Nmap Discovery - Part 2
So here we are back to help and let's look out at the first one here.
We've got the list scan.
So what does that mean?
Well, this is no scan at all we'll be doing so by default, with this Nmap still does a reverse DNS resolution on the host to learn their names.
And you still can't find interesting information just from their names.
So this is the least invasive type of scan.
So, if we pop over to here, we can see here, I've got an Nmap scan of the slash 24 facebook.com with an S L, which is the list scan.
So this is going to do a reverse DNS lookup on those IP addresses and tell us those DNS names. And if we scan up here, There we go.
We can see the DNS names of the servers and you can sometimes find interesting bits of information.
Like it's a VPN server or it's a dev server, you know, those sorts of things.
So you can see these, all the DNS names, interestingly of Facebook.
Now, if you want to be a little bit more adventurous, then we can do a random set of targets for 300 targets.
We'll do the list scan and we'll do double the booths.
And this should be fairly quick because of, of course it is just a DNS lookup or either a reverse DNS lookup.
That's what? 14 seconds for 300 hosts.
So here we go.
We can see. A whole bunch of DNS names, various random IP addresses wants that more intrusive is the ping scan or the no port scan.
This option tells Nmap not to do a port scan after the discovery stage and only print out the available hosts that are responded to the host discovery probes.
This is an often known as a ping scan, as you can see it written here.
Now, if we go here, this is the minus S N ping scan option.
So if I run this now, That's disabled, a port scan, but it has done the discovery and the default host discovery Done with minus S N consists of the, as I mentioned before, the ICNP echo request, the TCP SYN to port 4, 4, 3, the TCP ACK to port 80 and ICMP timestamp request as default.
And as you can see, that is very quick over the local network and it has returned all of the active hosts on the local network, but has not done a port.
Moving back here to Nmap help. Let's scroll down a little bit here.
We're now on onto minus capital P N treat.
All hosts is online. Skip host discovery.
This option, as it suggests, skips the Nmap discovery stage all together.
Disabling host discovery with the let's hop over to here would the minus capital P N causes Nmap to attempt the requested scanning function.
Against Every target IP address. So all of these without checking first, if the host is active.
So essentially this means skip the discovery stage, but still do a scan and it will do the default scan, the SYN scan, the 1000 top host, etc.
And there we go. Oh, and of course I added the mines V so he could see a little bit more of the output here.
We've got the ARP scan because we're on the local network, DNS resolution.
We can see here host 2, 3, 4, 5 down.
First one is up. So it's gone then into the scanning stage of SYN scan stage at 1000 top ports.
And it's found those four ports there in less than a second.