Nmap Basics Part 1
Okay, we're now going to go through using Nmap to gather information on a target by running port scanning and fingerprinting.
It's a very important tool and useful tool that almost every hacker will be using, whether they are black, white, or gray hats.
Nmap is the most used port scanner on the internet and justifiably.
So because it is extremely powerful and it's just good.
Essentially here, you can see the output of the Nmap minus H switch, which is the help.
And if we click over here onto this tab here, we can see the most basic and simple command or Nmap essentially it is Nmap and then it is the target.
So I'm just gonna run this now.
And as you can see, that was very, very quick, 1.45 seconds.
Now this simple default scan is actually scanning 1000 TCP ports on the target.
And the default scan is actually relatively comprehensive as it is.
What are those 1000 top ports?
Well, if we do a little search here into this direction, which you can see here, I do some sorting and grappling in head.
We can actually then look at what the top ports are.
And if you scan through, you may see some protocols that you're familiar with HTTP here on 8 008. SQL X 11, essentially.
It is all of the ports that you would expect to be in a list of the most common, the most popular 1000 ports.
But if you are unsure or wondering what it is that it is going to be scanning in the default, then of course you can just run this command here and you will be able to see the, what those ports are, but essentially, unless you specify ports, it will always be using those 1000, those top 1000 ports.
If we run this as a privileged user, we're running it here as root and we're in Kali.
So on windows that would be admin.
This launches what's known as a SYN Stealth scan.
Now, if we run as an unprivileged account, so non root that can't create raw packets, the TCP connect scan is used.
So with Root it's a SYN scan without root, it's a full connect scan.
Now if you're not quite sure what I'm talking about here, then it means you need to know a little bit more about TCP.
I P so you need to read up a little bit about it.
So find out about the TCP I P three way handshake, which is essentially a SYN. SYN ACK and ACK when the user has root privileges, the scanner is able to send just a SYN and then SYN ACK that comes back is enough to know that there is an actual open port there, but when you do not have privileges, you cannot send raw TCP SYN packets.
You have to call the operating them and do a full connect.
And essentially it just takes longer.
So if you can, you want to be running as a privileged user.
And just to make that clear, the difference between the two is that the TCP connect scan uses the high level system core connect to obtain information about the port state.
This means that each TCP connection is fully completed and therefore it is slower.
And more likely to be detected and recorded in system logs.
The SYN Stealth scan, as it is known, which is the default for privileged accounts uses raw packets to send specifically crafted TCP packets that detect port states more reliable.