My lightning talk on nmap given at the Christchurch ISIG meetup on 27 Oct 2015

1. NMAP
You’re on the network, now what?
28 Oct 2015, Kevin Alcock

3. NMAP - What is it?
• free and open source utility for network discovery and
security auditing
• binaries available for Linux, Windows, & Mac OS X
• It was designed to rapidly scan large networks, but
works fine against single hosts.
• uses raw IP packets in novel ways to determine what
hosts are available on the network, what services
(application name and version) those hosts are offering

4. NMAP
$ nmap 172.16.16.14
$ nmap 172.16.16.10-19
$ nmap 172.16.16.0/24
Default nmap TCP scan uses the 1000 most popular
ports.
see /usr/share/nmap/nmap-services

5. NMAP - A few options
$ nmap -sT 172.16.16.14
$ nmap -p 80 172.16.16.14
$ nmap -p 1-65535 172.16.16.14
$ nmap -v -sn 172.16.16.10-19
$ nmap -sT -A --top-ports=20 172.16.16.10-19

6. NMAP - A few options
-O (OS Detection)
-n (No DNS resolution)
-s <ip> (spoof source ip)
-6 (IPv6 scan)
-sV (Grab banners)

7. Input/Output options
-iL <file> (Input from list of hosts)
--exclude <host1[,host2][,host3],…> (Exclude hosts)
--excludefile <file> (Exclude list from file)
-oG <file> (Grepable output format)
-oX <file> (XML format)

8. NMAP - NSE scripts
/usr/share/nmap/scripts
--script=
ftp-proftpd-backdoor
smb-os-discovery
vnc-brute

9. NMAP - More Info
• http://nmap.org
• man nmap
• and google is your friend