Nmap Output

We're going to cover the Nmap output now.

And we can see most of the commands here in the Nmap, help let's pop onto this tab.

The first output and the most common output is the -O, N.

And then the file name of the file that you want to output.

So what this will do is let's just press return there.

We can see the output there.

That is the normal output.

And then if we have a look at that file that we've just created.

Normal dot file of it, do a nano of that.

And we can see thus the results that we just got sent to the screen.

That's -O for output, then N for normal.

We pop over onto the other tab.

We can see we've got X.

So this is for XML output, who he press return there.

We will see just a standard outport onto the screen.

If we nano XML.

We all see this output in XML format in the actual file itself, where that command there, the -O, X, and then the file name and another possible format we can use is the grepable format with the -O, G, and then a file name again.

As usual, these outputs of screen will be normal.

We nano grep, the grep file.

We can see there, we have got a file where each host is on one line.

So this escape out of that.

So if you do a cat of the grep farm and we grep for ports, we will see just the line with ports, or if we want to grep for 80.

I'll just say just the line with 80.

Now, if we had multiple house here, this would make more sense.

So for example, this is showing is that this is 192.168.1.35 and say we had many, many hosts here.

That grep of 80 would only show us the IP address of those that were returning 80.

The former, just for fun is the script kiddie format.

So if we run that within -O, S we'll see the output is normal than if we know that grep kiddie file, we can see the tax has been changed to the hacker style text, which has very little practical, real use.

Let's delete those files, all gone.

And if we look here, the next one is -O, A and then I've got results.

What results dot file.

But in this instance, I won't because of how it's going to output what this does is it creates a file in the three major formats at once.

So let's do that. If we just clear that LS - LA and there we go, we can see results in grepable, normal and XML.

So let's think about some of the other things that we can do.

Let's scan the local network for just a particular type of web server.

In this case, we're going to look for port 80.

So we're going to look for web servers.

We're looking for versions.

We've got output grepable and we've got a dash there.

That means it's not going to create a file, but it is going to output to screen in a grepable format.

Rolling. Open ports or only the open port 80, we're doing the local subnet and then we're grepping for open.

So this essentially is going to show us all of the port 80, all the web servers on the local network.

So give that a run.

Now take a little bit of time. Not too long.

And there we go.

We can see 1.1 and 1.35 about running web servers.

And if I do an LS minus LA, you can see it's not created another grepable file.

These are the ones that I previously just created with the -O A and that's because we had the dash there instead.

So if I went back here, just have it like this, and then.

Run this command without the grep, we can see the grepable format output to screen, as you can see there.

But what we were doing is we were grepping for the open ports instead of seeing the close one.

Here's a tip for how you can generate a list of IPS of live hosts.

So say you just wanting to create a list, a collection of the IPS that alive here, I'm searching on the local network.

As an example, I'm not doing a reverse DNS lookup during the output to XML I'm grepping Nmap, and I'm doing some cutting.

And then I'm sending that to the live dash host dot TXT file press return.

So when that's finished, that will create this live dash host dot TXT file.

So let's do an LS - LA. There we go.

There, we can see the file.

If we do a cat of that.

We'll see the host they're listed of what is live as a list of IP addresses.

So that can be useful.

That's a useful little command there for the list of IP addresses.

You can of course amend to that by just having the greater than, greater than which will append to that file.

So here's just another example. Cat file again.

And you can see it adds, this and this in, but we get that there.

So if we do large scans, we can just delete these out and you get a list of the IP.

That's a pretty useful tool that I've used a few times.

You can also append to a regular scans results with the dash dash append dash output command.

So if I just run this command here first.

Let's do a cat of the file.

We can see just that one there.

Then that said - - append, and we'll be appending it to this file and then let's change it. So it's a different IP.

So we'll have two that are then in this file dot file.

So we get the outpour and let's a nano the file.

We can see the first results at the top for, 1.1, and the second results at the bottom for, 1.35, which is where that - my append, minus output, some other output options you've got here.

You've got the style sheet that you can change.

So you can add X, L R style sheets, transform XML output to HTML, as it says, You've got web XML.

You can reference style sheets from Nmap.org for more portable XML.

And you've got this no style sheet prevent associating of XSL star sheets with XML outport.

So that's pretty much all of the output options.

And I've shown you a couple of other little tricks there with court and for appending results.