Network Discovery With Nmap (pt2)
1) Explore host with IP ping scan As we said in the previous episode, the scan ping used to find hosts that are online to a network. In the following example we will see how to make an IP ping scan to see hosts who are online at the time of scan.
nmap -sP -PO 192.168.1.1/24
Starting Nmap 7.01 ( https://nmap.org ) at 2016-01-30 19:59 EET Nmap scan report for 192.168.1.1 Host is up (0.00024s latency). MAC Address: (Tp-link Technologies) Nmap scan report for 192.168.1.100 Host is up (0.0055s latency). MAC Address: (Apple) Nmap scan report for 192.168.1.102 Host is up (0.011s latency). MAC Address: (Apple) Nmap scan report for 192.168.1.103 Host is up (0.032s latency). MAC Address: (Murata Manufacturing) Nmap scan report for 192.168.1.101 Host is up. Nmap done: 256 IP addresses (5 hosts up) scanned in 3.32 seconds
How does IP ping scan works: In the case of IP scan ping using IGMP and ICMP protocol to see whether the host is online.
2) Exploration host with ARP ping scan The ARP ping scan is the best option to see which hosts are online regarding the internal network (LAN) In this case the nmap uses a proprietary algorithm.
nmap -sP -PR 192.168.1.1/24
Starting Nmap 7.01 ( https://nmap.org ) at 2016-01-30 20:00 EET Nmap scan report for 192.168.1.1 Host is up (0.00024s latency). MAC Address: (Tp-link Technologies) Nmap scan report for 192.168.1.100 Host is up (0.060s latency). MAC Address: (Apple) Nmap scan report for 192.168.1.102 Host is up (0.065s latency). MAC Address: (Apple) Nmap scan report for 192.168.1.103 Host is up (0.087s latency). MAC Address: (Murata Manufacturing) Nmap scan report for 192.168.1.101 Host is up. Nmap done: 256 IP addresses (5 hosts up) scanned in 2.38 seconds
How does ARP ping scan works: The nmap sends ARP request to host and if received ARP response then host is online. 3) DNS Resolution The analysis of the DNS, the Domain Name System else usually gives us helpful information on the host, and it become why most Administrators call the respective host depending on use. P.X: mail server, firewall, router, and so on. In the following example we will use a method for "violent" analysis DNS to obtain results even for the host that are not online something which is not the case for "non violent" analysis
nmap -sS -PS -F -R 192.168.1.1/24
Starting Nmap 7.01 ( https://nmap.org ) at 2016-01-30 20:03 EET Nmap scan report for 192.168.1.1 Host is up (0.0016s latency). Not shown: 98 closed ports PORT STATE SERVICE 23/tcp open telnet 80/tcp open http MAC Address: (Tp-link Technologies)Nmap scan report for 192.168.1.100 Host is up (0.031s latency). All 100 scanned ports on 192.168.1.100 are closed MAC Address: (Apple)Nmap scan report for 192.168.1.102 Host is up (0.0086s latency). All 100 scanned ports on 192.168.1.102 are closed (50) or filtered (50) MAC Address: (Apple)Nmap scan report for 192.168.1.103 Host is up (0.0044s latency). All 100 scanned ports on 192.168.1.103 are closed MAC Address: (Murata Manufacturing)Nmap scan report for 192.168.1.101 Host is up (0.0000080s latency). All 100 scanned ports on 192.168.1.101 are closed Nmap done: 256 IP addresses (5 hosts up) scanned in 21.22 seconds
How does analyze DNS scan works:: In the World there are 13 root servers, TLD Name servers and a few thousand responsible for DNS management. When we ask someone then our DNS servers (router) communicates with said server for results. A good graphic guide for more detailed study is the following: http://royal.pingdom.com/2009/06/08/a-visual-explanation-of-how-dns-lookups-work/
You see the same result on the scans cause there is no firewall or IDS enabled , for more realistic results feel free to test nmap on scanme.nmap.org just watch out you can try only few scans per day.