Zenmap Built in Profiles

There are built-in commands called profiles, which we'll go through.

Now, you can use these, let's just click on there.

That's where they are.

You can use these as shortcuts instead of typing commands.

So if I click on that, you can see it appears here.

And if I click on this one, which is a default, when you open it, the intense scan.

You can see the command appears here.

So this is the one we ran for the demo on the last lecture.

So just to remind you the -T or T as the aggressive mode for it speeds up the scan.

So you're making the assumption here that you want a reasonably fast unreliable network when you're using this one and the -A again, enables OS detection, version detection, script scanning, and trace route.

And the boat level one.

So that's the intense scan.

And if you notice here, we've got intense scan, intense scan, intense scan, intense scans.

So these add or remove something to the intense scan.

So this original command.

So we've got the original command here. Yeah.

Plus we're adding UDP.

So if we look here, we can see we've got -S S, which is the SYN scan.

So it's telling it to do the default SYN scan, and then we've got the -S U, which is the UDP scan.

So it's intense scan plus UDP.

Then we've got the intense scan with all TCP ports re click on that.

We can see here is added the -P and then we're adding the 65,535 ports by adding the one dash.

And then the number of the maximum port that we want to use.

And then the last intense scan or edit of the original default intense scan is a no ping.

So we can see here, we've got the original options here, and then we've got the -P N.

This means all IPS will be scanned and there will be no test to see if the targets are all up using the intense scan.

So as you can see there, we've gone through all the intense.

And now onto the ping scan, ping is simply - S - N this does discovery to see if servers or targets or active and up are alive effectively, but does not check port.

So it doesn't do port scanning.

It does discovery only it's called the ping scan, or you could consider it discovery scan.

I tend to prefer the word discovery over ping because ping is a specific type of network activity in TCP.

Whereas discovery is more general.

And we've done ping scan, sit on onto quick scan and we can see here our usual minus capital T4 aggressive mode for speed up the scan and - F.

That is to do the top 100 ports as opposed to the top and thousand ports, which will be default.

If we go here, we've got quick scan plus.

So it's going to be this plus an additional.

So we've got the - S V, which is looking for version detection.

Got the aggressive mode for speed.

Again is adding OS detection.

We've got the - F again for the 100 ports, and then we've got this minus minus a light version or other minus minus version light.

This changes how aggressive.

The version detection is with version light, less probes are sent, so it's quicker for the version detection.

And we've also got quick trace route.

And that effectively, just as a trace route, the -S N is the note port scan option.

So just a trace route was performed here.

And then we've got regular scan.

This is the default or click on there so we can see that there's no options.

So this is the default, which is the top 1000 TCP ports.

And we run Zen map as a privileged user.

So in Linux, that would be the route in windows that would be.

This command will launch the, SYN style scan for on privileged accounts that can't create raw packets, the TCP connects scan is used.

And with this default command, no discovery options have been given.

So remember, Zen map sends an ICM P echo request ping. A TCP syn packet, a port 4 43, a TCP ACK packet to port 80 and I C M P timestamp request.

If no discovery options are given like here, the exception to this or the ARP for IPV four and the neighborhood discovery for IPV six scale.

Which are used for any targets on a local ethernet network.

So, so if your targets are on the local ether net, it will do that ARP or neighborhood discovery as well.

So that is the default, as we've already gone through in Nmap, it is not any different.

I'm just reminding you again, as repetition helps you to remember.

And then onto the final profile, which is the slow, comprehensive scan.

And look at that, we've got quite a meaty command there.

So what is this doing? So we can see here, we've got our SYN scan.

We've got a UDP scan.

We're speeding it up to four.

Now note, although it says.

We look here, slow, comprehensive scan in the profile name.

It doesn't mean that this is a stealth scan, a slow scan that it's going to scan slowly.

That will be T 0 or T 1.

This is actually T4, which is to attempt to speed it up. -A to OS detection version detection, scripts, cunning tracer vebose level one - P E is the ICMP echo for discovery.

We've also got - P P, which is the ICMP timestamp for discovery.

We've got P S or capital P S, which is the syn ack host discovery.

And they've specified here port 80 and port 4 43, the common web ports. We've also got - P A, which is ACK host discovery on 3, 3, 8, 9.

Got - P U, which is UDP host discovery on 4 0 1 2 5.

We've got - P - Y, which is S C T P discovery and - G on 53.

So that's changing the source port to 53 to look like DNS.

And then we're invoking the scripts here.

So we're adding scripting from possibly default discovery and safe.

So those are the built in profiles.

There they are there.

You can edit these and create your own profiles, which we're going to cover next.