Nmap - Beginners Course

Explore how a TCP connection forms via the three-way handshake, detailing syn and ack packets. Identify how different flags in the TCP header indicate synchronization and establishment between hosts.

Learn tcp/ip part 2 basics, how ports with services like http on 80 and ssh on 22 interact with firewalls, and classify port states as open, closed, or filtered.

Two methods close a tcap connection: a normal close with the fin flag or an abrupt reset with the reset flag. The fin sequence releases resources; the reset terminates immediately.

Scan a network with Nmap to identify open ports, focusing on the 100 common ports with the -F option, and optionally scan specific ports or ranges.

Explore Nmap timing options from t0 to t5, with t3 as default; faster timings reduce probe delays, while t5 waits about five milliseconds per probe.

Measure round trip time and set a maximum RTT timeout of 216 ms with an initial RTT timeout of 150 ms, based on 70–75 ms latency to a Sudan site.

Learn host discovery in a penetration test by identifying alive hosts with icmp pings and tcp packets using Nmap -sP, and note how stateful firewalls affect reachability.

Customize icmp probes in nmap by using type 13 echo requests and adjusting the -T timing flag, revealing additional hosts up during the scan.

Explore how to customize tcp ping in Nmap by adjusting tcp packet flags, spoofing sources, and using IP/subnet parameters to reveal alive hosts, while noting ICMP requests may be blocked.

Explore tcp ping and arp techniques to discover hosts, map mac addresses, and uncover open ports while navigating firewalls and routers and crafting packets within your internal network.

Explore the arp table to map ip addresses to mac addresses, using a command to view results and identify the 11 hosts on the network.

Learn to scan multiple hosts by listing targets in a text file for Nmap. Use the -iL option to read targets from the file, where only two hosts are found.

Output scan results to a text or sml file for later review, and identify hosts with the FP service and the X Mail form, including port 21 details.

Explore tcp connect scanning in Nmap, performing the full three-way handshake, and compare crafting custom packets with flags to standard scans; connect scans are noisier and may attract firewalls.

Explore how a tcp syn scan conducts partial connections to identify open, closed, or filtered ports using Nmap in stealth mode, highlighting required root privileges and firewall considerations.

Use a TCP ACK scan in Nmap to detect firewalls; a reset means unfiltered, no response means filtered, demonstrated on a local host and a remote site.

Learn how Nmap uses fin, null, and christmas tree scans to reveal port states; closed ports reset and open ports do not respond, while -sX bypasses stateless firewalls.

Explore how tcp flags like fin and syn in Nmap scanning influence firewall behavior as you craft packets, start with syntax, and experiment with options to gauge responses.

Learn to customize tcp flags with nmap's scan flags option by setting flags to 1 or 0, with root privileges, and test flag combinations against a host.

Discover how to perform UDP scans with Nmap, explain why UDP scanning is slow, and speed up using the max retries option on a sample host.

Learn to detect service versions with nmap using -sV and --version-intensity to identify running services and web servers on common ports, and compare scan times at different intensities (default 7).

Explore how nmap's operating system detection uses a fingerprint database and probes to identify a target's OS and device type. Use the -O option under sudo for testing.

Explore techniques to evade firewalls and intrusion detection systems, including decoy scans with -D and spoofed IPs, crafting source ports, and fragmentation options to bypass protections.

Explore evading firewalls in Nmap by manipulating data length to add extra bytes, and spoof the target’s Mac address, using random or vendor-specific macs to obscure origin.

Explore nmap verbosity, the reason option, and debugging levels to see why ports appear open, with examples of ping, stealth scans, and ports 80 and 443.

Explore the Nmap scripting engine to write and use network discovery scripts across categories such as authentication, discovery, exploit, and denial of service, and always obtain permission before scanning.

Explore SNMP (simple network management protocol) architecture with the manager, agent, and MIB, and learn to enumerate registered Windows users via SNMP queries on UDP port 161.

Discover how the snmp computer info script extracts host system information, demonstrated with root privileges on a target device — an Intel x86 PC running Windows 7.

Explore how SNMP reveals information on network devices and interfaces, including printers and IP cameras, using version 1 or 2. See how scripts identify interfaces and expose vulnerabilities.

Shows how to enumerate installed software on a Windows host using SLM, uncovering software such as printer software and .NET frameworks, and aims for root privileges.

Discover how NetBIOS names enable local area network discovery, using UDP port 137 to locate devices and identify NetBIOS names with scripted checks.

Explore the SMB protocol on port 445, identify supported versions (1, 2, 3), and use a script to gather computer names and BIOS data via SMB.

Use the SMB shares script in Nmap to scan for shareable folders on SMB port 445. Identify exposed shares like a family images folder and assess malware risk.

Explore how an http-enum script enumerates web server directories and reveals service version on a gateway, exposing an authentication vulnerability with a patch in version 1.4.36.

Explore how a dns cache snoop script tests a gateway dns server by issuing recursive and non-recursive queries, measuring response times to identify cached domains.

Discover how the dhcp-discover script locates DHCP servers on a network by broadcasting and receiving offers, and identify rogue servers and DNS configurations.

Explore universal plug and play (upnp) discovery via udp port 1900 multicast, showing how a client finds and queries devices' services and location files for control actions.