Nmap Tutorial for Beginners | Learn Network Scanning & Hacking Tools | Edureka

Key Takeaways

[Music] hello everyone welcome to this end map tutorial brought to you by Eddie Rea in this session we'll explore what end map is it's various modes of operation and some popular Alternatives we'll then move into the Hands-On demonstration where we'll start with the installation process and proceed to run different types of scans apply various scan filters and much more but before we begin make sure to subscribe to our YouTube channel and hit the Bell icon for the latest tech content from Eda also visit the Eda website for various training and certification courses the link to the website is in the description box below let's begin with understanding what nmap is nmap which stands for network mapper is a free and open-source utility used for network discovery and security auditing it's a tool that's popular among Network administrators and security profession profs because it helps them gain insight into their Network structures and also Security in fact nmap is so powerful that it's not only useful for security auditing but it also helps with tasks like Network inventory managing service upgrades and monitoring the uptime of hosts and services now let's dive into the key uses of nmap first it's widely used for network discovery which means finding devices and hosts in a network it also helps in security auditing by identifying vulnerabilities and weaknesses in the network administrators use it for things like Network inventory tracking all the devices on their Network and also for managing service upgrade schedules nmap is also handy for monitoring host and service up time ensuring that critical services are running smoothly moving on let's talk about the features of nmap what makes nmap so effective is that it uses a raw IP packets into unique ways to get valuable information for example it can tell you what hosts are available on the network meaning which devices are actively connected but it doesn't stop there it also identifies what services those host are offering including the details like the application name and version inmap can even figure out the operating systems and versions running on those devices additionally it helps in detecting the type of firewalls and packet filters in the place so nmap is an extremely versatile tool that provides a wealth of information about the network you're scanning another great feature of nmap is its compatibility it's not restricted to just one operating system it works across all major platforms official binary packages are available for Linux Windows and Mac OS X so regardless of what you are using you can run nmap and take advantage of its powerful features it's a truly cross-platform tool finally let's take a look at the end map suit and map is not just about the basic command line tool it comes with several additional tools that make it even more powerful one of these is zenmap which provides a graphical user interface making it easier for those who prefer not to use a command line then there's enat a flexible tool for data transfer redirection and debugging which is a grade for Network tasks and diff is another useful tool in the suit which helps you compare scan results over time and and finally nping is used for package generation and response analysis allowing you to analyze how your network responds to certain packets one of the most exciting aspects of end map is its variety of scanning techniques which we call modes of operations these modes allow inmap to explore networks in different ways depending on the requirements of the task or the level of stealth needed let's break them down now first we have is a ping sweep this mode is used for network discovery nmap sends icmp Echo request to check which hosts on the network are alive and reachable it's like saying hey are you there and waiting for a reply next we have the sin scan which is also known as the half open scan this method sends sin packets to a host and waits for a response if the target sends back a synac it means the port is open what makes it half open is the connection isn't fully established making it faster and less likely to be detected the next is TCP connect scan the TCP connect scan is a simpler and more direct method it fully establishes a TCP connection with the host this is useful when you don't have the Privileges to perform a sin scan but can be slow or more detectable then we have is the idle scan the idle scan is a stealthy technique that uses another machine as a decoy this way it hides your IP address during the scan making it highly discrete but also more complex then we have a the RPC scan this mode specifically targets RPC services on the network nmap sends requests to identify which remote procedure call services are running and collects details about them next is the windows scan the windows scan is tailored to identify open TCP ports on Windows machines it uses specific TCP flag combinations to bypass traditional detection mechanisms then we have the bounce scan the boun scan exploits FTP servers that support proxy FTP connections it uses the FTP server to scan a network hiding your IP address in the process this method is rarely used today but can be effective in certain scenarios then is the UDP scan unlike TCP scans the UDP scan is used to discover open UDP ports since UDP doesn't require handshake like TCP this method can be slower but is crucial for detecting services like DNS or SNMP the next we have is a fin scan the fin scan sends TCP packets with the fin flag which typically signals the end of the connection many firewalls and systems don't log these packets making it a steal the approach to identify open ports next comes a null scan in this mode no flags are set in the TCP packets this unconventional technique helps bypass some intrusion detection systems by not following standard protocols then we have is the xmus scan this creatively named scan sets multiple BCP flag simultaneously reassembling the lights of a Christmas tree it's designed to probe and identify open ports but is less common today due to its higher detectability next comes the ax scan the ax scan doesn't identify open ports directly but instead checks for the presence of the firewall or filtering rules it's more of a reconnaissance tool than a direct Port scanner next is a version detection nmap can also perform service version detection which probes ports to deter mind the application and version running on them this is crucial for identifying outdated and vulnerable Services the last we have is the ow detection with OS detection nmap identify the targets operating system and its version by analyzing details in response packets this information can guide further scanning and security assessments with these modes nmap offer flexibility for various scenarios from basic host Discovery to Ste the scans and detailed service analysis each each mode has its Trends and is suited for specific Network setups or objectives while nmap is powerful tool for Network scanning and security auditing there are several Alternatives that offer unique features and compatibilities let's explore some of them the first we have the zenmap zenmap is an official graphical user interface for nmap it provides an intuitive interface for users who prefer not to work directly with command line tools zenmap retains all the functionalities of nmap making it accessible for both beginners and advanced users the next comes the port spider Port spider is a security tool designed to scan Network ranges and identify open ports its primary goal is to detect vulnerable Services across multiple machines simultaneously making it useful for comprehensive Network assessments the next is the McAn McAn is reowned for its high performance capabilities allowing it to scan was number of IP addresses rapidly it's optimized for asynchronous Transmissions enabling it to scan the entire ipv4 internet in a matter of minutes however masan provides less detail information compared to nmap focusing primarily on identifying open ports the next we have is the angry ip scanner angry ip scanner is an open- Source crossplatform Network scanner that is simple to use it pings IP addresses to check if they are active and can resolve host names determine Mac addresses and scan ports it's EAS to to use makes a popular choice for quick Network assessments the last we have is the fing fing is a mobile and desktop application that provides Network scanning and device Discovery it's user friendly and offers features like device recognition network security assessments and Wi-Fi troubleshooting making it suitable for both home and professional use now that we have covered the theory behind end map it's time to see it in action in this section we'll go Hands-On with three key aspects of using nmap that is installation running scans and applying scan filters we'll start by demonstrating how to install nmap on different operating systems including windows and Linux the installation process is straightforward and by the end of the segment you'll have nmap ready to use on your systems first we'll start by installing nmap on Windows visit the official nmap website at nm.org then go to download section and select the appropriate Windows installer we'll wait for it to get downloaded next run the installer and follow the proms to complete the installation now click on I agree take all the checkboxes and click on next choose the destination folder that you prefer click on install wait for it to get installed click on I agree again install now click on next finish let's minimize this now let's again click on next for me I will be unchecking the desktop icons click on next finish so now we have the end map installed on our system once installed you can open command prompt or Powershell and type in map to verify that it's working there you go you can see that it's successfully working now let's install inmap on Linux open your terminal first to install in map type the following command so now let's type Pudo a get install in map hit enter and enter your password anyways it's already pre-installed after the installation finishes you can verify it by typing nmap in the terminal to see the nmap version and usage instructions there you go next we'll move on to running scans using nmap here we'll explore how to perform basic network discovery and more advanced scans to gather detailed information about hosts and services before we dive into running nmap commands let's understand the key components that make up a scan inmap scans are systematic and structured ensuring you get precise and actionable results here's a step-by-step breakdown first we have is the scan type nmap supports various scan types like a sin scan UDP scan or a full connect scan each type serves a different purpose and is tailored to specific scenarios the next we have is the port number this specifies which Port you want to scan by default and map scans the most common thousand ports but you can customize this based on your requirements next is a scan timing this determines how aggressive or stealy your scan will be nmap offers timing templates ranging from very slow and stealy scans to fast aggressive ones the next is output types finally you can decide how to save or view the results nmap supports multiple output formats including standard output XML and even a Gable format for advanced processing the last is a target IP this is one of the most critical and mandatory piece of information without a Target and map does not know where to look the target can be a single IP a range of ips or even a host name by understanding these elements you'll have a complete control over your scans tailoring them to meet your exact needs before getting into nmap IP scanning let's quickly talk about the cheat sheets available for nmap these cheat sheets are the great source of Saving Time and help you run commands efficiently if we open a browser and type nmap cheat sheet in the search bar you'll find several options two popular ones are station X and map cheat sheet and the other one is compar Tech and map cheat sheet talking about the station X and map cheat sheet this is my goto cheat sheet because it's interactive it allows you to search for specific commands and copy them directly making is super easy to use the other one we have is a comparitech and map cheat sheet this one is available in PDF format which is Handy for offline reference it's well organized and provides a quick overview of commonly used commands while both are useful I prefer the station X Che sheet for its Simplicity and easy of navigation these resources make learning and using and map much easier so keep them in mind as we proceed let's start with nmap IP scanning first nmap gives you multiple ways to Define your targets making it a highly flexible tool for scanning networks let's break it down first let's start with single IP so let's type the command this is the simplest way to Target a single device by specifying its IP address this method is great for Focus scans on a specific machine there you go here we have the results now let's see the subnet range here we specify an entire subnet using cidr notation this is idal for scanning all devices in a network range such as a small office Network next let's search for an IP range let's type the command for it if you need to scan a specific range of ips you can use a hyphen to define the range this is useful when you know the range of active devices you want to scan next let's search for the specific IPS sometimes you might want to scan multiple non-sequential IPS you can list them directly separated by spaces next let's try searching with the text file for this we'll open our editor so we'll enter some random IP that we want to search now let's save this on the desktop with the name targets. txt now we'll minimize this now let's go to our desktop directory on a terminal now let's enter the command for larger or predefined Target list you can save the IPS in a text file and use the IL flag to load them this method is perfect for bat scanning without manually entering IPS next let's search for a domain instead of using IP addresses you can directly scan a domain name and map will resolve the domain to its corresponding IP address and scan it this is especially useful for web servers and hosted services so we have the results here for ed. go next let's learn nmap Port scanning now that we have covered how to specify targets let's talk about ports ports are crucial in understanding the services running on a host and end map offers several ways to scan them based on your needs let's break them down with examples first let's start with the single port scanning let's type the command for it if you're interested in a specific Port like Port 80 for HTTP Services you can use the P flag followed by port number this is perfect for Focus scans next let's search for the sequential ports this scans a range of ports sequentially like ports 20 through 25 it's useful when you want to check multiple consecutive ports next let's search for the distributed ports only you can also scan non-sequential ports by listing them with commas this allows you to focus on ports of of Interest such as SSH HTTP and https next let's find the specific Services let's type the command for it sometimes you might want to Target a specific service running on a port using scripts like HTTP title with the p flag focuses on identifying specific service details such as web servers next let's search for the protocol specific ports nmap allows you to scan ports for specific protocols for instance scanning Port 53 with Su Flags targets UDP traffic which is commonly used for DNS servers next let's search for all the ports if you're Ure about which Port are in use you can scan all 65,535 ports with hyphen P hyphen flag this provides a comprehensive view of host open ports so if you hit enter it will show us the status of the scan so here you can see that the status is 39.663741 ports to save time you can scan the most commonly used ports using the top ports option for example scanning the top 100 ports gives gives a quick snapshot of the most relevant ones now that we have covered how to specify targets and scan ports let's dive into the different scan types nmap offers each scan type serves a specific purpose allowing you to choose the most appropriate method depending on your goals let's go through each of them first we will begin with a simple ping scan let's Ty the command a ping scan is a simply form of scanning used to determine if a host is up or down it doesn't scan ports but sends icmp Echo request to see if the target response next let's move on to the Sinn scan better known as the steal scan the Sinn scan is the most popular and stealy scan it sends a Sy packet to a Target Port and waits for response if the board is open it replies with a synar the scan doesn't complete the TCP handshake making it stealthier and harder to detect next let's talk about the TCP connect scan the TCP connect scan is a more straightforward approach it completes a TCP handshake by sending a sin receiving a sin act and then sending an act while it's easier to detect it's useful when a s scan is blocked or unavailable next let's search for the UDP scan unlike TCP UDP doesn't have an hand handshake making it more challenging to scan the UDP scan sends a datagram to the Target p and waits for response if there is no response the port is open or filtered next let's do a fin scan a fin scan sends the fin packet to the Target Port which typically indicates that the sender has finished communicating this scan can be useful to bypass certain firewalls and packet filters because it doesn't behave like a typical connection request next let's search for the null scan a null scan sends a packet with no flag set essentially making it appear like an empty packet this can sometimes bypass firewalls that only look for established connections but may be more likely to get blogged by modern firewalls next let's perform an Xmen scan the xus scan sends a packet with the fin PHS and also a urg flag set it's called the xma scan because the flags are set like a lights on a Christmas tree it's another Stelly scan type that can bypass certain types of filtering systems next let's perform an ax scan an a scan is primarily used to map out firewall rule sets rather than identifying open ports it sends act packets to the Target ports and analyzes the responses to determine if the ports are filtered or not next let's perform a Windows scan let's type the command for it the windows scan is similar to an a scan but uses the TCP window size to determine the state of the ports it's useful for mapping firewall rules and bypassing certain filtering systems next let's perform an idle scan the idle scan is one of the stealthiest scans it uses third-party device to send packets to the Target make making it difficult to trace the scan back to the attacker this type of scan is often used to avoid detection next let's perform the remote procedure call scan the RPC scan is specifically designed to identify services that use the remote procedure call protocol this is useful for scanning systems running services like NFS or SMB next let's perform an OS detection scan by using the O flag nmap tries to identify the operating system and OS version of the target Host this can relies on TCP IP stack fingerprinting to determine the OS based on how the target responds to various Network probes lastly let's do a version detection scan a version detection scan identifies the version of the services running and open ports this is useful for discovering vulnerability specific to certain software our versions next let's talk about scan timing in inmap when you run a scan the speed and intensity of the scan can be adjusted using different timing options n map offers a range of timing from t0 to T5 to help you balance speed stealth and accuracy let's break down each one first let's start with the t0 that is also known as a paranoid scan let's type the command for it t0 is the slowest timing option and is used for extremely stealy scans it's designed to minimize detection by firewalls and intrusion detection systems by making the scan extremely slow this option is great for situations where you need to be as discrete as possible but it may take a long time to complete now let's cancel this and move on to our next scan type because this might take a longer time the next scan we have is T1 that is also known as a sneaky scan T1 is still slow but a bit faster than t0 it's often called a sneaky scan because it is designed to avoid detection while still being faster than a t0 scan it's useful for reconnaissance when you need to remain hidden but don't have time for a t0 scan let's cancel this and move on to our next scan type let's see the t2 scan that is also known as the polite scan T2 is a polite scan it's still slow but avoids overwhelming the target Network or host with too many requests at once this scan type is useful when you don't want to create too much traffic or disrupt the network similarly we have another scan that is a T3 scan T3 is a default setting for end map and provides a good balance between speed and stealth it's called a normal scan and it's a best option when you don't need to be overly stealthy or slow it's a great option to most General use cases and should be used when speed and accuracy are more important than being undetected now let's move on to the T4 scan that is the aggressive scan T4 is an aggressive scan it scans Faster by sending more packets at once which can lead to quicker results but also increase the chance of detection by fire walls and intrusion detection systems this option is useful when you need quickly gather information and don't mind being noticed by the Target machine lastly let's move on to the T5 scan which is the insane scan T5 is a fastest and most aggressive scan it's called an insane scan because it attempts to scan as quickly as possible which makes it highly detectable it sends a high volume of requests in a short time so while it may provide very fast results it can also overwhelm the network and Alert security systems use this only when you need fast results and when stealth is not a priority now to summarize here are the different timing options and the characteristics first we have the t0 which is very slow and stealy then the T1 which is slow and sneaky next comes the t2 which is slow and polite T3 which is normal and balanced as well then is the T4 which is fast and aggressive the last is T5 which is very fast and insane now let's take a look at the output types available in inmap nmap offers several formats for saving the results of your scan which can be useful for analysis Automation and Reporting let's go through each of them first we have is a normal text format output let's stab the command for it the normal text format is a default and simplest output format it generates a human readable Report with basic information about the scan results such as open ports services and other details this format is great for quick easy to read reports and is the most common format used by most inmap users next is the XML format output the XML format is used when you need to process the scans results further and integrate them with other tools it generates a structured XML file that contains all the details of the scan including host information open ports and service details this format is idle for Automation and scripting especially when you want to parse the results with other programs next is a Gable format output the Gable format is designed for easy searching and parsing using tools like grip it output scan results in a simple line by line text format that makes it easy to filter or search for specific data although it's not the most humanfriendly it's useful for quickly extracting certain details from large scan results however nmap does not recommend this format for serious analysis as it can sometimes omit important details and isn't as structured as other formats the next is a script Kitty format output the script Kitty format is a very basic format designed primarily for people who aren't familiar with nmap's detailed output it gives minimal information in a simple format and while it's not commonly used by experienced users it may be useful for beginners or for quick checks however it's not recommended for professional or detail analysis due to its lack of depth finally let's talk about the nmap script engine NSE is a powerful feature of end map that allows you to extend its functionality with custom scripts these scripts are written in Lua and can automate a variety of tasks helping with network discovery and security auditing nsse scripts can be used for a range of purposes such as five wall bypass which helps bypass five walls or IDs IPS system systems to avoid detection during scans next is the FTP enumeration gathers information about FTP servers including user accounts and share directories then comes the DNS enumeration extracts DNS records and identifies potential misconfiguration in DNS servers last is the HTTP enumeration identifies web applications and hidden directories on HTTP servers potentially exposing vulnerabilities these Scripts are located in the scripts directory of n Maps installation for example on parro OS you can find the mat type the command for it as you can see here we have all the scripts the nsse scripts are incredibly useful for penetration testing and network analysis they help automate complex tasks and provide deeper insights during security assessments with this we have come to an end to this video on end map tutorial if you enjoyed listening to this video please be kind enough to like it and you can comment on any doubts and queries we will reply to them at the earliest look up for more videos and playlist And subscribe to Ed Ra's YouTube channel to learn more thank you for watching and happy learning