Nmap for Ethical Hackers - The Ultimate Hands-On Course

Nmap can be very confusing when we are first getting started. Let's learn to use the help menu which will remind us of the options and descriptions we will most commonly use.

Now that we have found an active host or group of hosts, let's learn how to scan specific ports.

Most of the time with nmap you will be using the same five scans. Let's learn what these are and how they work.

1. Ping Scan

2. --top-ports 20

3. -O - OS Fingerprinting

4. -A (Aggressive Scan - OS, Version, Trace)

5. -p 80 (Specify the port number)

In this video we will learn how to configure, save, and share Wireshark Profiles.

OS Fingerprinting can help to identify the operating system on a device, which will help when trying to find vulnerabilities or to take inventory of what systems need to be updated.

Scans in Nmap are designed to work in phases. Let's use Wireshark to understand how a scan develops.

Let's learn some tips and tricks when scanning for active devices on a local network as well as a remote one.

The "Ping" scan will change depending on the network we are enumerating. If it is a local network, we will send ARP traffic, however if it is a network that is at least one router hop away, nmap will use TCP SYNs. If sudo is used, Nmap will send ICMP pings to the subnet under test.

Let's dissect how a default scan progresses, learning what protocols are used as the scan progresses. We will deep dive into this scan with Wireshark.

We use ports all the time in our Nmap scans, but what is a port? 

Let's learn how these unique scans work, why they work, and when to use them in enumeration.

The Nmap OS Fingerprinting and Version scans are powerful features of this tool. Let's learn how they work and when we should use them.

Learning about a service version can help us to take inventory of the active services, or can help us to identify a possible vulnerability.

Verbosity will give us more detail in the output of an Nmap scan. This is a great option to know! 

Learning NSE is both fun and awesome! It really helps us to level up our scans. Let's see how.

Let's learn where the Nmap scripts are stored and how to update them.

Don't get lost in the weeds! Practice using these scripts and learning how they work. There are thousands of them. Find your favorites and learn them well.

To go further and learn more NSE scripts, we need to install a vulnerable machine into our lab environment. This video talks about why we need to do this. Please use the link in this module to access a step-by-step walkthrough of how to set this up.

Let's learn how to use the http-enum script to enumerate a server that has an open http port.

Let's check to see if an FTP server supports anonymous logins, and if not, how to brute-force a username/password.

In this video we will use the SMB scripts to check for common user accounts.

The "Vulners" script enables us to scan for service versions and will list possible CVE's that may work against the system to exploit it.

Scanning for TLS versions and certificates will help blue teams to tighten up older systems, as well as give red teams a possible attack vector.

Let's learn about what Firewalls and IDS systems look for.

The IP Protocol is designed to allow for fragmentation, especially when passing through a network segment with low MTU's (assuming the DF bit is not set). Let's see how this looks in Wireshark

Let's learn how to fake the source address we are originating from. If you cannot run this on your system, follow along with the included pcap file! 

Decoys will allow us to bury our true address in a sea of other spoofed ones. The good part about using this scan is that we will be able to receive a reply from the target.

Let's look at some best practices when performing active recon with Nmap.