Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

Paulino Calderon

• Publisher: Packt Publishing
• Year: 2017
• ISBN:
  9781786461537
• Edition: 2
• Topic: Computer Science
• Subtopic: Cyber Security
• Index: Computer Science

Over 100 practical recipes related to network and application security auditing using the powerful NmapAbout This Book• Learn through practical recipes how to use Nmap for a wide range of tasks for system administrators and penetration testers.• Learn the latest and most useful features of Nmap and the Nmap Scripting Engine.• Learn to audit the security of networks, web applications, databases, mail servers, Microsoft Windows servers/workstations and even ICS systems. • Learn to develop your own modules for the Nmap Scripting Engine.• Become familiar with Lua programming.• 100% practical tasks, relevant and explained step-by-step with exact commands and optional arguments descriptionWho This Book Is ForThe book is for anyone who wants to master Nmap and its scripting engine to perform real life security auditing checks for system administrators and penetration testers. This book is also recommended to anyone looking to learn about network security auditing. Finally, novice Nmap users will also learn a lot from this book as it covers several advanced internal aspects of Nmap and related tools.What You Will Learn• Learn about Nmap and related tools, such as Ncat, Ncrack, Ndiff, Zenmap and the Nmap Scripting Engine• Master basic and advanced techniques to perform port scanning and host discovery• Detect insecure configurations and vulnerabilities in web servers, databases, and mail servers• Learn how to detect insecure Microsoft Windows workstations and scan networks using the Active Directory technology• Learn how to safely identify and scan critical ICS/SCADA systems• Learn how to optimize the performance and behavior of your scans• Learn about advanced reporting• Learn the fundamentals of Lua programming• Become familiar with the development libraries shipped with the NSE• Write your own Nmap Scripting Engine scriptsIn DetailThis is the second edition of 'Nmap 6: Network Exploration and Security Auditing Cookbook'. A book aimed for anyone who wants to master Nmap and its scripting engine through practical tasks for system administrators and penetration testers. Besides introducing the most powerful features of Nmap and related tools, common security auditing tasks for local and remote networks, web applications, databases, mail servers, Microsoft Windows machines and even ICS SCADA systems are explained step by step with exact commands and argument explanations. The book starts with the basic usage of Nmap and related tools like Ncat, Ncrack, Ndiff and Zenmap. The Nmap Scripting Engine is thoroughly covered through security checks used commonly in real-life scenarios applied for different types of systems. New chapters for Microsoft Windows and ICS SCADA systems were added and every recipe was revised. This edition reflects the latest updates and hottest additions to the Nmap project to date. The book will also introduce you to Lua programming and NSE script development allowing you to extend further the power of Nmap.Style and approachThis book consists of practical recipes on network exploration and security auditing techniques, enabling you to get hands-on experience through real life scenarios.

Nmap Fundamentals

In this chapter, we will cover the following recipes:

• Building Nmap's source code
• Finding live hosts in your network
• Listing open ports on a target host
• Fingerprinting OS and services running on a target host
• Using NSE scripts against a target host
• Reading targets from a file
• Scanning an IP address ranges
• Scanning random targets on the Internet
• Collecting signatures of web servers
• Monitoring servers remotely with Nmap and Ndiff
• Crafting ICMP echo replies with Nping
• Managing multiple scanning profiles with Zenmap
• Running Lua scripts against a network connection with Ncat
• Discovering systems with weak passwords with Ncrack
• Launching Nmap scans remotely from a web browser using Rainmap Lite

Introduction

Network Mapper (Nmap) was originally released by Gordon Fyodor Lyon in the infamous Phrack magazine Vol 7 Issue 51 (https://nmap.org/p51-11.html). It is acclaimed today as one the best tools for network reconnaissance and security auditing in the information security industry. The first public version was introduced as an advanced port scanner along with a paper describing research on techniques for port discovery, but it has become so much more. It has evolved into an essential, fully featured tool that includes several other great subprojects, such as Ncrack, Ncat, Nping, Zenmap, and the Nmap Scripting Engine (all of them are available at https://nmap.org/). Nmap is described as follows in the official website:

"Nmap (Network Mapper) is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X."

Other tools in the project were created to meet the specific needs of users. Nping (https://nmap.org/nping/) specializes in network packet crafting. Ncrack (https://nmap.org/ncrack/) focuses on network authentication cracking. Ncat (https://nmap.org/ncat/) is an enhanced version of Netcat and allows users to read, write, redirect, and modify network data. Zenmap (https://nmap.org/zenmap/) is a cross-platform GUI focused on usability. Finally, the Nmap Scripting Engine (https://nmap.org/book/nse.html) takes scanned information obtained from targets and provides an interface for users to script additional tasks.

Nmap's community is very active, so I encourage you to always keep up with the releases and latest patches. Announcements and discussions take place on the development mailing list, so if you would like to contribute to the project, I recommend you subscribe to it.

This first chapter is for newcomers. Starting with building Nmap, we will become familiar with all the tools of the Nmap project. In just a few recipes, you will learn how flexible and powerful Nmap really is, but as we move through chapters, we will go deep into the internals to learn not only how to use the tools but to extend them and create your own. The practical tasks chosen for this chapter will help you fingerprint local and remote systems, map networks, craft custom network packets, and even identify systems with weak passwords.

Building Nmap's source code

Throughout the following recipes, we will use the tools included with the Nmap project, so it is a good idea to install the latest versions now. This recipe will show how to download the latest copy of the source code from the development repositories and install Nmap and related tools in your UNIX-based system.

We always prefer working with the very latest stable version of the repository because precompiled packages take time to prepare and we may miss a patch or a new NSE script. The following recipe will show the process of configuring, building, and maintaining an up-to-date copy of the Nmap project in your arsenal.

Getting ready

Before continuing, you need to have a working Internet connection and access to a subversion client. Unix-based platforms come with a command-line client named subversion (svn). To check whether it's already installed in your system, just open a terminal and type the following command:

 $ svn 

If the command was not found, install svn using your favorite package manager or build it from source code. The instructions to build svn from source code are out of the scope of this book, but they are widely documented online. Use your favorite search engine to find specific instructions for your system.

When building Nmap, we will also need additional libraries such as the development definitions from OpenSSL or the make command. In Debian based systems, try the following command to install the missing dependencies:

 #apt-get install libssl-dev autoconf make g++ 

Note that OpenSSL is optional, and Nmap can be built without it; however, Nmap will be crippled as it uses OpenSSL for functions related to multiprecision integers, hashing and encoding/decoding for service detection, and the Nmap Scripting Engine.

How to do it...

1. First, we need to grab a copy of the source code from the official repositories. To download the latest version of the development branch, we use the checkout (or co) command:

 $svn co --username guest https://svn.nmap.org/nmap 

2. Now you should see the list of downloaded files and the message Checked out revision <Revision number>. A new directory containing the source code is now available in your working directory. After ...

Table of contents

• Title Page
• Copyright
• Credits
• About the Author
• Acknowledgments
• About the Reviewer
• www.PacktPub.com
• Customer Feedback
• Preface
• Nmap Fundamentals
• Network Exploration
• Reconnaissance Tasks
• Scanning Web Servers
• Scanning Databases
• Scanning Mail Servers
• Scanning Windows Systems
• Scanning ICS SCADA Systems
• Optimizing Scans
• Generating Scan Reports
• Writing Your Own NSE Scripts
• HTTP, HTTP Pipelining, and Web Crawling Configuration Options
• Brute Force Password Auditing Options
• NSE Debugging
• Additional Output Options
• Introduction to Lua
• References and Additional Reading