Lab Objective:
Learn how to use the nmap command and its switches.
Lab Purpose:
Nmap is short for network mapper. It is a free and open-source security scanner that (among many other things) can discover hosts and services on a network and build a map from this information. It can spoof, masking its true identity and finding vulnerabilities on a host or entire network.
Lab Tool:
Ubuntu running in VirtualBox
Lab Topology:
Please use the following topology to complete this lab exercise. I used a virtual Ubuntu PC running inside VirtualBox, but if you are using Windows, you can use your home PC. Just check your firewall settings don’t block the test. For VirtualBox, I had to set all my network adapters to ‘Bridged’ so they can communicate and connect to my home router and devices.
You can download Nmap from nmap.org.
Lab Walkthrough:
Task 1:
Pull up a command prompt by typing ‘terminal’ into the search box (if you are using Ubuntu).
Task 2:
At the command prompt, issue the nmap command. Check your study guide for more information on all the available switches. For Ubuntu, it may not be installed, so you will be prompted to download it via the sudo apt install nmap command.
Task 3:
Issue an nmap command again and examine the available switches and options.
Task 4:
I’m running this in VirtualBox, so I’ve activated a Windows 10 PC because I want to scan my virtual network for any devices. If you are using this on your home PC, you should be able to use it and find any devices that are using it. DO NOT use this tool on a privately owned network.
Task 5:
There are so many options, but run a test using nmap -sn -v, which is a ping scan and verbose output. I’ll scan my home network range; yours may well differ, so input your own range. I’ve already noted down the IP addresses of my machines, so I know which is which.
Task 6:
Issue another nmap command. This time we want to determine the OS running on the machines (-O), probe the open ports (-sV), and treat all the hosts as being up (-Pn). You may need to run this command as ‘sudo’ if you are using Ubuntu, so it’s sudo nmap -Pn -O -sV 192.168.1.14, which is my home Windows PC.
Task 7:
The Nmap project has provided an online site for you to scan, which overcomes the illegality of scanning a privately held server. You can find it at scanme.nmap.org. They request fair use, so no 100 attacks per day or brute force attacks, please! We will stick to -A, which is OS detection, version, script scan, and traceroute.
The site was usually unavailable when I tried this, and when it finally worked, it wouldn’t return the OS details. Here is a screenshot courtesy of Nmap.
Source – https://nmap.org/6/
Task 8:
If you prefer a GUI for Nmap, you can use Zenmap, available at nmap.org/zenmap. It does the same thing but is user-friendly.
Notes:
It would take a few weeks to learn all the features of this command. This is a gentle introduction.
