Nmap Extras
In this lecture, we'll explore a few extras that might be useful for you when you're using Nmap.
So one of the useful things you can do is compare scans.
So we can compare scans with the N diff command and you put in the two files that you want to compare.
So we've got out and out to here, XML.
And will show us the differences.
We've got the minuses here.
You can see in the pluses and minuses, what has been removed and the pluses, what has been added.
So we can see these have been removed.
And this has been added based on the order by which you're comparing, comparing this one to this one.
So that's endif.
You can also convert Nmap XML files, the HTML files.
This can be useful for reporting.
So let's convert out .XML.
Then we've got the -O to outstart HTML.
Pop over to our browser here and there we go.
We can see quite a nice reasonably pretty report there in HTML, which as I said, can be useful for reports.
And of course you can do that with a full report.
This is just a very, very tiny report we can do within a big report and it'll convert it over to a HTML.
Another little trick.
I'd like to show you using a bash script, maybe want to scan a large number of servers and want a reverse sorted list of how often ports turn up on those servers.
So this may be useful when scanning an organization's network because the ports and services that are rare.
Don't turn up that often can be less well-maintained because they're not part of a standard bills.
You want me to do a scan there's loads of web servers that can generally be the same, but then if you find the odd few ports like port 1, 1, 4, or something, I like, well, what is that?
That's a non-standard thing on a network.
So those can be useful when looking for vulnerabilities.
And I've got a previous scan here that I've done of, I think, a thousand hosts or something that I am results.
Nmap and with some grepping some settings, some sorting, some unique thing, some sorting again and less, press return on that one.
And we can see here, the top of the results are web servers.
Followed by https servers.
And then down at the bottom, we've got this 10 80, you've got this 1720.
Now, if you searching more and more machines on quite a large network, then this can pop up some interesting results.
Particularly at the bottom worth.
Knowing there are online web based Nmap that you can use for a quick scan.
So you can see one example here, which will scan the common 100.
And you can see here, we've got version detection, detecting OS trace route and not doing the discovery.
So let's try something.
Shall we? What should we, what should we scan?
And let's do version detection, OS detection, but have a trace route.
And we might as well not do discovery because we know it's up there.
Let's give that a go.
And here we go.
Who've got the results out.
Not surprisingly, we've got port 80 and 443 open, and it's not being able to do much with the version detection there and OS detection scan down to the bottom.
And then we've got the trace route. And here we go.
There's another one, another online tool.
Now you should try running a scan against your own IP and see what sort of ports you've opened on your router.
That can be quite interesting.
You may have ports open that you didn't realize.
You definitely need to make sure that those are closed or at least secured.
So there's a few that lectures I wanted to show you.