[Day 11] 2. More about nmap

Nmap (Network Mapper) is a versatile tool for network discovery and security auditing. It offers various scanning techniques to identify open ports and services on target systems. Here's an organized overview of common Nmap scan types:

1. SYN Scan (-sS):

• Description: Also known as a "half-open" scan, it sends a SYN packet to the target port and waits for a response. If a SYN-ACK is received, the port is considered open; an RST indicates it's closed. The connection is not fully established, enhancing stealth.
• Usage:
  Copy

  nmap -sS <target IP>

• Privileges: Requires root privileges to send raw packets.
• Advantages: Fast and stealthy; works against any compliant TCP stack.
• Note: By default, Nmap performs a SYN scan when run with root privileges.

2. TCP Connect Scan (-sT):

• Description: Completes the TCP three-way handshake with the target port. If the handshake succeeds, the port is open; if it fails, the port is closed.
• Usage:
  Copy

  nmap -sT <target IP>

• Privileges: Does not require root privileges.
• Advantages: Useful when raw packet privileges are unavailable.
• Note: Nmap defaults to a TCP Connect scan when run without root privileges.

3. FIN Scan (-sF):

• Description: Sends a packet with the FIN flag set. Open ports typically ignore the packet, while closed ports respond with an RST.
• Usage:
  Copy

  nmap -sF <target IP>

• Advantages: Can bypass certain firewalls and packet filters that block SYN packets.
• Limitations: Ineffective against some systems (e.g., Windows) that don't adhere strictly to RFC 793.

4. XMAS Scan (-sX):

• Description: Sends a packet with the FIN, PSH, and URG flags set, "lighting up" the packet like a Christmas tree. Open ports typically ignore it; closed ports respond with an RST.
• Usage:
  Copy

  nmap -sX <target IP>

• Advantages: Similar to FIN scan in bypassing certain filters.
• Limitations: Ineffective against non-RFC-compliant systems.

5. NULL Scan (-sN):

• Description: Sends a packet with no flags set. Open ports usually ignore it; closed ports respond with an RST.
• Usage:
  Copy

  nmap -sN <target IP>

• Advantages: Can bypass some firewalls and filters.
• Limitations: Ineffective against non-RFC-compliant systems.

6. Idle Scan (-sI):

• Description: A stealth scan that uses a third-party "zombie" host to send packets to the target, masking the attacker's IP address.
• Usage:
  Copy

  nmap -sI <zombie IP> <target IP>

• Advantages: Extremely stealthy; the target sees the scan as coming from the zombie host.
• Limitations: Requires a suitable idle zombie host; more complex to execute.

Additional Notes:

• Port Scanning Behavior:
  • Open ports respond with a SYN-ACK packet.
  • Closed ports respond with an RST packet.
• Half-Open vs. Full-Open Scans:
  • Half-Open (SYN) Scan: Involves only SYN and SYN-ACK packets; does not complete the TCP handshake. Requires root privileges.
  • Full-Open (TCP Connect) Scan: Completes the full TCP handshake (SYN, SYN-ACK, ACK). Does not require root privileges.
• Traceroute Functionality: Nmap can perform traceroute to map the path packets take to the target.