Book Image

Nmap 6: Network Exploration and Security Auditing Cookbook

Book Image

Nmap 6: Network Exploration and Security Auditing Cookbook

Overview of this book

Nmap is a well known security tool used by penetration testers and system administrators. The Nmap Scripting Engine (NSE) has added the possibility to perform additional tasks using the collected host information. Tasks like advanced fingerprinting and service discovery, information gathering, and detection of security vulnerabilities."Nmap 6: Network exploration and security auditing cookbook" will help you master Nmap and its scripting engine. You will learn how to use this tool to do a wide variety of practical tasks for pentesting and network monitoring. Finally, after harvesting the power of NSE, you will also learn how to write your own NSE scripts."Nmap 6: Network exploration and security auditing cookbook" is a book full of practical knowledge for every security consultant, administrator or enthusiast looking to master Nmap. The book overviews the most important port scanning and host discovery techniques supported by Nmap. You will learn how to detect mis-configurations in web, mail and database servers and also how to implement your own monitoring system. The book also covers tasks for reporting, scanning numerous hosts, vulnerability detection and exploitation, and its strongest aspect; information gathering.
Table of Contents (18 chapters)
Nmap 6: Network Exploration and Security Auditing Cookbook
Credits
About the Author
Acknowledgement
About the Reviewers
www.PacktPub.com
Preface
References
Index

Managing multiple scanning profiles with Zenmap


Scanning profiles are a combination of Nmap arguments that can be used to save time and the need to remember argument names when launching an Nmap scan.

This recipe is about adding, editing, and deleting a scanning profile in Zenmap.

How to do it...

Let's add a new profile for scanning web servers:

  1. Launch Zenmap.

  2. Click on Profile on the main toolbar.

  3. Click on New Profile or Command (Ctrl + P). The Profile Editor will be launched.

  4. Enter a profile name and a description on the Profile tab.

  5. Enable Version detection and disable reverse DNS resolution on the Scan tab.

  6. Enable the following scripts on the Scripting tab:

    • hostmap

    • http-default-accounts

    • http-enum

    • http-favicon

    • http-headers

    • http-methods

    • http-trace

    • http-php-version

    • http-robots.txt

    • http-title

  7. Next, go to the Target tab and click on Ports to scan and enter 80, 443.

  8. Save your changes by clicking on Save Changes.

How it works...

After using the editor to create our profile, we are left with the following Nmap command:

$ nmap -sV -p 80,443 -T4 -n --script http-default-accounts,http-methods,http-php-version,http-robots.txt,http-title,http-trace,http-userdir-enum <target>

Using the Profile wizard, we have enabled service scanning (-sV), set the scanning ports to 80 and 443, set the Timing template to 4, and selected a bunch of HTTP-related scripts to gather as much information as possible from this web server. And we now have this profile saved for some quick scanning without having to type all these flags and options again.

There's more...

Zenmap includes 10 predefined scan profiles to help newcomers familiarize themselves with Nmap. I recommend that you to analyze them in order to understand the additional scanning techniques that are available to Nmap, along with some of the more useful combinations of its options.

  • Intense scan: nmap -T4 -A -v

  • Intense scan plus UDP: nmap -sS -sU -T4 -A -v

  • Intense scan, all TCP ports: nmap -p 1-65535 -T4 -A -v

  • Intense scan, no ping: nmap -T4 -A -v -Pn

  • Ping scan: nmap -sn

  • Quick scan: nmap -T4 -F

  • Quick scan plus: nmap -sV -T4 -O -F –version-light

  • Quick traceroute: nmap -sn –traceroute

  • Regular scan: nmap

  • Slow comprehensive scan: nmap -sS -sU -T4 -A -v -PE -PP -PS80,443 -PA3389 -PU40125 -PY -g 53 --script default or discovery and safe

Editing and deleting a scan profile

To edit or delete a scan profile, you need to select the entry you wish to modify from the Profile drop-down menu. Click on Profile on the main toolbar and select Edit Selected Profile (Ctrl + E).

The editor will be launched allowing you to edit or delete the selected profile.

See also

  • The Listing open ports on a remote host recipe

  • The Fingerprinting server of a remote host recipe

  • The Finding live hosts in your network recipe

  • The Scanning using specific port ranges recipe

  • The Running NSE scripts recipe

  • The Scanning IPv6 addresses recipe in Chapter 2, Network Exploration

  • The Gathering network information with broadcast scripts recipe in Chapter 2, Network Exploration

  • The Discovering UDP services recipe in Chapter 3, Gathering Additional Host Information