Pentest Notes / Enumeration
Nmap
NOTE: Always run as root user as the commands don't have sudo in them.
Host discovery
nmap -sn [IP_Range] | grep for | cut -d" " -f5
| Flag | Desc |
|---|---|
| -iL [file] | Input host list from a file |
| -sn | No port scan, host discovery only (ARP then ICMP by default on same subnet) |
| --packet-trace | Show all packets sent/received, useful for debugging discovery |
| --reason | Displays the reason for specific result. |
| --disable-arp-ping | Disable ARP ping even on local subnet |
| -PE | ICMP echo request ping, often blocked by firewalls |
| -Pn | Disables ICMP Echo request |
| -PR | ARP ping only, default for local subnet, fast and reliable |
| -PP | ICMP timestamp request ping |
| -PM | ICMP address mask request ping |
| -PS | TCP SYN ping, sends SYN, expects SYN/ACK, default port 80 |
| -PA | TCP ACK ping, sends ACK, expects RST if host is up, default port 80 |
| -PU | UDP ping, expects ICMP port unreachable if host is up |
| -n | No DNS resolution, speeds up scan |
| --exclude [hosts] | Exclude specific hosts/ranges |
| --excludefile [file] | Exclude hosts listed in a file |
No port scanning : -sn
By default ARP packets are sent first, and then ICMP echo.
Port scans
nmap -p- -T4 -sV -sC -oN nmap [MACHINE_IP]
| Flag | Desc |
|---|---|
| -sT | TCP scan |
| -sU | UDP, very slow, use top ports |
| -sS | Syn (Stealth) half handshake, final ack not sent |
| -sN | Null, no flag bits set, only closed ports |
| -sF | Fin, fin bit set, only closed ports |
| -sX | Xmas, fin psh urg bits set, only closed ports |
| -sW | Window, ack flag set, same as -sA, check down |
| -sM | Maimon, fin ack bits set, sometimes dropped for open port |
| -sA | ACK, ack flag set, only filtered ports, rule detection |
| -O | OS detection |
| -sV | Service detection on open ports |
| -sC | Run default scripts on open ports |
| -A | Performs service, OS detection, traceroute and uses defaults scripts while scanning |
| -v or -vv | Verbosity |
| -oN or -oA | Save normal or all formats |
| -T4 or -T5 | runs faster, T3 by default |
| --scanflags RST,SYN,FIN | Custom scan, set SYN, RST, and FIN together |
| --stats-every=5s | Shows progress of scan every 5 seconds. |
udp, null (no flags set), fin (finish flag set) and xmas (psh, urg and fin set: malformed packet) scans respond to only closed ports with RST packet.
Otherwise it is open|filtered
Window scan -sW : checks window field of rst packet, sometimes responds differently according to firewall so it may display as open ports.
Port States
open: If target sends SYN-ACK flagged packet
closed: If target responds with RST flagged packet
filtered: If Nmap does not receive a packet back, might be dropped or ignored by firewall
unfiltered: Only occurs during the TCP-ACK scan. Port is accessible, but cannot be determined whether it is open or closed.
open | filtered: No response for specific port. Indicates that a firewall or packet filter may protect the port.
closed | filtered: Occurs only in the IP ID idle (Zombie) scans and indicates that it was impossible to determine if the scanned port is closed or filtered by a firewall.
Create HTML Report
• Output must be saved in XML
• Convert stored results from XML to HTML using xsltproc
xsltproc target.xml -o target.html
• Open the HTML file in browser
Performance
| Flag | Default | Description |
|---|---|---|
| --initial-rtt-timeout [time] | 100ms | Initial timeout |
| --min-rtt-timeout [time] | - | Minimum timeout |
| --max-rtt-timeout [time] | 100ms | Maximum timeout |
| --max-retries [num] | 10 | Max retries |
| --min-rate [number] | - | Minimum packets/sec |
| --max-rate [number] | - | Maximum packets/sec |
Rates : If we know the network bandwidth, we can set the min. rate for sending packets.
NSE: Scripting Engine
Searching:
grep "category_name or protocol or anything specific" /usr/share/nmap/scripts/script.db
Categories of scripts:
| Category | Description |
|---|---|
| auth | Determination of authentication credentials. |
| broadcast | Scripts, which are used for host discovery by broadcasting and the discovered hosts, can be automatically added to the remaining scans. |
| brute | Executes scripts that try to log in to the respective service by brute-forcing with credentials. |
| default | Default scripts executed by using the -sC option. |
| discovery | Evaluation of accessible services. |
| dos | These scripts are used to check services for denial of service vulnerabilities and are used less as it harms the services. |
| exploit | This category of scripts tries to exploit known vulnerabilities for the scanned port. |
| external | Scripts that use external services for further processing. |
| fuzzer | This uses scripts to identify vulnerabilities and unexpected packet handling by sending different fields, which can take much time. |
| intrusive | Intrusive scripts that could negatively affect the target system. |
| malware | Checks if some malware infects the target system. |
| safe | Defensive scripts that do not perform intrusive and destructive access. |
| version | Extension for service detection. |
| vuln | Identification of specific vulnerabilities. |
Firewall Evasion:
https://nmap.org/book/man-bypass-firewalls-ids.html
ACK Scan
Sometimes SYN flag connection attempts are blocked by firewalls, therefore, go for ACK scan -sA
nmap [MACHINE_IP] -p [ports] -sA -Pn -n --disable-arp-ping
Decoys
-D [decoy1], [decoy2], ME, [decoy3], ..
-D RND: [num]
Makes it appear that the decoys are scanning the target network too. IDS won't know which IP was scanning them and which were innocent decoys.
ME : position of your IP address - just leave it as ME, no need of replacing it.
DNS Proxying
Usually traffic on port 53 is trusted and let through unfiltered.
Use 53 as source port in nmap scan
--source-port 53
Connect to filtered port
ncat -nv --source-port 53 [MACHINE_IP] [PORT]
Proxies
--proxies [Comma-separated list of proxy URLs] (Relay TCP connections through a chain of proxies)
--randomize-hosts (Randomize target host order) : make the scans less obvious to various network monitoring systems, especially when you combine it with slow timing options. Tells Nmap to shuffle each group of up to 16384 hosts before it scans them.
Fragmentation
-f : Fragment the packets ,less likely that the packets will be detected by a firewall or IDS.
--mtu [number] : accepts maximum transmission unit size to use for the packets sent. This must be a multiple of 8.
--scan-delay [time] ms : add a delay between packets sent. useful if the network is unstable and evading time-based firewall/IDS triggers.
--badsum : generates invalid checksum for packets. Any real TCP/IP stack would drop this packet, however, firewalls may potentially respond automatically, without bothering to check the checksum of the packet. As such, this switch can be used to determine the presence of a firewall/IDS.
Zombie scan
-sI [ZOMBIE_IP] [your_IP]