Nmap Service and Version Detection

Here we are in Nmap.

Help again, on this lecture, we're going to talk about the service and version detection features and the main way of enabling that is with -S. V if we pop over here a second, we can see the output of such a scan Nmap is attempting to determine the version of the service that is running on the port.

So for example, we can see here that it is successfully on port 22 discovered open SSH, which is 6.6.1. P one.

And we've got some ubuntu information here as well.

And it's telling us the protocol number and also successfully on port 80 is discovered apache, the http D server on 2.4.7.

So as a hacker or even a systems administrator, you really want to know.

Which versions of services or running, having an accurate version number helps dramatically in determining which acts boys or service is vulnerable to version is what helps to obtain this information.

After TCP and or UDP ports are discovered using a scan method.

Version detection interrogate those ports to determine more about what is actually running.

If I pop over to this tab here, we can see this link here.

The Nmap services, probes database contains pros for querying various services and match expressions to recognize and pause responses.

So if we have a look in here, we will basically see pattern.

That can be matched in order to help up version detection.

Let's pop over to this tab here and we'll see the most basic of version command, which is the -S V.

And we're doing that against the 192.168.1.43 IP address.

Emma, try to determine the service protocol easy.

If it's got things like FTP, SSH, Telnet, HTTP, the application name, like Apache httpd drop Baer SSHD version number, host, name, service device name like is it a printer or router?

Dos family, EEG, windows, Linux, when possible.

Nmap also attempts to get.

Common platform and numeration, which is the CPE.

And we can see that here, CPE tries to get the representation of this information, which is an open standard for naming hardware and software components.

And as we can see. What we've discovered is some sort of Samsung we can see from the Mac that it is from Samsung.

We're getting Samsung back from Nmap, and we can also see that we're getting version information.

That's telling us that it's Samsung.

So this is likely to be a television, of course, many servers.

Don't provide all this information.

Some UDP peoples are left in the open filtered state.

After UDP whore scan is unable to determine whether the port is open or filtered version detection will try to elicit a response from these ports just as it does with open ports and change the state to open.

If it succeeds, open filtered, TCP ports are treated the same way to.

When RPC services are discovered 1, 3, 9, that sort of thing.

The Nmap RPC grinder is automatically used to determine the RPC program and version numbers.

It tries all the TCP and UDP ports detected as RPC and floods them with sun RPC program.

No commands in an attempt to determine whether they. RPC ports.

And if so, what program and version number they serve up.

So that's going to happen on generally your windows machines. And of course also the Unix and Linux machines that are running RPC.

Here, we are looking at the results of another scam.

Now, if you see here, I scroll down just a little bit.

And then scroll back up when Nmap receives enough responses from a server, but cannot match the versions against the database.

It prints out a special fingerprint, as you can see here and their URL for you to submit it.

If you know, for sure what it is that.

This is how the Nmap database gets built up.

Often. You won't see a fingerprint because often machines don't provide enough information to give that fingerprint.

It has to have sufficient open and sometimes closed ports pop onto this tab here.

Another option we've got is dash dash all ports, which means don't exclude any ports from version detection by default Nmap version detection skips TCP port 9,100, because some printers print, anything sent to that port.

So this option, no ports or exclusive. Pop over here.

We can see that minus minus version minus intensity, then the intensity level, and then about it have a verbose.

They don't need the verbose.

So let's remove that the intensity level specifies which probe should be applied, the higher, the number, the more likely it is, or the service will be correctly identified.

However, high intensity scans take longer.

The intensity must be between zero. And nine and the default is seven.

So we can see here. One would be a light scan.

Seven would be the default and a nine would be the maximum.

Another way of doing this as with the dash dash version dash light.

This is a convenience alias to enable a light version of the scanner.

We pop here. We've also got the minus minus version minus all.

So that's try every single probe.

That's another convenience, alias and that's for intensity level nine, showing that every single pro was attempted against each port.

And then finally we have minus, minus version minus trace.

And this caused Nmap to print out the bugging information.

So it's trace version, scan activity, and generally you won't need to use that unless you've added something yourself for versioning, an example out of that, you can see here.

So there you are, that is Nmap versioning more information than just the version information can be deemed through Nmap.

And we are going to go through that in terms of things like using OS detection and also scripting and the scripting language, which we're going to cover as we go through.

And we're going to cover shortly that's Nmap and versioning.