = vulnerability 192.168.100.3

This will perform a lightweight vulnerability scan of the specified target. To execute a single script you can use the following:

nmap --script = promiscuous.nse 192.168.100.0/24

This will execute the promiscuous.nse script to look for Ethernet cards in promiscuous mode. In the enterprise, this is something worth investigating for security auditing, because it will discover systems that are running sniffers. Sniffers may be running on legitimate network analyzer systems, or employees may have installed them, or they may be running on a system compromised by an attacker. This security auditing can also be coupled with policy compliance checking to determine if unauthorized individuals are running sniffers. You may have a certain subset of NSE scripts that you would like to execute. You can run these by specifying the directory where they are located:

nmap --script =/my-scripts 192.168.100.0/24

This will execute all NSE scripts in the my-scripts directory. Use the all parameter to execute all NSE scripts that are included with Nmap:

# nmap --script = all 192.168.100.4
Starting Nmap 4.50 (http://insecure.org) at 2008-01-03 21:55 EST
Interesting ports on server.home.com (192.168.100.4):
Not shown: 1705 closed ports

MAC Address: 00:11:F5:92:26:65 (Askey Computer)
Host script results:
|_ NBSTAT: NetBIOS name: MYLAPTOP, NetBIOS MAC: 00:11:F5:92:26:65
|_ Promiscuous detection: Win98/Win2K/WinXP with pcap installed. I’m unsure if they’re sniffing. (tests: “1_1_____1_”)
Nmap done: 1 IP address (1 host up) scanned in 6.343 seconds

Notice the Host script results in the output. The scripts detected the NetBIOS name and that WinPcap is installed. NSE includes a few advanced NSE command-line arguments, mostly for script developers and debugging. These include the ability to pass arguments to scripts to override script values, running a trace for a script, and updating the script database. Table 4.6 summarizes the NSE command-line options. We should see a lot more NSE scripts in the future, since NSE is a new and evolving Nmap feature with lots of expansion capabilities.

Evasion and Spoofing

As we have mentioned throughout this chapter, security controls such as packet filters, router access control lists, and firewalls will limit the results of your Nmap scanning. Nmap scans are also easily detected by intrusion detection and prevention systems (IDPS). In the enterprise, this may not be a concern since you may have physical access to internal networks behind the security controls and you are not concerned with being detected. However, Nmap does include several options to attempt to evade firewalls and IDPSes. You may be interested in using these features to test the robustness of your security controls and their susceptibility to evasion techniques. You may also wish to use these techniques as part of a full security audit or penetration test to attempt to defeat security controls using the same methods as attackers. For example, evasion techniques are often used to verify that firewall filters are operating properly. We have already mentioned some evasion techniques in the “Port Scanning” section, such as the Idle scan and FTP bounce. We also mentioned some evasion techniques that use timing parameters in the “Performance and Optimization” section. In this section, we will take a closer look at evasion methods that use fragmentation, spoofing, and packet manipulation techniques.

Packet fragmentation is an old and common evasion technique that splits the packet header across many small packets. This will sometimes break up distinguishing characteristics across packets and evade pattern matching detection techniques. You can fragment your Nmap packets by using the -f command-line option. This will break the packets into a maximum of 8 bytes after the IP header. If you use this option twice, Nmap will break the packets into a maximum of 16 bytes after the IP header. You can use the --mtu command-line option (instead of the -f option) to specify your own packet size for fragmentation in multiples of 8. For example, the following command-line options perform the same fragmentation:

nmap -f -f 192.168.100.0/24
nmap --mtu 16 192.168.100.0/24

Fragmentation doesn’t always evade security controls these days, because controls have built-in techniques to detect and handle fragmentation. However, sometimes controls don’t have this feature enabled for performance and routing reasons.

Spoofing is another evasion technique where you mask your IP address by pretending to be another system on the Internet. We saw this with both the Idle and FTP bounce scans. The Nmap decoy scan (-D) combines spoofing and confusion to attempt to evade detection. By specifying decoys, you are making it appear that other hosts are also scanning the target in hopes that you won’t be detected or singled out. You can specify multiple decoys as a comma-separated command-line parameter. You can also specify ME in the list to represent the position for your actual system, otherwise Nmap will position your system randomly. Positioning your system further down the list increases the chances that you will not be detected. Attackers often use real IP addresses of active hosts on the Internet, but for enterprise auditing this may not be necessary, and may get you into trouble if the owners of the active systems take action. For security testing purposes, you can specify other IP addresses in your network, maybe even ones set up in a development or lab environment for this purpose. An example of a decoy scan includes the following:

nmap -D <192.168.100.1,192.168.100.4,192.168.100.20,192.168.100.3,192.168.100.55,19 2.168.100.100,ME,192.168.100.29,192.168.100.57> 192.168.2.0/24

This example uses 8 decoys with the real scanning system at position 7. Although this isn’t “traditional” spoofing since your address will still show up as scanning the target, it can add enough confusion to the mix to evade detection.

If you want to use traditional spoofing to make your system appear as another system, use the -S command-line option. However, you won’t get responses back from the target since they will go to the spoofed system. This option is also used to specify the IP address of the interface on your system that you will use to send packets when Nmap can’t determine your actual IP address. You can also use the -e command-line option to specify an interface to use in this case. You can use the --spoof-mac command-line option to specify a MAC address to be included in the Nmap packets. If you specify a 0 as the option parameter, Nmap will choose a random MAC address for you. You can also specify a full MAC address, or a vendor prefix or name, in which case Nmap fills in the rest for you with random values. However the vendor name must be included in the nmap-mac-prefixes file. Some examples of MAC spoofing include the following:

nmap --spoof-mac 0 192.168.100.0/24
nmap --spoof-mac 11:22:33:44:55:66 192.168.100.0/24
nmap --spoof-mac 000D93 192.168.100.0/24
nmap --spoof-mac D-Link 192.168.100.0/24

Nmap will then report the MAC address that it is using. The last example provided the following output:

Spoofing MAC address 00:05:5D:DA:32:64 (D-Link Systems)

In addition to source IP and MAC addresses, you can also specify source ports to use for scanning. Specifying a popular source port that is often allowed through firewalls (such as DNS port 53) is a common way to evade firewalls. Nmap includes two equivalent command-line options to specify a source port: -g and --source-port. For example, the following uses perform the same scanning, using a source port of 53:

nmap -g 53 192.168.100.0/24
nmap --source-port 53 192.168.100.0/24

Nmap offers several packet manipulation techniques that may be used for evasion. You can use the --date-length command-line option to append a specified number of random bytes to the packets Nmap sends during scans. This may avoid Nmap detection signatures and other detection techniques. You can also specify IP options to include in the packet by using the --ip-options command-line option. You can specify record route (R), record timestamps (T ), record timestamps and route (U ), loose source routing (L), or strict source routing (S). To have more granular control than these built-in parameters, you can also use hex notation to specify IP options as long as they are each preceded by an x. IP options may evade security controls by specifying routes to take to the target.

You can set the time to live (TTL) field to a given value with the --ttl command-line option. This may be effective at evading some security controls. Another method to avoid detection is to randomize the target hosts that are being scanned by using the --randomize-hosts command-line option. You can have Nmap use an invalid TCP or UDP checksum with the --badsum command-line option. Most hosts will drop packets with bad checksums, so if you receive responses to these scans, they are probably coming from security controls, such as firewalls, that don’t verify checksums.

Table 4.8 summarizes the evasion and spoofing command-line options. Nmap just scratches the surface of possible evasion and spoofing techniques. There are a variety of advanced tools available to go beyond what has been presented here. The features that Nmap does provide for evasion and spoofing are more than adequate for typical enterprise scanning.

Output Logging

Nmap output goes well beyond the on screen reporting shown in the examples so far. Nmap offers a variety of output formats for standard output and file-based formats, such as XML, for interoperability with other software programs. Nmap output also offers various levels of verbosity and debugging messages. Nmap offers the following output formats:

■ Interactive By default, Nmap reports results to standard output, on the screen, to be analyzed interactively. This format is always displayed, even when other output options are used, unless you use the hypen (-) to disable interactive output.

■ Normal The results are also sent to standard output, but with less runtime information and warnings. To report results in normal output format use the -oN < filename > command-line option.

■ XML The results are reported in XML format that can be converted to HTML and parsed by other software programs. To report results in XML format, use the -oX < filename > command-line option. The XML document type definition file is located at http://insecure.org/nmap/data/nmap.dtd. It includes the Nmap XML formatting specifics. You can download the file and view it with a text viewer. Besides using XML for software interoperability, you can also view the XML output in a Web browser, as shown in Figure 4.1.

■ Grepable Output that can be easily parsed by scripts and other software programs. To report output in grepable format, use the -oG < filename > command-line option. Grepable output is considered depreciated in favor of XML output, but grepable output is still highly used because it is a much easier format to use for quick scripting. UNIX tools such as grep, sed, awk, and cut are all used with grepable output. Perl is also a great language to use to parse grepable output. More information on grepable output format can be found at www.unspecific.com/nmap-oG-output.

■ s| < rIpt kIddi3 The output is written in Leetspeak, which uses symbols and numbers to replace alphabet characters. Leet has been used among hackers and script kiddies since the 1980s. Nmap incorporates Leet to mock script kiddies, but to also demonstrate how output can be modified in arbitrary ways, as mentioned at http://seclists.org/nmap-hackers/2000/0005.html. To report results in s| < rIpt kIddi3 (script kiddie) format use the -oS < filename > command-line option.

The following example logs Nmap results in grepable format:

# nmap -oG myscan.gnmap 192.168.100.3

Grepable output contains commas, colons, and forward slashes to facilitate use of UNIX commands and programming languages for parsing the output:

# nmap 4.50 scan initiated Sat Jan 5 18:12:34 2008 as: nmap -oG myscan.gnmap 192.168.100.3
Host: 192.168.100.3 (systemB.home.com) Ports: 135/open/tcp//msrpc///, 139/open/ tcp//netbios-ssn///, 3389/open/tcp//ms-term-serv///, 6346/filtered/tcp//gnutella///, 6347/filtered/tcp//gnutella2///, 8081/open/tcp//blackice-icecap///
# Nmap done at Sat Jan 5 18:12:38 2008 – 1 IP address (1 host up) scanned in 3.810 seconds

The output formats can be combined, but you can only specify each format once. For example, you can send results to both normal and XML format by using the following command:

nmap -oN scan.nmap -oX scan.xml 192.168.100.0/24

You can also use the -oA < filename > command-line option to output results in normal, XML, and grepable formats at once:

nmap -oA myscan 192.168.100.0/24

The files are stored as myscan.nmap, myscan.xml, and myscan.gnmap. As noted earlier, interactive output is always displayed unless it is disabled as in the following example:

nmap -oN - 192.168.100.0/24

Nmap allows users to control the verbosity and debugging features with a variety of command-line options. The most commonly used option is the verbose (-v) option, which provides additional information such as completion time estimates, and displays open ports as they are discovered. The verbose option can be provided twice for greater verbosity. For example:

# nmap -v -v 192.168.2.3
Starting Nmap 4.50 (http://insecure.org) at 2008-01-01 18:40 Eastern
Standard Time
Initiating Ping Scan at 18:40
Scanning 192.168.2.3 [2 ports]
Completed Ping Scan at 18:40, 0.12 s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 18:40
Completed Parallel DNS resolution of 1 host. at 18:40, 11.06 s elapsed
Initiating SYN Stealth Scan at 18:40
Scanning 192.168.2.3 [1711 ports]
Discovered open port 3389/tcp on 192.168.2.3
Discovered open port 135/tcp on 192.168.2.3
Discovered open port 8081/tcp on 192.168.2.3
Discovered open port 139/tcp on 192.168.2.3
Completed SYN Stealth Scan at 18:40, 4.75 s elapsed (1711 total ports)
Host 192.168.2.3 appears to be up … good.
Interesting ports on 192.168.2.3:
Not shown: 1707 closed ports

Read data files from: C:Program Filesmap
Nmap done: 1 IP address (1 host up) scanned in 19.729 seconds
 Raw packets sent: 1746 (76.804 KB) | Rcvd: 1712 (68.484 KB)

You can get even more output information by using Nmap’s debugging option (-d). Nmap debugging accepts a numerical level up to a value of 9. With debugging you can gain insight into the very details of what Nmap is doing during the scan, and you also get a substantially large amount of information to sift through. Another method of debugging is to use the --packet-trace command-line option. This option will print every packet sent and received during the Nmap scan, just like a packet sniffer. The --iflist command-line option is used for debugging, because it displays a list of the scanning system’s interfaces and network routes. This is a status option only and does not perform a scan, so it can be specified without a target host. Another useful debugging feature is error logging. Although errors are displayed on the screen as part of interactive output, you can log them to a file with the --log-errors command-line option. The errors get displayed in the normal output file so you must also use the -oN (or -oA) command-line option:

nmap -oN myoutput.nmap –log-errors 192.168.100.0/24

A way to customize Nmap output is to use the --open command-line option to show only open, open|filtered, and unfiltered ports. Another nice feature is the ability to append to existing output files instead of overwriting them, which is what Nmap will do by default. You can use the --append-output command-line option to add your new results to an existing output file. Existing output files are also useful to resume scans that have been canceled or interrupted. If you are logging out to normal or grepable format, you can use the --resume command-line option to have Nmap continue the scanning and append the new results to the existing output file:

nmap --resume scanoutput.nmap

Nmap also includes a few command-line options for configuring XML output. To view XML output as Hypertext Markup Language (HTML), you must have the XSL stylesheet (nmap.xsl) installed on the same system. This file installs by default in the Nmap directory. If you are viewing the XML file on another system, it won’t be displayable if Nmap isn’t installed. You can use the --stylesheet command-line option to specify a path or URL to an nmap.xsl stylesheet, but even easier you can use the --webxml command-line option to retrieve the latest version of the stylesheet from insecure.org. You can also use the --no_stylesheet command-line option to omit a stylesheet altogether.

Table 4.9 summarizes the output logging command-line options. Nmap allows users to display a variety of levels of output information and formats. This configurability allows Nmap to be viewed interactively, scripted, or integrated with other output parsers.

☑ Nmap can be run from the command line or Zenmap GUI.

☑ You must have administrator or root privileges to use all of Nmap’s features.

☑ Running Nmap with no options displays the usage information.

☑ Nmap supports a variety of ways to specify scanning targets.

Discovering Hosts

☑ Nmap can discover available hosts by using ping scanning and other ICMP requests, TCP SYN pings, TCP ACK pings, UDP pings, and IP Protocol pings.

☑ TCP SYN and TCP ACK pings are often used to detect hosts behind firewalls.

☑ You can disable host discovery during your Nmap scan.

Port Scanning

☑ Nmap offers a variety of port scanning techniques.

☑ Nmap reports port status as one of six possible states.

☑ Nmap performs SYN scanning by default.

☑ If a user doesn’t have root or administrator privileges, Nmap will perform the TCP connect scan (-sT ) by default.

☑ Nmap offers several stealthy port scanning techniques such as idle scanning and FTP bounce scanning.

☑ Nmap offers a variety of ways to specify ports to scan.

Detecting Operating Systems

☑ Nmap performs OS detection by probing the target host and analyzing the responses.

☑ Each OS has distinctive responses to the probes which identify the OS and result in an OS fingerprint.

☑ Nmap includes several command-line options to configure the OS detection engine.

Detecting Service and Application Versions

☑ Nmap can perform version detection to gather more detail on the services and applications running on the identified open ports.

☑ Nmap needs OpenSSL to discover listening services behind SSL encryption.

☑ The OS and version detection probe databases are continually growing from contributions from the user community.

Other Scanning Options

☑ The NSE performs a variety of advanced techniques such as vulnerability and malware detection and exploitation.

☑ Nmap has several features to enhance timing and performance, including advanced algorithms and executing tasks in parallel.

☑ Nmap timing options include timing templates, parallelism, timeouts, and retries.

☑ Nmap includes evasion methods that use fragmentation, spoofing, and packet manipulation techniques.

☑ Nmap reports scanning results to standard output, known as interactive output.

☑ Nmap can log results in normal, XML, grepable, and s| < rIpt kIddi3 format.

☑ You can get more information by using Nmap’s verbosity and debugging levels.

☑ Nmap supports IPv6 scanning.