---
# System prepended metadata

title: Nmap
tags: [Nmap, Tryhackme, Active Recon]

---

    Owner: 侯智晟 (meowhecker)
    Email: meowheckerouo@gmail.com 
    
[TOC]


# Mapping Network & Discovering alive Host

Before initial an attack the target machine,It is crucial to gather essential information 

- Machine is online?
- What the services are running ?


Namp is open source tools (1997), Play a pivotal role in mapping the target systems (This is very important!!)

- Identifying Active/Dead Hosts:
- Identifying Running Services on Hosts:


Workflow for Namp tools 


![圖片](https://hackmd.io/_uploads/Hy2XgHO36.png)

## Sub Network (Term Explanation)

### Network segment 

A Network segment refers to a Physical Connected portion of network. 

e.g. switch or Access point 

### Subnetwork 

Subnetwork represents a Logic Connection with a network 

e.g router 

![圖片](https://hackmd.io/_uploads/ByJEfrdnp.png)

![圖片](https://hackmd.io/_uploads/B1YsGrdnT.png)


### LAB subnetwork practice 

Topology 

![圖片](https://hackmd.io/_uploads/rJzYVSunp.png)


Q1. ARP packet (segment-1)

![圖片](https://hackmd.io/_uploads/HJ7mNHdnT.png)

![圖片](https://hackmd.io/_uploads/SkWaVrd36.png)

![圖片](https://hackmd.io/_uploads/S16TEr_2p.png)

Q2. ARP packet (segment-2)

![圖片](https://hackmd.io/_uploads/Sysfrrd3p.png)

![圖片](https://hackmd.io/_uploads/S1odSru2p.png)

![圖片](https://hackmd.io/_uploads/BkPqHr_2p.png)

solved!!



## Mapping target Network (Dead list)

Defined target scope we want to scan 

- list 

meohecker1.com meowhecker2.com 192.168.1.2

- Range

10.10.10.1-10 -> scan 10.10.10.1 ~ 10.10.10.10

- subnet

machineip/30 -> ignore 2 bit -> scan 4 ip address 

- file.txt

`nmap -iL list_of_hosts.txt.` 


Check a list of host without port scan 

```
nmap -sL MACHINE_SCOPE
```
sL -> list scan!!

This option will give you a **detailed list** of the hosts that Nmap will scan without scanning them


>Reverse-DNS look up(Default): nmap connect to DNS server to do reverse-DNS lookup(ip to host name) it might reveal information to the pentester



### LAB - Mapping Network 

Not Scanning -> `dead list` 

```
nmap -sL 10.10.12.13/29
```
![圖片](https://hackmd.io/_uploads/ryeq2ru2T.png)


```
nmap -sL 10.10.0-255.101-125
```
![圖片](https://hackmd.io/_uploads/HJZB5rdnT.png)

![圖片](https://hackmd.io/_uploads/r1gu9rdnp.png)

Solved !!


## Discover the live host via Network Protocol 

We can use TCP/IP Protocols to discover the live hosts.

- Layer2 
ARP Protocol: Send a frame to broadcast address 

Layey3 
ICMP Protocol: Type(8 echo) | Type (0 echo reply)

Layer4 
TCP Protocol 
UDP Protocol


### LAB-Discover the live host 

Topology 
![圖片](https://hackmd.io/_uploads/SyuIy8_nT.png)


Q1. PC-1 ping PC-2 
![圖片](https://hackmd.io/_uploads/rkAryId2T.png)



![圖片](https://hackmd.io/_uploads/SJ83yIu36.png)

Solved 


Q2. PC2 ping PC5 (Cross the network segment)


![圖片](https://hackmd.io/_uploads/HkIKeUdn6.png)

2 ARP Query 

![圖片](https://hackmd.io/_uploads/SJBneLunp.png)

Solved ! 

## ARP alive host Discovery 

When the attacker and target exist in same network segment, ARP (Address Resolution Protocol) requests can be employed to discover alive hosts.


![圖片](https://hackmd.io/_uploads/BJ2XtIOh6.png)


Upon receiving the MAC address of the target machine, it can confirm that the target machine is alive.
    
```
nmap -RP -sn ATTACKERIP/NETWORK_SEGMENT
```


RP -> Using ARP to discover alive machine 
sn -> Ping scan (Forbidden Port scanning) 

![圖片](https://hackmd.io/_uploads/BkTVp8d36.png)

![圖片](https://hackmd.io/_uploads/S1jzXw_3p.png)



### arp-scan (Another Tools)

Another tool for ARP-based.

Usage:

The command will send ARP request for all valid IP

```
arp-scan --localnet

or 

arp-scan AttackerIP/24
```

![圖片](https://hackmd.io/_uploads/Sk8R2Luna.png)

---

Specify the interface 

```
sudo arp-scan -I eth0 --localnet
```

### LAB-ARP discover Alive host 

![圖片](https://hackmd.io/_uploads/BJkFiUdn6.png)

![圖片](https://hackmd.io/_uploads/SJgBYsUdh6.png)

Solved !


## ICMP Alive Host Discovery


### Echo Request (Default blocked by Windows Machines) 

ICMP type 8 -> Echo request 
ICMP type 0 -> ECHO reply (Discover Alive Machine )

![圖片](https://hackmd.io/_uploads/H1G70Iuha.png)


Flags 
PE -> Using ICMP echo 
sn -> Ping scan - Disable Port Scan 

```
nmap -PE -sn TARGET 
```

![圖片](https://hackmd.io/_uploads/Bk8Lbwd2p.png)
![圖片](https://hackmd.io/_uploads/ry_2zv_3T.png)

### ICMP timestamp Request (Bypass default firewall)

When Default default ICMP echo request(type 8) are blocked by firewalls, ICMP timestamp requests (type: 13) can be employed for discovering alive machines.

ICMP timestamp reqeust (type:13)
ICMp timestamp reply   (type:14)

![圖片](https://hackmd.io/_uploads/rJ-nZv_36.png)

```
nmap -PP -sn 10.10.68.220/24
```

![圖片](https://hackmd.io/_uploads/Skj1FwO3T.png)

10.10.68.133, 10.10.68.134 are new machines.

![圖片](https://hackmd.io/_uploads/HJeoGvOnT.png)


### ICMP Address Mask require

ICMP type 17 -> Address Mask require 
ICMP type 18 -> Address Mask reply

![圖片](https://hackmd.io/_uploads/SJu3IDdh6.png)

flags

PM: Ping address mask 
```
sudo nmap -PM -sn 10.10.68.220/24
```

![圖片](https://hackmd.io/_uploads/SJKwvwOnT.png)

According previous result, we can know that have four host is live at least but the result return 0 hosts up, we can infer target network segmentation have firewall rules block our Address mask request. 

![圖片](https://hackmd.io/_uploads/ryAVOPunT.png)


### LAB ICMP discover alive host

![圖片](https://hackmd.io/_uploads/ryp7Kvu2T.png)

Solved!!

## TCP/UDP alive host Discovery 

If you are not privilege user, Namp will attempt a three-way handshake for TCP-base host discovery. 


### TCP - Syn ping

Sending only a SYN packet is a common method for TCP host discovery.

![圖片](https://hackmd.io/_uploads/rkw_cD_hT.png)


Attacker -> connect to target's port 80
![圖片](https://hackmd.io/_uploads/rkKOjDOhp.png)

![圖片](https://hackmd.io/_uploads/B1y2ovdnT.png)

---

Specify the Port Scope 

```
nmap -PS80,442,8080 -sn 10.10.68.220/24
```

![圖片](https://hackmd.io/_uploads/rkbU2POn6.png)

```
nmap -PS20-25 -sn 10.10.68.220/24
```

![圖片](https://hackmd.io/_uploads/r1GXRPu3a.png)

### TCP - ACK ping(-sn)

Send only Ack packet trigger unexpected behavior and is useful for host discovery.

![圖片](https://hackmd.io/_uploads/By0d6wu2T.png)


Flags 
PA : Only send ACK packet  (ping ACK)


```
nmap -PA -sn 10.10.68.220/24
```

![圖片](https://hackmd.io/_uploads/BkeZuCPunT.png)

![圖片](https://hackmd.io/_uploads/r1WoRDdnp.png)


### UDP ping 


UDP ping involves sending the UPD packet and inferring the target aliveness base on the reply message(ICMP). 

![圖片](https://hackmd.io/_uploads/S1QWOsO2p.png)

![圖片](https://hackmd.io/_uploads/Bk-R1u_hT.png)
According reply message -> we can infer that the target is alive.

```
nmap -PU -sn 10.10.68.220/24
```

![圖片](https://hackmd.io/_uploads/BJNPeOu3T.png)

![圖片](https://hackmd.io/_uploads/BkK7l_u2T.png)


### Masscan (Another Tools)

Masscan is more aggressive tools for network scanning and can be used for quick scan.

```
apt install masscan.

masscan MACHINE_IP/24 -p443
masscan MACHINE_IP/24 -p80,443
masscan MACHINE_IP/24 -p22-25
masscan MACHINE_IP/24 ‐‐top-ports 100
```

### LAB TCP/UPD Discover host 

![圖片](https://hackmd.io/_uploads/H12mWOu26.png)

Solved !!

## Reverse-DNS lookup 

Utilizing Reverse DNS lookup can provide more information to an attacker

Even If the host is down, the -R option can add ed to query DNS server to obtain the hostname of offline host 

Additionally. a DNS server can be specified using the `--dns-servers DNS_SERVER` option.


### LAB - Reverse DNS lookup
![圖片](https://hackmd.io/_uploads/B15YzOd3T.png)

Solved 

### Summary 

![圖片](https://hackmd.io/_uploads/ry2pfdOhp.png)



# Port Scanning 

- TCP connect port scan 
- TCP syn port scan 
- UDP port scan



When the target's firewall is up, , the absent of response (sliently to drop the pacekt) prevent us to receiving a banner from the target.



Namp can categorize port into Six state (If the port is unreachable -> it won't display in result)

**Open**: A server listen on port and is not blocked by firewall rules. 

![圖片](https://hackmd.io/_uploads/ryM7duK2p.png)

**Close**: Not server listen on port but (the port is open !!) and not blocked by firewall rules.

![圖片](https://hackmd.io/_uploads/Hyl2V9F2p.png)



**Filtered**: the probe can not archive the target host. we can't determine the port is open or close 

![圖片](https://hackmd.io/_uploads/S1FeE5Fha.png)


**Unfilted**:  Nmap cannot determine if the port is open or closed, although the port is accessible.(This state occur when we Mapping the firewall rule via the ACK scanning)


![圖片](https://hackmd.io/_uploads/S1FXW9u2p.png)


**Open | filtered**: Open or filtered 



![圖片](https://hackmd.io/_uploads/S1N-vutnp.png)


**close | filtered**: Close or filtered




### LAB - UPD/TCP Port 

![圖片](https://hackmd.io/_uploads/BJRXhdOna.png)

Solved!!

## TCP flags 

RPC 793 https://datatracker.ietf.org/doc/html/rfc793.html#section-3.1


TCP flags play a crucial role in the communication between devices over a TCP connection. Each flag in the TCP header serves a specific purpose.

TCP format and flags

![圖片](https://hackmd.io/_uploads/B1JGAu_3p.png)

URG -> Urgent pointer indicate the incoming data is urgent, it can ignore to wait previous TCP segment. 

ACK -> Acknowledgement 

PSH -> push buffer data to application promptly

**RST -> The Reset packet with the RST flag can be used to terminate a TCP connection abruptly. Situations where no server or server didn't know how to handle the request may trigger the use of this flag**

SYN -> Synchronize sequence numbers 

FIN -> Finishing Connection!

### LAB - TCP flags 

![圖片](https://hackmd.io/_uploads/By0xf5_ha.png)

Solved!!


## TCP - Connection Scan (sT)

If we are not privileged users, the TCP connection scan (sT) is the only option available. 

Port is Open 

![圖片](https://hackmd.io/_uploads/HyQwmqd3T.png)

![圖片](https://hackmd.io/_uploads/HJCs4qO26.png)

Port is close(Port is accessible but no server run )

![圖片](https://hackmd.io/_uploads/S1UWE9On6.png)

![圖片](https://hackmd.io/_uploads/BJhBE5d26.png)

Tearing TCP connection 
![圖片](https://hackmd.io/_uploads/B1OC49O2p.png)

Usage 

sT: TCP connection SCAN
Default -> Scan 1000 common port 
F: 1000 common port -> 100 common port
r: to scan the ports in consecutive order -> 1,2,3,4,5,6,7,8,9
```
nmap -sT 10.10.120.184

or

nmap -sT -F 10.10.120.184

or 
nmap -sT -r 10.10.120.184
```

![圖片](https://hackmd.io/_uploads/BJ6wU9d2T.png)


### LAB-TCP connection Scan (sT)

Previous Scan result!

![圖片](https://hackmd.io/_uploads/HJBFLc_2p.png)

![圖片](https://hackmd.io/_uploads/B1M6UquhT.png)

Solved !!

## TCP SYN Scan (sS)

Syn scan is Default scan mode and require privilege permission (Root)
![圖片](https://hackmd.io/_uploads/S1llOqOha.png)

As the scan does not establish a full TCP connection,  it tends to be more stealthy, reducing the chances of detection. 

**Due the the lack of TCP connection establishment, the service info may be not reliable**


![圖片](https://hackmd.io/_uploads/rJ2ut9una.png)

Port is close
![圖片](https://hackmd.io/_uploads/B1W0tcuna.png)


Usage 
```
sudo nmap -sS 10.10.177.213
```

![圖片](https://hackmd.io/_uploads/S1sLKWo2p.png)


### LAB TCP SYN Scan (sS)



Previous Scan Result

![圖片](https://hackmd.io/_uploads/rkjTc5dha.png)




Solved!!

## UDP Scan 

UDP is connectionless protocol, we can't guarantee receiving the response form the UPD service 

Open(reply), Open | filtered (Be blocked, Not reply )
![圖片](https://hackmd.io/_uploads/S1QWOsO2p.png)


Port is close 
![圖片](https://hackmd.io/_uploads/Bk-R1u_hT.png)

ICMP type 3 Destination unreachable!(Port unreachable)


```
nmap -sU -F -v 10.10.155.68
```

![圖片](https://hackmd.io/_uploads/H1UQsj_nT.png)

```
nmap -sU 10.10.155.68
```
![圖片](https://hackmd.io/_uploads/S1o3ecthp.png)

### LAB - UDP Scanning

Previous Scan Result 
![圖片](https://hackmd.io/_uploads/r1ZpYs_hT.png)


![圖片](https://hackmd.io/_uploads/H10Ljidna.png)

Solved

## Port Scope/Scan Speed and Performance

### Port Scope 

Port list 
`-p80,443,8080`

Port Range 
`-p20-23`

Scan All Port 
`-p-`

### Scan common port 

F: Scan 100 common port 

--top-ports NUMBER_PORT

### Scan Speed 


**Set timing template**

`-T0~5`

- paranoid (0)  (slowest)
- sneaky (1)
- polite (2)
- normal (3)     (Default)
- aggressive (4) (Using in CTF )
- insane (5)    (fastest)

For avoiding the IDS detection, we can chose the T0 or T1

TO mode is scan one port at one time and wait 5 minute between send a probe 

T1 -> T1 mode is suitable for real-world testing.
T5 -> T5 mode is the fastest but may result in packet loss. (Affect the Result correctly).


**Packet per second**

Use these options for control over packet speed.

```
--min-rate PACKET_PER_SECOND
--max-rate PACKET_PER_SECOND
```

### Multiple Probes

Multiple threading
Use multiple threads for faster scanning.

```
--min-parallelism THREADS_PROBE
--max-parallelism THREADS_PROBE
```

### LAB - Port Scope/Scan Speed and Performance

![圖片](https://hackmd.io/_uploads/rJMuN_K3T.png)

Solved !!

## Summary (cheat sheet) Basic 上

![圖片](https://hackmd.io/_uploads/H1fsVdY2a.png)


---


## Null, FIN, Xmas Scan (Bypass stateless firewall ) 

These type of scans are efficient for bypassing stateless firewall.

By Using a flag combination that do not match the SYN packet,it become it possible to bypass the firewall and reach the system behind it.

>Stateless fire only check the specific packet's features and do not to analysis packet behavior. e.g. packet Src, dst, flags... (Those Features are defined by developer)

### Null Scan (sN) 

Null scan -> TCP flags are set to zero 

Due to no flags, the server will didn't reply the response 


#### Port: Open | filtered 

Null scan relies on the leak of response to infer that the port is not close 

![圖片](https://hackmd.io/_uploads/HykFqEV6a.png)

#### Port: Close 

![圖片](https://hackmd.io/_uploads/ByG9q4NTa.png)

#### Usage 
```
nmap -sN 10.10.233.164 -T4
```
![圖片](https://hackmd.io/_uploads/rkWhL9F3T.png)


### FIN Scan (sF)


#### Port : Open | filtered 
![圖片](https://hackmd.io/_uploads/SkX3qEE6a.png)

#### Port : Close 

![圖片](https://hackmd.io/_uploads/Sysp54NaT.png)

```
nmap -sF 10.10.233.164 -T4
```
![圖片](https://hackmd.io/_uploads/ByMKcct26.png)


### Xmas (sX) FIN PSH URG

#### Port : Open |filtered 

![圖片](https://hackmd.io/_uploads/H1MJjE4Tp.png)


#### Port : Close 

![圖片](https://hackmd.io/_uploads/BJVgsVEpT.png)

#### Usage 

![圖片](https://hackmd.io/_uploads/Hk4V2cKnT.png)



### LAB NULL, FIN, Xmas Scan 

![圖片](https://hackmd.io/_uploads/SkAtejK3T.png)

Solved 


## Maimon Scan (sM) FIN/ACK 

![圖片](https://hackmd.io/_uploads/BJqKXstnT.png)

I think is can be used to discover the firewall Rule setting

If we didn't receive the RST ACK -> we can refer that the target may have firewall to drop the packet.

```
sudo nmap -sM 10.10.252.27 -T4
```
![圖片](https://hackmd.io/_uploads/BJt3QoY3p.png)



### LAB Mimon Scan 

![圖片](https://hackmd.io/_uploads/S1fyVoK2T.png)


## ACK, Window(Mapping the Firewall rules), Customer Scan 


ACK, Window Scan typically use for mapping firewall rules, and not necessary discover whether servier is actively listening on a port


### ACK scan (sA) - Identify the firewall rule configuration 


#### Firewall Down 

![圖片](https://hackmd.io/_uploads/rJ59UjtnT.png)

![圖片](https://hackmd.io/_uploads/SJzDuiYna.png)

---

#### Firewall UP


![圖片](https://hackmd.io/_uploads/ByBUYot26.png)


![圖片](https://hackmd.io/_uploads/HkXzdiFn6.png)


### Window Scan 

Windows scan examines the TCP Window field of the RST packets returned. On specific systems, this can reveal whether the port is open. 


Window Scan is similar to the Ack Scan and is a good way to map the target firewall rule configuration.

#### Case: No firewall  

![圖片](https://hackmd.io/_uploads/Hyvhl0FnT.png)

#### Case: Firewall UP

![圖片](https://hackmd.io/_uploads/r1kDbCY26.png)


#### Usage

```
nmap -sW 10.10.233.164 -T4
```

![圖片](https://hackmd.io/_uploads/rkEazAt3a.png)



### Customer Scan 

Customer setting tcp flag

```
--scanflags RSTSYNFIN
```
RST = 1
SYN = 1 
FIN = 1


### LAB - ACK, Window, Customer Scan 

```
nmap -sA  10.10.89.2 -T4
```

![圖片](https://hackmd.io/_uploads/Sye4KRKnT.png)

![圖片](https://hackmd.io/_uploads/BJTm50Fna.png)

![圖片](https://hackmd.io/_uploads/SkXr90Yn6.png)

Solved !!

## Spoofing(Same network segment), Decoy Scan(Useful)



### Spoofing Scan 

Spoofing Scan works in specific network environments where the attacker can monitor the traffic.


![圖片](https://hackmd.io/_uploads/Hy8May93p.png)

```
nmap -sS -S SPOOFED_IP TARGETMACHINE
```

In general using, we need to specify the interface where the network segment is the same as the target machine (-e) and disable ping scan (-Pn).

```
nmap -sS -e NET_INTERFACE -Pn -S SPOOFED_IP TARGET_IP
```

### Decoy Scan (Stealth Techniques)
 
 
Decoy Scan allow the attacker to make it harder for defender to identify the attacker machine.


![圖片](https://hackmd.io/_uploads/H1OVgeqhT.png)

Usage:

If attacker ip is 10.66.45.69
```
nmap -sS -D 10.10.1.1,23.12.32.22,ME,RND,RND TARGET_MACHINE
```
Scan sequence -> 10.10.1.1 -> 23.12.32.22 -> 12.66.45.69 -> 71.23.12.23 -> 192.168.3.2


### LAB - Spoofing & Decoy Scan 


![圖片](https://hackmd.io/_uploads/rkitXlqn6.png)

Solved 

## Fragment Packet (Bypass IDS/Firewall)

Firewalls (software/hardware) typically check the IP and TCP headers. More advanced firewalls may also check the carried data.

IDS check packet behavior and features. Once the traffic matches the features of malicious traffic, an alert is raised.


### Fragment packet 


We can attempt to split packet into multiple segment to bypass IDS or firewalls.

Nmap provide the -f option to fragment packets

According to RFC-791, the TCP header is typically 20 bytes (24 bytes with options). By fragmenting the packet, we can bypass firewall rules or IDS.


![圖片](https://hackmd.io/_uploads/r1YR3e5nT.png)

![圖片](https://hackmd.io/_uploads/r1JqXysnT.png)



```
 nmap -sS -p80 10.20.30.144 -f 
```



Port 80 Analysis 

Normal Case (No fragment)
![圖片](https://hackmd.io/_uploads/By6M8ys3T.png)


Fragment Case

![圖片](https://hackmd.io/_uploads/ByxoU1i2T.png)


Customer the packet size -> we can increase the packet size to make look like innocuous.

```
--data-length NUM
```

### LAB Fragment Packet 

![圖片](https://hackmd.io/_uploads/SkDSPyona.png)


## Zombie(Idle) Scan (Stealth Techniques)

Zombie scan allows scanning stealthily without exposing our IP or identity.

It upgrades the spoofing scan to use a zombie machine for communication.


Nmap checks the (ip.id) value to determine if the port is open, close, filtered. 

![圖片](https://hackmd.io/_uploads/BynOhks36.png)

### Connect to Zombie Machine to Record ip.id Value

![圖片](https://hackmd.io/_uploads/HyGULgshT.png)

### Port: Open 

![圖片](https://hackmd.io/_uploads/Sy0u01j3a.png)

### Port: Close

![圖片](https://hackmd.io/_uploads/SJs-4gsha.png)


### Port: filtered 

![Uploading file..._5idd28jl4]()

### Comparing the (ip.id) value to determine the port is open or close 

![圖片](https://hackmd.io/_uploads/S1Jt8xi2a.png)


### Usage 

```
nmap -sI ZOMBIE_IP MACHINE_IP
```

### LAB Zombie scan 

![圖片](https://hackmd.io/_uploads/HkIOwes2T.png)

## More information 

### Reason (Recommend !!)

We can require Nmap to provide the reason and inference of the scan result.

```
 sudo nmap -sS --reason 10.10.252.27
```

![圖片](https://hackmd.io/_uploads/SJ2iYes3a.png)

Adding the reason provides more clarity about the scan results.

### More Information 


v -> Verbose Information 

vv


d -> debug 

dd -> Debug max 


### LAB- More information 

![圖片](https://hackmd.io/_uploads/H17ysejnT.png)

![圖片](https://hackmd.io/_uploads/HkMMjgs36.png)


## Summary 下

![圖片](https://hackmd.io/_uploads/B1HNigjnp.png)

![圖片](https://hackmd.io/_uploads/HyeBolonT.png)


# Post Port Scan 



## Service Detection (sV)

Once we discover open port, the next steps is to investigate further and identify the running service and potential vulnerability.


```
nmap -sT -sV --version-intensity 0~9 TARGE_IP -T4 
```
0 -> (lightest)
0 -> (complete)


Service detection requires establishing a TCP connection to retrieve the service's banner.


Usage

```
nmap -sT -sV 10.10.139.233 -T4 --reason
```


### LAB Identify Service 

![圖片](https://hackmd.io/_uploads/SJMh9Zi2p.png)


![圖片](https://hackmd.io/_uploads/rkGPibih6.png)

![圖片](https://hackmd.io/_uploads/B1Lvo-on6.png)

Solved !!


## OS Detection & Traceroute 


### OS Detection 


Nmap can detect the OS type and version based on the reply packet.


OS type is usually detected correctly, but kernel version may not be reliable due to virtualization techniques.
Usage 


```
nmap -sS -O 10.10.139.233
```

![圖片](https://hackmd.io/_uploads/H1CWRWjna.png)


### Traceroute 

```
nmap -sS --traceroute 10.10.139.233
```

![圖片](https://hackmd.io/_uploads/ByPaRZshp.png)

### LAB - OS detection 


![圖片](https://hackmd.io/_uploads/r1nmZziha.png)

Solved 


## Nmap Script engine (NSE - lua Language)

The Nmap Script Engine (NSE) uses Lua, an interpreted language. The default scripts are located in the directory:

```
/usr/share/nmap/scripts
```

![圖片](https://hackmd.io/_uploads/H13-b4o3a.png)

Addictional script can be download from the internet.

If we didn't know .nse functionality, we can use less or text editor to lookup  

![圖片](https://hackmd.io/_uploads/BJflfNs3T.png)


### Specify the script we want to use 

```
nmap --script=default
```


### Script Categories 

![圖片](https://hackmd.io/_uploads/BkeJr0Qohp.png)

Notice!: Some intrusive script may lead to service crash. 


```
nmap -sS -sC 10.10.58.136
```

![圖片](https://hackmd.io/_uploads/HySXl4jnp.png)



![圖片](https://hackmd.io/_uploads/ry5pxVsna.png)


![圖片](https://hackmd.io/_uploads/SyfFlEs2T.png)


### LAB- Nmap Script 


![圖片](https://hackmd.io/_uploads/B1oIzEon6.png)

![圖片](https://hackmd.io/_uploads/Sy69zNonT.png)

![圖片](https://hackmd.io/_uploads/BJElX4ih6.png)

![圖片](https://hackmd.io/_uploads/HyUHQEjna.png)

![圖片](https://hackmd.io/_uploads/BJk-DEj3T.png)

![圖片](https://hackmd.io/_uploads/Hko6L4o3T.png)

![圖片](https://hackmd.io/_uploads/rJYvDEshp.png)

Solved !

## Output The Result 

Save the scan result in a file. !

### Normal (-oN)

```
nmap -sT 10.10.50.162 -T4 -oN 10.10.50.162.nmap
```

![圖片](https://hackmd.io/_uploads/rJ66FVjnT.png)


### Grepable (It's Suitable when the report have multiple machines )

```
nmap -sT 10.10.50.162 -T4 -oG 10.10.50.162.gnmap

```

![圖片](https://hackmd.io/_uploads/HJeWo4snT.png)


![圖片](https://hackmd.io/_uploads/ByNysNj3T.png)

### XML form

![圖片](https://hackmd.io/_uploads/SJoGn4jha.png)


```
nmap -sS 127.0.0.1 -oS FILENAME
```

### LAB - Output Result 

Scan report contain many machine -> gmap + grep 

![圖片](https://hackmd.io/_uploads/SyPg04ihT.png)

![圖片](https://hackmd.io/_uploads/BJNvAEsha.png)

![圖片](https://hackmd.io/_uploads/r1UdA4j3a.png)

Solved !!

## Summary 

![圖片](https://hackmd.io/_uploads/BkocRVj3p.png)
