-: In this demonstration you're going to see how Nmap
is used to conduct a network scan.
Now for the Security+ exam you don't need to know
how to run Nmap or all of the commands that I'm going to
use inside this demonstration.
You just need to be aware that Nmap is a tool
that can be used to determine what hosts
are on your network, so in that respect it's a network
mapping tool but it also can be used
to determine what services are running
on what open ports and what versions
of those services are being run.
Now in that respect, Nmap can be used
as a vulnerability scanner as well.
So let's move into the lab environment
and watch as I show you a little of what Nmap can do
for you as a security analysis, a vulnerability assessor,
or even a pen tester in the future.
So now that we are in the command line environment,
what are we going to do?
Well we first are going to want to find out which things
on the 10.10.10.0 network are up and which ones are down,
so we want to use ping scan.
Nmap dash SN and then the IP address.
So for us that's 10.10.10.0/24.
It's going to go through and scan all 254 possible IPs
and find which ones are up and which ones are down.
Now it came back with four hosts.
What are those four hosts?
Well the .1 is the router itself.
It's the internal interface of the router.
There is the .10 which is one of our servers,
the .11 and the .12 which is the other two servers.
All we have at this point is knowing that those
three servers are up and responding to ping.
We have no other information.
So we're going to want to take it a step further.
Let's go ahead and do a SYN scan, Nmap dash SS
and then the IP address that we want to look at.
But I'm going to combine that with port 80,
so I want to figure out what web servers
are being run out of this network.
And then we're going to use the 10.10.10.0/24.
Now as I scan away, it's going to check all of the 254 IPs
again and in this case we found there are
four web servers responding.
There's port 80 responding up as closed on the router.
It is open on the LAMP server, the .10,
it is open on the .11 which is Metasploitable 2,
and it is ope on .12 which is the Damn Vulnerable Web App.
So all three of my servers are running at least port 80.
Now let's dig in deeper on one of those servers
as we go further in our information gathering.
Let's go ahead and do a SYN scan
against the LAMP server, which is the .10.
So, we're going to do Nmap dash SS and then 10.10.10.10
and we'll go ahead and search that
and you can see now that there are more than just
the web server running, right?
There are three services running on this server.
There's an SSH server on port 22,
there's the web server on port 80,
and the web proxy on port 8080.
Now that we found those, what about the versions?
What if I wanted to figure out what version of web server
it was running on port 80?
Well how would we do that?
Well, we're going to us Nmap dash SV and then the 10.10.10.10
and now if we run it you're going to see a little bit
of a difference here, it's a little bit longer
to run this, but instead of half a second,
it's taking almost seven seconds.
The difference here is that I get the versioning
associated with each of those services.
So the same three services are up,
but I found out that it's running some form of Linux
and it's running Apache 2.4.18, which tells me
that I could start associating vulnerabilities
associated with that and attack this machine.
Now it tells me Ubuntu Linux,
but it doesn't tell me what version.
What if I wanted to go deeper
and figure out the version of this operating system?
How would I do that?
Well it's not SV because that's the version
for the service, instead it's dash O
because it's for the operating system.
So it's Nmap dash O and then 10.10.10.10.
And then we'll go ahead and hit enter
and away it goes and it comes back in less than two seconds
and tells me that it is Linux somewhere
between version 3.2 and 4.6.
So let's go ahead and take it a step further.
Let's combine some commands.
Let's go ahead and do an Nmap scan for dash SS,
we're also going to do dash SV for the versioning,
and we're going to go ahead and add the dash O
to get the operating system.
I'm going to do that against 10.10.10.10 through 10.10.10.12,
those three machines, and see what comes back.
Now you may have noticed that it keeps saying
it's unable to determine any DNS servers.
That's an error because I don't have this lab environment
connected to the internet so there's no DNS being resolved.
It's not an issue because we're using IP addresses,
but if I tried to do something like scanning Google.com
right now it wouldn't be able to give me
that answer back because it doesn't know
what the IP address is for Google.
Now this scan is going to take a little bit longer
so I'm going to fast forward to when
the scan comes back with the results.
Now the results have come back,
it took 140 seconds, so it took almost three minutes.
So this has come back with a ton of information,
so much so that it actually scrolled off my screen.
So we're going to scroll back up to where I put in the command.
So there we go, there's the command we put in,
Nmap dash SS, a SYN scan, dash SV,
versioning for the services,
dash capital O for operating system versioning,
and then 10.10.10.10 through 10.10.10.12.
Now the first one it comes back with is the results
for 10.10.10., which shows that there are 997 closed ports
'cause by default Nmap is going to scan the
top 1,000 commonly opened ports.
You'll notice here there was those same three ports
that we found earlier, port 22, port 80 and port 8080
and you'll notice it tells us what version of SSH
and what version of Apache is being run
and again the versioning of Linux is somewhere between
3.2 and 4.6, not very accurate.
Now if we look at the bottom of the screen,
I'm going to scroll it up to the top here,
this is the scan report for 10.10.10.11.
Notice this one has a ton of open stuff,
it only has 979 closed ports,
which means that there are 21 open ports
and you'll see them all shown on the screen there.
Things like FTP and SSH and Telnet and http
and RPC bind and port 139 and 445 for netbios,
as I said which is Samba for Windows file sharing
between a Linux machine and a Windows machine.
All of these different things
with all of these different versions.
Now this is a great machine that we can target,
because we have a lot of vulnerable apps on it,
things like Apache 2.2.8.
There's exploits that exist for that.
There's VS FTPD 2.3.4 for the FTP service.
That's a vulnerable version we can attack.
There's Pro FTPD 1.3.1.
There's MySQL, version 5.0.51, right?
Lots of different pieces of information
that we can use to then later exploit it.
Now it does say that one service was unrecognized
even though it gave back data
and they weren't really sure what it was
because there wasn't a valid fingerprint
and you could submit it to Nmap
for them to try to figure it out better.
If you know what the service is you could tell it
and then they can add that to the next version of Nmap.
Then as we scroll down a little bit further,
we'll go through that signature that they gave us
and you can see that the version of Linux here
was again version 3.2 to version 4.6.
And so that again wasn't real helpful
and the reason why we're getting that wide range
of operating systems is because this is all actually
being run in a docker environment, so they're all sharing
the same operating system.
This is a container based virtualization
that we've talked about perviously.
Now as I scroll on down, we're going to see the results
for 10.10.10.12 and this one only has one port that's open
and it's running Apache version 2.4.10.
So again, we can go and look for something
that would be able to be exploited
and go after that server using that.
So as you can see, Nmap has a ton of capabilities here.
I only just scratched the surface of what Nmap
can really do but this is already much more
than what you need to know for the Security+ exam.
If you're interested in learning more about Nmap,
you definitely will want to move up to the PenTest+
or CySA+ certifications in the future.
Or you could take an entire course on Nmap itself,
because honestly, there is so much more to learn
about using this particular network mapping
and vulnerability scanning tool.
(upbeat music)