5 ms·

This is a really interesting topic, but as a newbie I would love a little more detail. For example, with the nmap command, why did they use those particular swi

This is a really interesting topic, but as a newbie I would love a little more detail. For example, with the nmap command, why did they use those particular switches? >nmap -Pn -sT -p- --min-rate 10000 \ -oN nmap/tcp_ports_scan I understand that nmap is a very versatile port scanning program, and I haven't used it since I was a kid, but I have no idea what about this particular situation calls for -Pn -sT -p- -oN. Is that an ideal configuration to use when you're scanning a target that you know nothing about?

bombcar 5y ago
See the other post above but https://nmap.org/book/scan-methods-udp-scan.html https://nmap.org/book/scan-methods-udp-scan.html would be a good place to start.
phantomread 5y ago
I realize documentation is only half the battle but I get a lot from using something like explainshell when I see unknown argument lists: https://explainshell.com/explain?cmd=nmap+-Pn+-sT+-p-+--min-rate+10000+-oN+nmap%2Ftcp_ports_scan https://explainshell.com/explain?cmd=nmap+-Pn+-sT+-p-+--min-... This way you can read the full command sort of like a custom pamphlet. To your point, more context beyond the manpage is always helpful.
- braingenious 5y ago
  What a cool website! Thanks!
mr_mitm 5y ago
The answer below mentioning explainshell.com doesn't explain the `-Pn` parameter. This one makes nmap skip host discovery and immediately start the port scan. The developer of nmap discourages using this parameter: https://twitter.com/bonsaiviking/status/1286024550241767426 https://twitter.com/bonsaiviking/status/1286024550241767426 Only if you know the host is alive and at the same time does not want to be seen, then it may make sense to use it, otherwise it messes with nmap's rate calibration. The website also doesn't really explain why those switches were chosen. And it's not clear to me either: unless you lack permissions or you find yourself in some other special circumstances, `-sS` is superior over `-sT` (as the man page explains). The latter creates a full TCP connection, while the former sends only a SYN packet and waits for the response: SYN-ACK means port open, RST means port closed. Then it moves on, leaving the half-opened connection dangling. `--min-rate` was chosen to increase speed, but it comes at the cost of accuracy. `-T4` is the better switch to increase speed. See the man page for details.

bombcar 5y ago

See the other post above but https://nmap.org/book/scan-methods-udp-scan.html https://nmap.org/book/scan-methods-udp-scan.html would be a good place to start.

phantomread 5y ago

I realize documentation is only half the battle but I get a lot from using something like explainshell when I see unknown argument lists: https://explainshell.com/explain?cmd=nmap+-Pn+-sT+-p-+--min-rate+10000+-oN+nmap%2Ftcp_ports_scan https://explainshell.com/explain?cmd=nmap+-Pn+-sT+-p-+--min-... This way you can read the full command sort of like a custom pamphlet. To your point, more context beyond the manpage is always helpful.

braingenious 5y ago
What a cool website! Thanks!

mr_mitm 5y ago

The answer below mentioning explainshell.com doesn't explain the `-Pn` parameter. This one makes nmap skip host discovery and immediately start the port scan. The developer of nmap discourages using this parameter: https://twitter.com/bonsaiviking/status/1286024550241767426 https://twitter.com/bonsaiviking/status/1286024550241767426 Only if you know the host is alive and at the same time does not want to be seen, then it may make sense to use it, otherwise it messes with nmap's rate calibration. The website also doesn't really explain why those switches were chosen. And it's not clear to me either: unless you lack permissions or you find yourself in some other special circumstances, `-sS` is superior over `-sT` (as the man page explains). The latter creates a full TCP connection, while the former sends only a SYN packet and waits for the response: SYN-ACK means port open, RST means port closed. Then it moves on, leaving the half-opened connection dangling. `--min-rate` was chosen to increase speed, but it comes at the cost of accuracy. `-T4` is the better switch to increase speed. See the man page for details.