nmap is the tool any Penetration Tester\/ Ethical Hacker can’t do without.<\/p>\n
The tool can be downloaded from – http:\/\/nmap.org<\/a><\/p>\n I will use scanme.nmap.org as the target system for the demonstration:<\/p>\n When we run the nmap command against scanme.nmap.org<\/p>\n The scan it runs by default is the TCP SYN Scan, also known as the Stealth of Half Scan. As you can see it give you a list of interesting ports, with a state and a service that might be running on that port.<\/p>\n I normally start with a host discovery with a ping scan, this goes no further than to determine if the host is online.<\/p>\n You can run a list scan, but this only gives you a list of targets to scan<\/p>\n This scan will, probably only be used, to determine if what the network range that you want scan involves…something like…<\/p>\n as you can see no scanning, just listing.<\/p>\n I upgraded my nmap version to nmap-5.36.t4 , there are other interresting things that comes with this like NPING<\/a> and NCAT<\/a> (Ncat was written for the Nmap Project as a much-improved reimplementation of the venerable Netcat<\/a>)<\/p>\n But I will blog about that a bit later….<\/p>\n[root@byte ~]# ping -c 3 scanme.nmap.org\nPING scanme.nmap.org (64.13.134.52): 56 data bytes\n64 bytes from 64.13.134.52: icmp_seq=0 ttl=54 time=162.937 ms\n64 bytes from 64.13.134.52: icmp_seq=1 ttl=54 time=158.487 ms\n64 bytes from 64.13.134.52: icmp_seq=2 ttl=54 time=154.497 ms\n\n--- scanme.nmap.org ping statistics ---\n3 packets transmitted, 3 packets received, 0.0% packet loss\nround-trip min\/avg\/max\/stddev = 154.497\/158.640\/162.937\/3.447 ms\n\n<\/span><\/pre>\n[root@byte ~]# nmap scanme.nmap.org\n\nStarting Nmap 5.00 ( http:\/\/nmap.org ) at 2011-01-14 06:13 CST\nInteresting ports on scanme.nmap.org (64.13.134.52):\nNot shown: 993 filtered ports\nPORT STATE SERVICE\n22\/tcp open ssh\n25\/tcp closed smtp\n53\/tcp open domain\n70\/tcp closed gopher\n80\/tcp open http\n113\/tcp closed auth\n31337\/tcp closed Elite\n\nNmap done: 1 IP address (1 host up) scanned in 34.15 seconds\n[root@byte ~]#\n\n<\/span><\/pre>\n[root@byte ~]# nmap -sP scanme.nmap.org\n\nStarting Nmap 5.00 ( http:\/\/nmap.org ) at 2011-01-14 06:28 CST\nHost scanme.nmap.org (64.13.134.52) is up (0.16s latency).\nNmap done: 1 IP address (1 host up) scanned in 0.62 seconds\n[root@byte ~]#\n\n<\/span><\/pre>\n[root@byte ~]# nmap -sL scanme.nmap.org\n\nStarting Nmap 5.00 ( http:\/\/nmap.org ) at 2011-01-14 06:28 CST\nHost scanme.nmap.org (64.13.134.52) not scanned\nNmap done: 1 IP address (0 hosts up) scanned in 0.24 seconds\n[root@byte ~]#\n\n<\/span><\/pre>\n[root@byte ~]# nmap -sL 64.13.134.48\/28\n\nStarting Nmap 5.00 ( http:\/\/nmap.org ) at 2011-01-14 06:35 CST\nHost nmap.org (64.13.134.48) not scanned\nHost insecure.org (64.13.134.49) not scanned\nHost seclists.org (64.13.134.50) not scanned\nHost sectools.org (64.13.134.51) not scanned\nHost scanme.nmap.org (64.13.134.52) not scanned\nHost research.nmap.org (64.13.134.53) not scanned\nHost cust-134-54.titan.net (64.13.134.54) not scanned\nHost cust-134-55.titan.net (64.13.134.55) not scanned\nHost cust-134-56.titan.net (64.13.134.56) not scanned\nHost cust-134-57.titan.net (64.13.134.57) not scanned\nHost ns1.titan.net (64.13.134.58) not scanned\nHost ns2.titan.net (64.13.134.59) not scanned\nHost wwwr.titan.net (64.13.134.60) not scanned\nHost nswc1.titan.net (64.13.134.61) not scanned\nHost nswc2.titan.net (64.13.134.62) not scanned\nHost 64.13.134.63 not scanned\nNmap done: 16 IP addresses (0 hosts up) scanned in 0.21 seconds\n[root@byte ~]#\n\n<\/span><\/pre>\n