In this tutorial you’ll fined 20 basic examples of Nmap command usage.
You’ll see how to use Nmap from the Linux command line to find active hosts on a network and scan for the opened ports.
You’ll learn how to determine a remote operation system using TCP/IP stack fingerprinting and how to discover what version of software is running on a remote host.
I’ll also show how to use Nmap for stealthy scanning, how to detect firewalls and spoof MAC address. (more…)
In this article i will explain how to stay anonymous during port scanning with Nmap (utility for network discovery and security auditing).
I’ll show how to perform an anonymous port scanning through the Tor network, using ProxyChains utility.
I’ll also show how to get round a situation where scan fails, because Tor endpoints are blocked.
To perform an anonymous port scanning, we need to install the following tools:
| Package | Description |
|---|---|
| tor | Anonymizing overlay network for TCP |
| nmap | Network port scanner |
| proxychains | Redirect connections through proxy servers |
Install Tor from the standard repositories:
$ sudo apt-get install tor
$ sudo apt-get install nmap
$ sudo apt-get install proxychains
ProxyChains is already configured to use Tor by default.
You can verify this by looking up /etc/proxychains.conf.
The last lines should be like these:
[ProxyList] # add proxy here ... # meanwile # defaults set to "tor" socks4 127.0.0.1 9050
Run the following command to perform an anonymous Nmap scanning through Tor network:
$ proxychains nmap -sT -PN -n -sV -p 80,443,21,22 217.xx.xx.xx ProxyChains-3.1 (http://proxychains.sf.net) Starting Nmap 6.00 ( http://nmap.org ) at 2014-03-24 17:34 EET |S-chain|-<>-127.0.0.1:9050-<><>-217.xx.xx.xx:443-<><>-OK |S-chain|-<>-127.0.0.1:9050-<><>-217.xx.xx.xx:21-<><>-OK |S-chain|-<>-127.0.0.1:9050-<><>-217.xx.xx.xx:80-<><>-OK |S-chain|-<>-127.0.0.1:9050-<><>-217.xx.xx.xx:22-<--denied Nmap scan report for 217.xx.xx.xx Host is up (0.14s latency). PORT STATE SERVICE VERSION 21/tcp open ftp Pure-FTPd 22/tcp closed ssh 80/tcp open http Apache httpd 2.2.26 ((CentOS)) 443/tcp open ssl/http Apache httpd 2.2.26 ((CentOS))
In the scan log we can see the ‘chain’ that goes from Tor-proxy (127.0.0.1:9050) to our scanned host (217.xx.xx.xx).
It is possible that we will encounter a situation where scan fails, because Tor endpoints are blocked.
The solution may be in adding common public proxy server to the ‘chain’.
We can do that by simply editing the /etc/proxychains.conf and adding a new entry at the end of the [ProxyList] (be sure that random_chain option is disabled).
[ProxyList] # add proxy here ... # meanwile # defaults set to "tor" socks4 127.0.0.1 9050 socks4 115.71.237.212 1080
The new ‘chain’ goes through the Tor-proxy (127.0.0.1:9050) to some public proxy server (115.71.237.212:1080) and then to our scanned host (217.xx.xx.xx).
$ proxychains nmap -sT -PN -n -sV -p 21 217.xx.xx.xx ProxyChains-3.1 (http://proxychains.sf.net) Starting Nmap 6.00 ( http://nmap.org ) at 2014-03-25 11:05 EET |S-chain|-<>-127.0.0.1:9050-<>-115.71.237.212:1080-<><>-217.xx.xx.xx:21-<><>-OK |S-chain|-<>-127.0.0.1:9050-<>-115.71.237.212:1080-<><>-217.xx.xx.xx:21-<><>-OK Nmap scan report for 217.xx.xx.xx Host is up (1.2s latency). PORT STATE SERVICE VERSION 21/tcp open ftp Pure-FTPd
In the examples above, i run Nmap with the following options:
| Option | Description |
|---|---|
| -sT | full TCP connection scan |
| -PN | do not perform host discovery |
| -n | never perform DNS resolution (to prevent DNS leaks) |
| -sV | determine service version/info |
| -p | ports to scan |
Scanning through Tor is very slow. That is why, i’ve scanned only several specified ports in the examples above.
Even if you are using proxy, all your DNS queries still go to the DNS server of your ISP.
To prevent DNS leaks, use tor-resolve command to resolve a hostname to an IP address via Tor network:
$ tor-resolve google.com 173.194.34.174
Searching for Linux command that can list all IP addresses of devices connected to the network?
Use nmap or ping commands to determine alive hosts in your local network.
Scan for active hosts on a network using nmap command:
# Standard ICMP ping $ nmap -sn 192.168.1.0/24
Sample output:
Starting Nmap 6.00 ( http://nmap.org ) at 2013-06-14 00:52 EEST Nmap scan report for 192.168.1.1 Host is up (0.0031s latency). Nmap scan report for 192.168.1.101 Host is up (0.00097s latency). Nmap scan report for 192.168.1.102 Host is up (0.065s latency). Nmap done: 256 IP addresses (3 hosts up) scanned in 2.98 seconds
Use the following script to find out what computers in your local network respond to ping:
$ echo 192.168.1.{1..254}|xargs -n1 -P0 ping -c1|grep "bytes from"
Sample output:
64 bytes from 192.168.1.101: icmp_req=1 ttl=64 time=0.042 ms 64 bytes from 192.168.1.1: icmp_req=1 ttl=64 time=37.4 ms 64 bytes from 192.168.1.102: icmp_req=1 ttl=64 time=208 ms
Some hosts may have a firewall, and will not respond to standard ICMP pings.
If a firewall is blocking standard ICMP pings, try the following host discovery methods:
# TCP SYN Ping $ nmap -sn -PS 192.168.1.0/24 # TCP ACK Ping $ nmap -sn -PA 192.168.1.0/24 # UDP Ping $ nmap -sn -PU 192.168.1.0/24 # IP Protocol Ping $ nmap -sn -PO 192.168.1.0/24 # ARP Ping $ nmap -sn -PR 192.168.1.0/24
Last three commands should be executed with root credentials.