Nmap (Network Mapper,) is a free and opensource security tool used for network scanning. Some of the main features of Nmap are scan for open ports, service discovery and security, and vulnerability auditing.
Nmap is most commonly used via a command-line interface and is available for many different operating systems such as Ubuntu, CentOS, Redhat, Free BSD, and Mint.
In this tutorial, we are going to look at the some of the most frequently used Nmap command with some examples.
Install NMAP
Be default, nmap is not installed on most Linux distributions like Debian, Ubuntu, Hat, CentOS and Fedora. But its available on yum and apt repo for an easy install.
The following commands install nmap on Linux:
CentOS and Redhat based systems
$ sudo yum install nmap
On Ubuntu and Debian based systems
$ sudo apt-get install nmap
1. Scan Specific Host
To scan a specific host (this assumes that you already have the host's IP or hostname) and reveal basic information, use the command:
$ nmap IP-address
For example,
$ nmap 192.163.43.103
The command above is quick and generates output within a short time
You can also scan using the hostname instead of the IP address for example
$ nmap ubuntu-server
To scan a range of IPs, use the syntax
$ nmap 192.163.43.1-103
The command will scan all hosts from IP 192.168.43.1 to 192.168.43.103
2. Perform a thorough scan on a system
You can reveal all the information about a host system using the -A flag as shown below. This will reveal all the information pertaining to the host system such as the underlying OS, open ports, services running and their versions, etc.
$ nmap -A 192.163.43.103
From the output, you can see that the command performs os and service detection, giving you detailed information such as the type of service and its version, and the port it is running on. The command usually takes a while to run but it is thorough and gives you all you need about the particular host system.
3. Scanning a particular port
To scan a specific port and check if it is open use the -p flag in the syntax below:
$ nmap -p port_number IP-address
For example, to scan port 80 on a host system run:
$ nmap -p 80 192.168.43.103
To scan a range of ports, for example between 80-433 use the syntax:
$ nmap -p 25-443 192.168.43.13 or $ nmap -p 80,443 192.168.43.13
4. Find Host service name and its version
To check basic information about the services running on a host, then use the -sV flag as shown:
$ nmap -sV 192.168.43.103
5. Scanning an entire network subnet
To scan devices in a network subnet, use the CIDR notation as shown
$ nmap 192.168.43.0/24
6. Exclude specific host on Scan
As you perform a full network scan, you can choose to exclude a specific host using the --exclude flag . In the example below, we shall exclude our Kali Linux machine from being scanned.
$ nmap 192.168.43.* --exclude 192.168.43.8
7. Display host interfaces and routes
To display interfaces and routes on a particular host use the --iflist flag as shown.
$ nmap 192.168.43.103 --iflist
8. Scan Remote Host using TCP ACK and TCP Syn
At times, firewalls can block ICMP requests interfering with the scan results. In that case, we use the TCP syn (PS) and TCP ACK (PA) to achieve the desired results.
$ nmap -PS 192.168.43.103
$ nmap -PA 192.168.43.103
9. Scan to detect firewall settings
You can use the Nmap tool to perform a scan to show whether the firewall is open or not as shown
$ nmap -sA 192.168.43.223
In the first instance, the firewall is disabled and therefore not running. (Ports are unfiltered). In the second instance, the firewall has been enabled and chances of discovering open ports will be minimal.
10. Scanning TCP or UDP ports
To scan TCP ports that are open on the host, use the -sT flag as shown:
$ nmap -sT 192.168.43.103
To scan UDP ports, use the -sU flag
$ nmap -sU 192.168.43.103
11. Save scan results in a file
After you have completed your scan, you can save the results in a text file using the -oN flag and specifying the output file as shown below:
$ nmap -oN scan.txt 192.168.43.103
The file will be created in your current working directory. To view the view simply use the cat command as shown:
$ cat results.txt
Also, you can use the redirection symbol (>) greater than symbol to redirect the output to a different file for example,
$ nmap 192.168.43.103 > output.txt
12. Scan with a set of Nmap scripts
Nmap comes packed with numerous and powerful scripts that are used for vulnerability scanning and thereby pointing out weaknesses in a system. To get the location of NSE scripts simply run the command:
$ locate *nse
You can load an Nmap script using the --script option as shown.
$ nmap -sV --script=mysql-info.nse 192.168.43.103
To scan with the most default scripts use the syntax
$ nmap -sC 192.168.43.103
If you are looking for automation then NSE is the answer (NMAP Scripting Engine)
Conclusion
If you are looking for automation then NSE is the answer (NMAP Scripting Engine). To get help with commands on Nmap simply run $ nmap -h. And that's all we had for this topic. We do hope that you are comfortable using nmap command to scan your network and discover more details about your host systems.
