Pen Testing Tools: Nmap

Basic Guide

Here's a basic guide on how to use Nmap in Kali Linux:

1. Open Terminal.

2. Install Nmap (if not already installed): Nmap typically comes pre-installed with Kali Linux. If for some reason it's not, you can install it by running: 

   • sudo apt-get install nmap

3. Basic Nmap Scan: To perform a basic scan of a target, use:  

   • nmap localhost

   • nmap [target]

   • Here, replace `[target]` with the IP address or domain name of the system you want to scan.

4. Scan Multiple IPs or Subnets: You can scan multiple targets by listing them separated by spaces or by using a range or subnet notation:

   • nmap 192.168.1.1 192.168.1.2

   • nmap 192.168.1.1-10

   • nmap 192.168.1.0/24

5. Perform a Service Version Detection: To detect the version of services running on open ports, use:

   • nmap -sV [target]

6. Operating System Detection: Nmap can try to detect the operating system of the target:

   • nmap -O [target]

7. Aggressive Scan: An aggressive scan provides more information about the target, including OS detection, version detection, script scanning, and traceroute:

   • nmap -A [target]

8. Using NSE Scripts: Nmap has a powerful scripting engine (NSE) that allows you to use scripts for more advanced discovery and exploitation:

   • nmap --script=[script-name] [target]

9. Scan Specific Ports: To scan specific ports, use:

   • nmap -p [port(s)] [target]

   • You can specify a single port, multiple ports separated by commas, or a range of ports.

10. Saving Scan Results: You can save the results of your scan to a file:

    • nmap -oN output.txt [target]

11. Stealth Scan: To perform a stealthier scan, which can help avoid detection by some intrusion detection systems, use the SYN scan: 

    • nmap -sS [target]

Sample Commands...

1. Command to verify installation: nmap -v

2. Basic scan: nmap [target]

3. Ping scan: nmap -sn [target]

4. Scan without ping: nmap -Pn [target]

5. Specific port scan: nmap -p [port] [target]

6. All ports scan: nmap -p- [target]

7. Fast scan: nmap -F [target]

8. TCP SYN scan: nmap -sS [target]

9. UDP scan: nmap -sU [target]

10. Service version detection: nmap -sV [target]

11. OS detection: nmap -O [target]

12. Service/version detection: nmap -sV [target]

13. Running specific NSE scripts: nmap --script=[script] [target]

14. Normal output: nmap -oN [outputfile] [target]

15. XML output: nmap -oX [outputfile] [target]

16. Grepable output: nmap -oG [outputfile] [target]

Ethical Considerations and Legal Issues

• While Nmap is a powerful tool for network administrators and security professionals, its use should be limited to networks and systems where the user has explicit permission to perform scans. Unauthorized scanning can be considered intrusive and illegal in many jurisdictions.

• Responsible Use of Kali Linux 

Conclusion

Nmap's versatility, power, and ease of use make it a staple in the field of network security. Its ability to provide detailed insights into network security postures makes it invaluable for vulnerability assessments and network audits. However, as with any powerful tool, ethical and legal considerations should guide its use. Whether you're a seasoned network professional or a budding cybersecurity enthusiast, Nmap is a tool that warrants attention and mastery.

NEXT: Pen Testing Tools: Wireshark