Learn Nmap Network Scanning Basics

Introduction

In this lab, you will learn the fundamentals of network scanning using Nmap. Nmap is a powerful and versatile tool widely used by network administrators and security professionals. It's an open - source utility for network discovery and security auditing, capable of scanning networks to find hosts and services, identify operating systems, and detect vulnerabilities.

Through practical exercises, you'll understand how to perform different types of port scans. You'll also learn to interpret scan results and gain insights into network security assessment techniques.

Skills Graph

Understanding Ports and Setting Up the Environment

Before we start learning about port scanning, it's crucial to understand what ports are in the context of computer networking. Ports act as communication endpoints. They enable different processes on a computer to share network resources. Think of them as doorways through which data can enter and leave a computer. There are a total of 65,535 ports available, and they are divided into three ranges:

• Well-known ports: These are ports numbered from 0 to 1023. They are reserved for specific services. For example, port 80 is used for HTTP (Hypertext Transfer Protocol), which is the protocol used for transferring web pages. Port 22 is used for SSH (Secure Shell), which is a protocol for securely accessing a remote computer.
• Registered ports: These ports range from 1024 to 49151. They are registered with the Internet Assigned Numbers Authority (IANA). While they are registered, ordinary users can also use them for their own applications.
• Dynamic/Private ports: These ports are in the range of 49152 to 65535. They are freely available for temporary use. Applications can use these ports when they need to establish a short - term connection.

In this step, we're going to set up a local service in our lab environment. We'll scan this service later. This hands - on approach will help you understand how Nmap, a powerful port - scanning tool, detects open ports and the services running on them.

First, open a terminal. A terminal is a text - based interface where you can enter commands to interact with your computer. Once the terminal is open, you need to make sure you're in the project directory. The project directory is where all the files related to this experiment are stored. You can navigate to the project directory by running the following command:

cd /home/labex/project

Next, we'll create a simple HTTP server on your machine. We'll use Python's built - in HTTP server module. This server will listen on port 8080. Listening on a port means that the server is waiting for incoming requests on that specific port. This server will be the target of our Nmap scans. To start the server, execute the following command:

python3 -m http.server 8080 &

After running this command, the output should look similar to:

Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...

The & symbol at the end of the command is important. It runs the process in the background. This means that the server will keep running, and you can continue using the terminal to enter other commands.

To verify that the server is running, we'll check the listening ports. We can do this by running the following command:

ss -tuln | grep 8080

The ss command is used to display socket statistics. The -tuln options tell the command to show TCP, UDP, listening sockets, and display numerical addresses. The | symbol is a pipe, which takes the output of the ss command and passes it to the grep command. The grep command then searches for the string 8080 in the output.

If the server is running correctly, the output should show that port 8080 is being used:

tcp   LISTEN  0       1            0.0.0.0:8080      0.0.0.0:*

This output confirms that our HTTP server is running as expected and is ready to be scanned by Nmap.

Basic Nmap Port Scanning

Now that our HTTP server is up and running, we're ready to start performing basic port scans using Nmap. But first, let's understand what port scanning is. Port scanning is a fundamental technique in network security. It helps us find out which ports on a host are open. Ports are like doors in a building; each service running on a computer uses a specific port to communicate. For network administrators, knowing which ports are open ensures that their services are operating as expected. For security professionals, it's a crucial step in identifying potential vulnerabilities because open ports can sometimes be exploited by attackers.

First, we need to make sure that Nmap is installed on our system. Nmap is a powerful network scanning tool that we'll be using throughout this experiment. To check if it's installed, we can run the following command in the terminal:

nmap --version

This command asks the system to display the version of Nmap installed. If Nmap is installed correctly, you should see output similar to this:

Nmap version 7.80 ( https://nmap.org )

Performing a Basic Port Scan

Now that we've confirmed Nmap is installed, let's perform a basic scan to check if port 8080 is open on our localhost. The localhost refers to the computer we're currently working on, represented by the IP address 127.0.0.1. To perform the scan, execute the following command:

nmap -p 8080 localhost

In this command, the -p flag is used to specify which port or ports we want to scan. Here, we're only interested in port 8080. When you run this command, Nmap will send special network packets to port 8080 on the localhost and analyze the responses to determine if the port is open.

You should see output similar to this:

Starting Nmap 7.80 ( https://nmap.org ) at 2023-08-01 10:00 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00020s latency).

PORT     STATE SERVICE
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

This output provides us with important information. It tells us that port 8080 is open and that Nmap has identified the service running on this port as "http-proxy".

Next, we want to save the output of this scan to a file. Saving the scan results is useful because we can refer back to them later for further analysis. To save the output, run the following command:

nmap -p 8080 localhost > /home/labex/project/basic_scan.txt

In this command, the > symbol is used to redirect the output of the Nmap scan to a file named basic_scan.txt located in the /home/labex/project directory.

To verify that the output has been saved correctly, we can use the cat command. The cat command is used to display the contents of a file. Run the following command:

cat /home/labex/project/basic_scan.txt

You should see the same output as before, now saved in the file.

Understanding the Output

Let's take a closer look at the output of our Nmap scan to understand what each line means:

• Starting Nmap 7.80 ( https://nmap.org ) at 2023-08-01 10:00 UTC: This line tells us when the Nmap scan started. It's useful for keeping track of when the scan was performed.
• Nmap scan report for localhost (127.0.0.1): This line identifies the target host of the scan. In this case, it's the localhost with the IP address 127.0.0.1.
• Host is up (0.00020s latency): This line confirms that the target host is online. The latency value indicates how long it takes for the network packets to travel to the host and back. A very low latency is expected for the localhost because it's the same computer we're working on.
• PORT STATE SERVICE: This is the header for the port scan results. It tells us what information will be displayed in the following lines.
• 8080/tcp open http-proxy: This line indicates that port 8080 is open. The /tcp part specifies the type of network protocol used (TCP, which is a common protocol for reliable data transfer). Nmap has identified the service running on this port as "http-proxy".
• Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds: This line summarizes the scan. It tells us that Nmap scanned one IP address (the localhost), found the host to be up, and completed the scan in 0.05 seconds.

Advanced Nmap Scanning Techniques

Now that we've successfully completed a basic port scan, it's time to take our skills to the next level and explore some more advanced Nmap scanning techniques. Nmap is a powerful tool that offers numerous options to gather detailed information about network services. This information is crucial for both network administration and security assessment. By using advanced scanning techniques, you can uncover more about the systems on your network, which helps in identifying potential security risks and managing your network more effectively.

Service Version Detection

One of the most useful features of Nmap is its ability to determine what service and version is running on an open port. Knowing the service and its version is essential because it helps you identify potential vulnerabilities associated with specific service versions. Many software vulnerabilities are tied to particular versions, so by knowing the exact version running on a port, you can quickly check if there are any known security issues.

To perform a service version detection scan on port 8080, you need to execute the following command:

nmap -sV -p 8080 localhost

In this command, the -sV flag is the key. It tells Nmap to probe open ports to determine service information. The -p 8080 specifies that we want to scan port 8080, and localhost indicates that we are scanning our own machine.

The output of this command should look similar to the following:

Starting Nmap 7.80 ( https://nmap.org ) at 2023-08-01 10:15 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00022s latency).

PORT     STATE SERVICE VERSION
8080/tcp open  http    SimpleHTTPServer 0.6 (Python 3.10.12)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.32 seconds

As you can see, Nmap now provides more detailed information about the service running on port 8080. It identifies the service as a Python SimpleHTTPServer, along with its version and the Python version it's running on.

Now, let's save this valuable information to a file. You can do this by running the following command:

nmap -sV -p 8080 localhost > /home/labex/project/advanced_scan.txt

The > symbol is used to redirect the output of the nmap command to the specified file.

To view the contents of the file, you can use the cat command:

cat /home/labex/project/advanced_scan.txt

Understanding the Difference Between Basic and Advanced Scans

Let's compare the basic scan and the advanced scan to understand why advanced scans are so useful.

1. Basic Scan (nmap -p 8080 localhost): When you run a basic scan, it only tells you that port 8080 is open and running a service. Based on the port number, Nmap makes a guess that the service might be "http-proxy". However, this is just a rough estimate, and it doesn't give you detailed information about the actual service.

2. Advanced Scan (nmap -sV -p 8080 localhost): In contrast, an advanced scan provides much more detailed information. It tells you the exact service name (SimpleHTTPServer), its version (0.6), and even the programming language and its version (Python 3.10.12) that the service is running on.

This additional information is valuable for several reasons:

• Identifying outdated services: By knowing the exact version of a service, you can easily check if it's an outdated version that might have known vulnerabilities. If so, you can take steps to update the service and secure your network.
• Understanding your network: You can get a clear picture of exactly what software is running on your network. This helps in network management and resource allocation.
• Planning security measures: You can plan security measures that are specific to the services running on your systems. For example, if you know a particular service has a known vulnerability, you can implement targeted security controls.

Other Useful Nmap Options

Nmap offers many other scanning options that can be combined to perform different types of scans. Here are some of the most commonly used options:

• -sS: This is a TCP SYN scan, also known as a stealth scan. It's a fast and stealthy way to scan ports because it doesn't complete the full TCP connection, making it harder to detect.
• -O: This option enables operating system detection. It allows Nmap to try and determine the operating system running on the target machine.
• -A: An aggressive scan that combines several features, including OS detection, version detection, script scanning, and traceroute. It provides a comprehensive view of the target system.
• -T<0-5>: This option is used to set the timing template. A higher number means a faster scan, but it may also increase the chance of being detected.
• -Pn: This option treats all hosts as online, skipping the host discovery phase. It's useful when you know the target is online and want to save time.

For example, if you want to perform a quick scan of all well-known ports on your local machine, you can use the following command:

nmap -F localhost

The -F (fast) option tells Nmap to scan fewer ports than the default scan. This is useful when you want to get a quick overview of the open ports on a system.

Note: In a real network security assessment, it's important to have proper authorization before scanning any systems. Unauthorized scanning may be against the law in many jurisdictions.

Interpreting and Analyzing Scan Results

In this step, we're going to learn how to understand and analyze the results of our Nmap scans. When it comes to network security, being able to read the scan output is essential. It helps you make well - informed decisions about the security of your network. For example, you can identify potential vulnerabilities or unauthorized access points based on the scan results.

Comparing Different Scan Types

Let's conduct a few more types of scans to see how their outputs differ. First, we'll perform a comprehensive scan. This type of scan includes all the common options, which gives us a detailed view of the target.

nmap -A -p 8080 localhost > /home/labex/project/comprehensive_scan.txt

In this command, the -A flag is very important. It enables aggressive scan options. These options include detecting the operating system of the target, figuring out the version of the services running, scanning for available scripts, and performing a traceroute. By using this flag, we can gather a lot of useful information about the target.

Now, let's take a look at the results of this comprehensive scan.

cat /home/labex/project/comprehensive_scan.txt

The output will be quite detailed. It will contain information about the service running on port 8080, any possible scripts that could be run against the service, and other relevant details. This detailed information can help us understand the security situation of the target better.

Understanding Port States

Nmap reports several possible states for ports. Each state tells us something different about the port's status.

• open: This means an application is actively accepting TCP connections or UDP packets on this port. It's like a door that's open and ready to receive visitors.
• closed: The port is accessible, but there's no application listening on it. It's like a door that's unlocked but no one is inside to answer.
• filtered: Nmap can't determine if the port is open because packet filtering prevents its probes from reaching the port. It's like there's a security guard blocking Nmap's view of the door.
• unfiltered: The port is accessible, but Nmap can't tell if it's open or closed. It's like looking at a door and not being able to tell if someone is inside.
• open|filtered: Nmap can't determine if the port is open or filtered. It's an uncertain state where we're not sure if the door is open or blocked.
• closed|filtered: Nmap can't determine if the port is closed or filtered. Similar to the previous state, we're not sure if the door is locked or blocked.

Let's see how these states appear in our scan results by scanning a range of ports.

nmap -p 8080-8085 localhost > /home/labex/project/port_states.txt

After the scan is done, we can view the results.

cat /home/labex/project/port_states.txt

You should see that port 8080 is reported as open, while the other ports in the range are likely reported as closed. This gives us an idea of which ports are actively being used and which ones are not.

Practical Analysis of Results

Now, let's create a summarized report by extracting the key information from our scan results. We'll use the grep command to filter for open ports. Open ports are very important for security assessment because they are potential entry points for attackers.

grep "open" /home/labex/project/comprehensive_scan.txt > /home/labex/project/open_ports.txt

After filtering, we can view the results.

cat /home/labex/project/open_ports.txt

This filtered output makes it easier for us to focus on the open ports. Instead of looking at the entire detailed scan report, we can quickly see which ports are open and start assessing their security risks.

Security Implications

Understanding the security implications of your scan results is crucial. Here are some key points to keep in mind.

1. Unnecessary Open Ports: Any open port is a potential entry point for attackers. If a service is not needed, it should be disabled. For example, if you have a port open for a service that you no longer use, an attacker could use that port to gain access to your system.
2. Outdated Services: Older versions of services may have known vulnerabilities that attackers can exploit. It's important to keep your services up - to - date to avoid these risks.
3. Misconfigured Services: Even up - to - date services can be vulnerable if misconfigured. A small mistake in the configuration can expose your system to attacks.

In our lab environment, we intentionally opened port 8080 for the HTTP server. But in a real - world production environment, you would need to carefully evaluate whether this service is necessary and if it's properly secured.

Stopping the HTTP Server

Before we finish this step, let's clean up by stopping the HTTP server we started earlier. First, we need to find its process ID.

ps aux | grep "python3 -m http.server"

When you run this command, look for the line that shows our HTTP server process. The second column in the output contains the process ID (PID). Once you find the PID, you can use it to stop the server.

kill <PID>

Replace <PID> with the actual process ID from the previous command output.

Alternatively, you can use the following command to find and kill the process in one step.

pkill -f "python3 -m http.server"

After stopping the server, we need to verify that it's no longer running.

ss -tuln | grep 8080

If there's no output, it means the server has been successfully stopped.

Summary

In this lab, you have learned the fundamentals of network scanning using Nmap, a powerful and widely - used tool in the cybersecurity industry. First, you grasped the concept of ports and their functions in computer networking. Then, you set up a local HTTP server to practice scanning a real - world service.

You conducted various Nmap scans, from basic port scans to advanced service version detection. You learned to interpret scan results, understanding port states and their security implications. You also practiced filtering results for security assessments. These skills are crucial for network administrators and security professionals to identify open ports, detect vulnerabilities, make informed security decisions, and document network configurations. By mastering these techniques, you've taken a significant step towards proficiency in network security assessment and administration. Always obtain proper authorization before scanning systems in real - world scenarios, as unauthorized scanning may be illegal.