Nmap Discovery - Part 1
So here we are looking at Nmap help again.
And we going to look at the host discovery options, which you can see.
Here discovering active target hosts and services is called discovery from the early information gathering stages.
The black hat will have domains, sub domains and IP addresses from the target, which he wants to discover if they are active hosts and whether they have running services.
So these IP addresses these domains.
These often need to be reduced from sometimes huge sets of IP addresses into a list of active and interesting hosts.
Scanning every port on every single IP address is slow and usually are necessary.
The black hat is looking for active host.
With open ports that can be exploited to compromise the target.
So obviously the first step is the host is being up.
And then the second step is the host is running services.
So this discovery stage is working out whether the host is in fact up and running and is an active host.
And that is the stage we're in.
Now, the discovery stage.
So the discovery probes of Nmap are designed to solicit responses, which demonstrate that an IP address is actually active.
So, if we go over here, we can see Nmap 192.168.1.1-5 so that will scan 1 to 5.
If no host discovery options are given.
So you can see we've got no host discovery options.
These are those discovery options S and also mainly capital P.
If no host discovery options are given Nmap sends an ICMP echo request ping the TCP SYN packet to port 4, 4, 3 a TCP ACK packet to port 80 and an ICMP timestamp request.
If no host discovery options are given the exceptions to this or the ARP for IPv4 and neighborhood discovery for IPv6 scans, which are used for any target on a local ethernet network.
So here this 192.168.1.1 is a local ethernet scan.
So if I do a dash V we'll be able to see the output.
So, if we look here, we can see initiated the ARP scan that's because it was on a local and network.
And then before it does any port scanning, it does the discovery and the discovery is done via those mechanisms that I mentioned, ICMP echo request is sent out.
A SYN packet is sent to port 4, 4, 3 a TCP ACK packet to port 80 and an ICMP timestamp request is sent.
Then, if there is a response back based on those discovery probes, then it will go into a port scan.
And if we look here, here, rather than we can see the scan will be based on these options here now, because.
We have selected nothing in terms of the scan type. It does the default scan, which as we mentioned before, is a SYN scan.
And this is of the top 1000 hosts.
So we did the discovery, we were on the land.
So we did the op ping scan.
We did there's other probes as well, the ICNP SYN pack packet to 4, 4, 3. And then after those.
We then did the port scan itself, which returned those.
So, as I said here, because one of the local network, we've got the ACK scan, but let's try this same thing, but Lets do with something that's not on the local network.
So just a random domain there with a minus V and then we can see here at the beginning, we've got no ACK that's in there.
We can see that we've got a DNS resolution, obviously it's found something.
It will have found something on 80 and 4 4 3.
So there would have been a response there and we can see these opens and we can see these closed ports here, but close still tells us that this is an active host.
Even if all of these were not here.