In this step, we're going to learn how to perform a basic Nmap scan and save the results to a text file. Documenting network reconnaissance activities is crucial as it helps you keep track of what you've discovered and can be used for future reference or reporting. So, mastering this skill is essential for anyone interested in network security.
Understanding Nmap Basics
Nmap, short for Network Mapper, is a powerful and widely - used free and open - source utility. Its main purpose is network discovery and security auditing. It works by sending raw IP packets to the target network or host. Based on the responses it receives, Nmap can figure out a lot of information. It can tell you which hosts are available on the network, what services those hosts are offering (like web servers, email servers, etc.), what operating systems they are running, and many other important characteristics. This information is invaluable when you're trying to understand the security posture of a network.
Creating a Directory for Scan Results
First, open a terminal window. By default, the terminal should already be in the /home/labex/project directory. We need a dedicated place to store all the results of our Nmap scans. This makes it easier to organize and manage the data. So, let's create a directory for this purpose using the following command:
mkdir -p /home/labex/project/scans
The -p flag in the mkdir command is very useful. It ensures that the directory is created even if the parent directories don't exist. In our case, the parent directory already exists, but it's a good practice to use this flag in case you want to create a more complex directory structure in the future. If the command executes successfully, you won't see any output. That's normal, and it means the directory has been created.
Running a Basic Nmap Scan
For the sake of demonstration, we'll scan the localhost, which is your own machine, on port 9999. In a real - world situation, you would need proper authorization to scan actual network hosts. Scanning without permission is unethical and may even be illegal.
Now, let's run a basic Nmap scan and save the output to a text file. Execute the following command:
nmap -p 9999 localhost -oN /home/labex/project/scans/initial_scan.txt
Let's break down this command to understand what each part does:
nmap: This is the command to start the Nmap tool. It tells the system that we want to use Nmap for our network scan.-p 9999: The -p option is used to specify the port we want to scan. In this case, we're scanning port 9999.localhost: This is the target of our scan. Since we're using localhost, we're scanning our own machine.-oN /home/labex/project/scans/initial_scan.txt: The -oN option is used to save the output in "normal" format. The path /home/labex/project/scans/initial_scan.txt specifies where the output file will be saved.
After running the command, you should see output similar to this:
Starting Nmap 7.80 ( https://nmap.org ) at 2023-10-30 12:00 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000097s latency).
PORT STATE SERVICE
9999/tcp closed unknown
Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds
Viewing the Saved Scan Results
Now that we've run the scan and saved the results to a file, let's check if the results were properly recorded. We can do this by viewing the content of the saved file using the cat command:
cat /home/labex/project/scans/initial_scan.txt
The output you see should be similar to what was displayed in the terminal when you ran the scan. This file now serves as a record of your network reconnaissance activities. You can refer back to it whenever you need to review the information.
Understanding the Scan Results
The scan results contain several important pieces of information:
- When the scan was performed: This helps you keep track of the timeline of your network reconnaissance.
- The target that was scanned: In our case, it was
localhost.
- The state of the host: It tells you whether the host is up (reachable) or down (unreachable).
- The state of the specified port: It can be open, closed, or filtered. An open port means a service is listening on that port, a closed port means no service is listening, and a filtered port means the port is being blocked by a firewall or other security device.
- The service typically associated with that port: For example, port 80 is usually associated with HTTP services.
- Statistics about the scan duration: This gives you an idea of how long the scan took.
Now that you've successfully performed your first Nmap scan and saved the results to a file for documentation purposes, in the next step, we'll explore different output formats that Nmap supports.
