Ethical Hacking with Nmap: From Scanning to Initial Access

Learn how nmap works internally by crafting packets and analyzing responses to determine open, closed, or filtered ports, using tcp and udp behavior, service detection, and os fingerprinting.

Learn to use the nmap-help command to access an overview of nmap capabilities, including host discovery, tcp and udp scans, port specification, service detection, script scans, os detection, firewall evasion.

Use nmap host discovery (-sn) to identify live hosts via ARP and ICMP probes, map gateway, DNS server, and Kali Linux, then proceed to port scanning and deeper enumeration.

Identify open ports on the target using a tcp syn scan with nmap, revealing services and entry points for enumeration and exploitation.

Run a TCP connect scan with Nmap to complete the full TCP three-way handshake, revealing open ports while leaving more traces and being noisier when not running as root.

Learn how UDP scanning with Nmap differs from TCP, using no handshake and ICMP responses for closed ports, and why DNS and SNMP rely on UDP.

Explain why UDP scans run slower than TCP scans due to no handshake and timeouts. Note services such as domain, rcpbind, netbios, ns, and nfs, and stress UDP scanning's importance.

Use nmap -sV to detect service names and versions on open ports, analyze responses from web, ftp, and ssh services, and target vulnerability research and exploitation.

Run default nmap scripts (-sC) to automatically gather deeper information, including banner grabbing, vulnerability checks, and service enumeration, revealing open ports and versions for actionable intelligence on the attack surface.

Execute an aggressive nmap scan with -A to enable service and version detection, scripts, OS detection, and traceroute in one command, yielding open ports, script results, vulnerabilities, and OS details.

Learn stealth and evasion scan techniques in Nmap using null scan to evade firewalls and basic filtering, observing open ports with no response and closed ports with a reset.

Explore FinScan, enabled with -sf in nmap, by sending a tcp packet with the fin flag set; open ports may not respond, closed ports reset, and ports may be filtered.

Explore Nmap's fragmentation scan technique to evade firewalls by splitting tcp headers across multiple fragments with -f, enabling previously filtered ports to appear open when firewalls fail to reassemble.

Combine multiple nmap techniques in a single command to balance stealth, speed, and accuracy while using fragmentation and sync scans to evade simple packet inspection firewalls.

Target specific ports with Nmap to scan only needed services, speeding up initial enumeration and delivering fast, focused results for commonly used ports.

Exploit a known vsftpd 2.3.4 backdoor to gain initial access via an ftp shell after anonymous login, culminating in a shell with root privileges.

Demonstrates gaining SSH access on a Debian-based host using OpenSSH 4.7p1, enumerating usernames with Metasploit's SSH enum users module and brute-forcing with username and password files to obtain a session.

Exploit telnet exposure by brute-forcing credentials with Metasploit to gain an interactive shell on a target after identifying an open port 23 telnet service.

Exploit SMB service on port 445 to gain remote code execution and establish initial access through a compromised Samba service using Metasploit, yielding an interactive shell.

The lecture demonstrates identifying a Java RMI service on port 1099 with nmap, then exploiting insecure Java RMI configuration via msfconsole to obtain a remote meterpreter shell.

Discovered MySQL service on port 3306; brute-forcing with Hydra yields a root login with no password. This access reveals databases and unauthorized data exposure.

Combine Nmap enumeration with initial access by showing how misconfigured or vulnerable services like ftp, ssh, telnet, smb, java, arma, and mysql yield shells via weak creds or metasploit exploits.