Network Enumeration with Nmap (Continue Here)

Introduction

• Network Mapper (Nmap) is an open-source network analysis and security auditing tool, it is designed to scan networks and identify which hosts are available on the network using raw packets, and services and applications, including the name and version, where possible.

• Nmap can be divided into the following scanning techniques:

  • Host discovery

  • Port scanning

  • Service enumeration and detection

  • OS detection

  • Scriptable interaction with the target service (Nmap Scripting Engine)

• The general syntax

sudo nmap <scan types> <options> <target>

Host Discovery

• When conducting a network penetration testing, we should get an idea of what systems we can interact with.

# Find the live systems' IP addresses without running port scanning.
sudo nmap <IP Address>/<Subnet> -sn -oA <Output File> | grep for | cut -d" " -f5

# Find the live systems' IP addresses from a file (Seperating each IP address with a new line)
sudo nmap -sn -oA <Output File> -iL <Input File> | grep for | cut -d" " -f5

# We can specify specific IP addresses or a specific range
sudo nmap -sn -oA <Output File> <IP Address or Range> | grep for | cut -d" " -f5