18 ms·
What is NMAP and how to use it? (2020)
- blueflow 4y agoIn addition to `nmap -h` you might also use `man nmap` for more extensive list of arguments. Take note, doing unwarranted nmap scans is considered network abuse. Doing it from your VPS might (depending on the hosters TOS) get your contract terminated.
- Topgamer7 4y ago> `nmap -h` you might also use `man nmap` I wish linux man pages had more example sections. TBH I reach for `tldr nmap` or `tldr ...` first in most cases.
- deleted 4y ago[deleted]
- justeleblanc 4y agoI hadn't heard of tldr. Looks neat! Here's a link for other people who didn't know: https://github.com/tldr-pages/tldr https://github.com/tldr-pages/tldr
- sublinear 4y agohttps://tldr.inbrowser.app/ https://tldr.inbrowser.app/
- CyberKimura 4y agoWas unaware of this tool, awesome.
- cmdialog 4y agoYeah it's such an old meme to say "Just read the man page" but there are a non-zero amount of completely useless man pages and tldr is a great alternative.
- waihtis 4y ago> Take note, doing unwarranted nmap scans is considered network abuse. Doing it from your VPS might (depending on the hosters TOS) get your contract terminated. For live practice, you should scan IP addresses in countries that are unlikely to be able to prosecute you, like Russia (if you are a westener)* * joking (maybe)
- Keejazz 4y agoI would suggest instead, if one really is interested in the topic of networking and port scanning, to set up a lab environment, either virtually, or physically. This is not very costly, unless you need to scan specific enterprise systems that can not be emulated, and are beyond ones price range - to buy to learn. There are also platforms like tryhackme, hackthebox etc., that offer both free and paid networks, on which one can legally scan.
- waihtis 4y ago> This is not very costly, unless you need to scan specific enterprise systems that can not be emulated, and are beyond ones price range - to buy to learn. This is where my advice comes in handy :)
- 0xdeadbeefbabe 4y ago> Take note, doing unwarranted nmap scans is considered network abuse. Doing it from your VPS might (depending on the hosters TOS) get your contract terminated. Makes you more excited to read the man page doesn't it?
- bheadmaster 4y agoInteresting note. I wonder where's the cutoff - when exactly does "opening connections" become "abusing the network" - two connections? Two dozen? A thousand? I always assumed network data is network data. I don't see the difference between sending millions of packets of data to stream a video and to scan a network. The only difference is the intention - does that mean the act of learning someone's open ports is what's considered abuse? Or is it consent - the fact that you're learning about open ports that the server owner doesn't want you to know about?
- electroly 4y agoThe AWS Acceptable Use Policy is at https://aws.amazon.com/aup/ https://aws.amazon.com/aup/ and other providers will have similar. > You may not use, or facilitate or allow others to use, the Services or the AWS Site ... to violate the security, integrity, or availability of any user, network, computer or communications system, software application, or network or computing device; There's no cutoff because it's not about the number of connections; you could conceivably violate this policy with a single connection, and you could be in compliance with a million connections. Note the term "unwarranted" in OP's post.
- bheadmaster 4y agoWhat exactly defines an "unwarranted" connection? Assume we're not talking about nmap (since it's widely known as a hacker tool which may muddy the waters), but instead of a user-written program that e.g. checks for open ports. If a port is open to the public internet, what exactly makes a connection to it "unwarranted"? As for the AWS rule, scanning open ports does not violate, by itself, any of those things.
- sjsdaiuasgdia 4y agoI have no idea how AWS defines it, but to my mind it's about two things: intent and impact. Intent: What is the connection's purpose? To use a service, to map a topology, to identify potentially vulnerable targets, to consume resources? Impact: How does the act of connecting (once or many times) affect the remote end of the connection? Is a critical resource being exhausted (network connections, cpu, memory, etc)? Is the remote end's service still available for its intended purpose? There's no magic spot on the scales but the further you get away from "to use the service" on the Intent scale and "no detectable impact" on the Impact scale, the more trouble you're likely to run into.
- matheusmoreira 4y ago> doing unwarranted nmap scans is considered network abuse Why?
- zamadatix 4y agoYou'll often trip security/abuse systems since the traffic looks (and in many cases - is) the same as abusive traffic. If you go and trip those unannounced then there is usually even less sympathy to exclude you than if you ask if they can be bothered to exclude you before you go and start scanning.
- matheusmoreira 4y agoIt's just network connections. Why would they make a computer accessible to me if they don't want me connecting to it?
- zamadatix 4y agoThere are two "they"s involved in the conversation but generally when using someone else's stuff the more apt question is "why should I have an expectation I can use their stuff however I want without limit". For the "they" of your provider, who is held accountable for allowing abusive traffic, the goal is to provide you outbound connectivity but to do that they also need to ensure they don't get de-peered or their network ranges blocked for hosting abusive traffic. Even for things which don't transit a 4th party there is negative incentive to let your customers abuse each other just because the addresses are reachable. This almost always results in automated systems with limited incentive for good uses of port scanning to be allowed. For the "they" of the end system is (most likely) they didn't make the entire system available to you, just some select services for use in a certain way (e.g. loading their website). Doing that does not provide them an obligation to continuously allow all traffic received at the address to be processed and it's very likely they'll just block you entirely as another layer of defense.
- addingnumbers 4y agoThe alerts tend to be geared more toward attempts to reach a secured system that isn't accessible to you.
- krylon 4y agoYears ago, I wrote a primitive portscanner that was deliberately slow to avoid upsetting anyone. It would store hosts and results for scanned ports in a database (it was my toy project for learning SQL) and make sure to only connect to any given host once in a predefined period. Fun times.
- teddyh 4y ago> Take note, doing unwarranted nmap scans is considered network abuse. By whom? I disagree; using nmap is more akin to, say, standing outside a building (on public property) and taking (or painting) a picture of the building. Yes, some people have gotten in trouble for that. Should they, though?
- wongarsu 4y agoYou could also say it's like going to a large apartment building and ringing all the doorbells to see who's there. And (depending on the nmap flags we're talking about) then profiling their voice on the intercom to figure out what kind of people live in each apartment.
- teddyh 4y agoPerhaps. Ought that be illegal?
- mcny 4y ago> Perhaps. Ought that be illegal? I can't really explain why but I think there is a difference between doing something manually and automating it. For example, it is perfectly ok for a police officer to sit behind the bushes in front of someone's front porch with a pair of binoculars but not ok to put a hidden camera 24/7 in front of everyone's front porch.
- teddyh 4y agoWe were (by way of analogy) discussing running nmap manually, I believe.
- rikthevik 4y ago> doing unwarranted nmap scans is considered network abuse After almost being physically ejected from a secure data centre because a member of my group used nmap to see if a port was open, I recommend starting with telnet. :) A wide nmap is probably going to trigger an IDS, and then you get to meet interesting people and answer interesting questions.
- nocsi 4y agoThere’s something wrong with your org if nmap scans trigger alerts/bring down machines. There’s so many rogue devices scanning networks nowadays that’d I’d be surprised if anyone had port scanning enabled in the filters to minimize false positives.
- flangola7 4y agoGPT is great at driving nmap
- uuddlrlrbaba 4y agoWhy is this being downvoted? could you expand on what you mean
- itslennysfault 4y agoNot OP, but you can ask ChatGPT in plain language for a command to scan a server or network for certain things and it can generate you those commands in seconds
- LittleShaman 4y agoWhy not just google it? Theres always a blog or stackoverflow question to copy snippets from. What keeps me away is that unless youre already familiar with a topic you wont catch errors. The command it suggests might not do exactly what you wanted.
- ParetoOptimal 4y ago> Why not just google it? Theres always a blog or stackoverflow question to copy snippets from. I don't get these questions. 20s vs 2m is meaningful in a problem of 10 steps. > What keeps me away is that unless youre already familiar with a topic you wont catch errors True, but often the cost of errors is very low and feedback instant. > The command it suggests might not do exactly what you wanted. An example is it gave me `make --with-out-foo` when I needed `--without-foo`. I simply removed the `-` and went on my way after seeing the error.
- LittleShaman 4y agoErrors like suggesting incompatible combinations of parameters or hallucinated non-existant params you will easily catch once you try them. But what about more subtle conceptual misunderstandings? I meant cases like asking how to X and ChatGPT suggesting something similar (and valid) but not what I wanted. Or imagine silent failures like an additional switch that happens to exclude what you wanted. Not an issue if youre just automating grunt work you know to do yourself of course. But I'm interested in when you arent familiar with a tool.
- nubb 4y agofor those interested in this also check out massscan for another port scan tool.
- thewataccount 4y agoAlso zmap. Does anyone know how masscan/zmap compare?
- itslennysfault 4y agoFor those of you on a mac -sp becomes -sn in the first example nmap -sn 192.168.1.1/24
- jmholla 4y agoThat's actually the case for everyone running a modern version of nmap. See yrro's comment. [0] [0]: https://news.ycombinator.com/item?id=35571374 https://news.ycombinator.com/item?id=35571374
- yrro 4y agoTypo in the first example. $ nmap -sp 127.0.0.1/32 Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-14 19:26 UTC Could not parse as a prefix nor find as a vendor substring the given --spoof-mac argument: 127.0.0.1/32. If you are giving hex digits, there must be an even number of them. QUITTING! should be -sP (which is actaully a deprecated alias for the current -sn option). o Switched to -Pn and -sn and as the preferred syntax for skipping ping scan and skipping port scan, respectively. Previously the -PN and -sP options were recommended. This establishes a more regular syntax for some options that disable phases of a scan: + -n no reverse DNS + -Pn no host discovery + -sn no port scan We also felt that the old -sP ("ping scan") option was a bit misleading because current versions of Nmap can go much further (including -sC and --traceroute) even with port scans disabled. We will retain support for the previous option names for the foreseeable future.
- zitterbewegung 4y agoBefore I started using wireguard I would install nmap and figure out which computer I needed to remote into for my local network.
- mabbo 4y ago`nmap` was so much fun when I first played with it back in 2004 or so as a 17 year old. I remember reading my own IP address, then wondering "I wonder what the neighbours are like?". So I scanned a range of similar IPs. One of them had port 80 accepting connections. "A website? Hosted on Bell internet?" I opened up my browser and went to that IP directly. "Tim Hortons 2402 - Camera Control". It required a password (which I never guessed, sadly). These kinds of weird adventures were a lot of fun.
- maldev 4y agoSuper noob trap, which this article doesn't address. If you want to scan every port, do -p-. Which alot of the times you do want to scan every port. By default it only scans common ports. You can also do -p50- to scan 50+ or -p-50 to scan 0-50. You can find alot on non common ports, and if you're running a port scan, you should use it. Sad the article doesn't mention this.
- m4jor 4y agosince -p- can take a while, you can also speed it up with --min-rate=2000
- Brajeshwar 4y agoThe mandatory Matrix hacking scene mention - Trinity uses NMAP? Here is a video https://www.youtube.com/watch?v=0PxTAn4g20U https://www.youtube.com/watch?v=0PxTAn4g20U