Nmap Target Selection Part 2
N map -H and I scroll up, you can see here all of the potential switches.
That are in Nmap and we get to the top here.
The first thing we're gonna talk about here is target specification.
So as you can see here, we've got host name, IP address networks, and it can be done in this form so we can see the domain here.
We can see a domain, and then we can see with the CIDR notation/24.
We can see a single IP address here and we can see ranges. So 1-254.
And if I go down to the bottom here, I can put a switch in here.
I can put the target either at the end, or I can put the target here at the beginning and I can do any of the notations that were previously there.
So I can put, for example, 24, which is the CIDR notation.
I can put One Two say 35, or I can just put in the domain like microsoft.com.
This -S capital S don't worry about that for now.
We're just talking about the target. I'm just putting that in there so that you can know that you can put the target in at the end, or you can put the target in at the beginning.
So if I run that scan, now it's going to scan with this particular flag, which is actually the SYN flag, which is the default anyway.
And it's going to, and all of those 35 hosts. And as you can see here, it's found one.
Two three hosts on 1.1, 1.8, and 1.35. And if we look at the details here, we can see started scanning and the N map version got the date.
It's calling this and found it as the name Router.
This is the IP address. Host is up.
It's scanned a thousand ports, as you can see.
And there are four that it has found to be open 22 53 80 and 1 7, 2 3.
And these are on the TCP port.
And based on this number from its database.
It believes that to be SSH, that isn't necessarily going to be the case, but in most instances, people do use the common ports for common services.
Later. We'll look into versioning to determine and bannering and looking at banners and other information through scripting to verify if the service is actually the correct service that is listed.
And then we can see the Mac address as well.
Now brought back the Nmap help again.
We can see we've gone through these here, the host names, the domain names, the IP addresses the networks.
Another way another useful way is to use a file as the input.
So as you can see here, it's -IL.
So we need to create a file.
So nano target files, and you can see here, I put in some targets here, just in exactly the same notation that you would, if it was within the command itself.
So then the command that we want is I capital L and then the target file.
So as you can see here and we'll run that and that'll take a little bit of time while that's running, we're gonna pop back to here and we can see the next one.
This can be quite useful.
This chooses random targets, and then you need a number after it, in order to determine how many random targets that it will choose so that it would be Nmap.
Let's put three in there.
That's gonna choose three random targets.
And then I'm gonna add another switch here, which is VRBO.
So the output will be VRBO, so there'll be more output than normal so we can see exactly what's going on here.
So one V is VRBO level one, two vs. Three vs. The VERBOs level goes up so we can see here scanning through house.
And those three hosts were down.
Let's try again.
And they were all so down and let's try 30.
And this time we may indeed find something and we can see here, we've got some open ports or 80 on this IP address. 1.9.35.
If I press a key while this is going through, it's gonna go through the percentage of completeness that it's going through.
So you can see it's 99%.
If I press V while it's going through.
And while it's active, it'll increase the velocity of the output.
So we can see here that it's found a host of Vodafone IP in Germany.
And we can see it's got, has CTP.
It's got RT MP up and because we've got VERBO output, it's given us the reason why it believes it's up and that's because it's sent a SYN and then it's got a SYN-ACK back in return.
I'll make note of that IP address for later.
And if we go back to the help here, we can see, we can exclude hosts as well.
So say we had a range and we wanted to miss out a couple of hosts and we can even have an exclude file as well.
So that's target specification.