How to Use Nmap for Enumeration in Real-World Cybersecurity Scenarios

Nmap (Network mapper) , so it’s an enumeration tool mean gathering information about the network like host discovery and port scanning and the running services that run on it and it’s version.

So in this acritical we are going to show how to do:

1. host discovery.
2. port scanning .
3. service and version detection.

In this way, the scanning process progresses step by step: first verifying the host, then examining its ports, and finally identifying the applications operating over those ports and detect it’s version.

As attacker the first thing you want to do after define your target is to do host discovery in the network so you can know how many hosts are running there, and know their mac and ip addresses.

To do this here is the structure that you guys must know before starting:

nmap [options] [ip address of the network] / [ specific ip address]

The first option we are going to take is -sn (scan network) this option for do hosts discovery in the network to know which hosts are up.

nmap -sn 192.168.1.0/24  //network address
nmap -sn 192.168.1.1-100 // define specefic ip address to scan
nmap -sn 192.168.1.1,3,7,10

lets talk about the result. We find 9 hosts up in our network .As an attacker now you know your scope . But here how nmap know which host is up?? we are going to use Wireshark.

As shown here , nmap use ARP protocol to know which host is up by sending broadcast from kali machine to all devices in the network , the one is up , replay with it’s MAC address.

NOTE: if your target is public then nmap use ICMP to scan that target.

ICMP used to scan the scanme.nmap.org public sub-domain

NOTE: nmap may sometimes has false positive/negative prob so maybe when your scan your network some host my not appear as up.

After completing host discovery and confirming that the target device is reachable on the network, we move to the port discovery phase at the Transport Layer (Layer 4). In this stage, TCP and UDP ports are scanned to determine whether they are open, closed, or filtered by a firewall , so services are accessible or not.

The option we use here is -sT /-sS for TCP scan . -sU for UDP. Lets take a look:

Here we scan the open TCP ports on ip 192.168.1.20 using -sT ( scan tcp) . The result shows 7 ports open and other 993 closed.

NOTE: the service here is not the real service that is running in ports it’s the common service that the port takes usually. we will talk about this later

How nmap know the open TCP ports ??

TCP connection opened with every scanned port , so nmap send SYN TCP packet to a specific port , if destination answer with SYN+ACK then the port is open else that closed -send RST -, then nmap send ACK +RST to closed the connection , this known as full TCP Scan , or TCP Three-Way Handshake Scan. Because it’s open a session.

Three-Way Handshake to open connection with port 80 by wireshark

• sS (syn scan) option is the same as -sT , the way that the namp work with -sS , nmap send SYN TCP packet to a port ,if the port is open destination send SYN + ACK , nmap send RST without ACK , so no session is opend which make -sS faster than -sT.

half connection to know the port is open , using -sS

Now lets take a look for UDP port scanning . Some important services use only UDP port in layer 4 , like DNS , DHCP , SNMP . TO scan them we use the option -sU .

First of all , you must know that UDP is like a one way connection so that no acknowledgment is received from the client , something like nmap says I want to connect with you but no response because UDP works like this , so how nmap scans the ports on UDP ? nmap sends UDP packet to every port , If the port is closed destination will send an ICMP massage with code 3 , type 3 ( destination unreachable) . If the port is open , nmap will get a replay from the port , but sometimes the state of the port is open|filtered what that mean ? open filtered mean that the port is open because no ICMP massage is received but also no replay from that port so namp can’t determine . UDP scan is slower than TCP scan because UDP is a connectionless protocol and open ports usually do not respond. Since there is often no feedback from the target about the port state, Nmap must wait and retry before deciding whether the port is open, filtered, or closed. This waiting and retry mechanism increases the scan time. Let’s take a look :

run wireshark before do nmap UDP scanning so you can capture the traffic :

text inside the square is the status of scanning like what happening know while scanning is progressing

At wireshark filter by ICMP protocol so you can see the closed UDP ports .

icmp destination unreachable type3 ,code 3 (closed ports)

open ports

The next step is to analyze the service running on that port at the application layer (Layer 7). This involves identifying the specific protocol or application in use, such as HTTP, SSH, or DNS, and sometimes even determining its version. the option is -sV ( service/version detection)option.

As picture showed , you can see the actual service and it’s version listed under the version column for each port.

How nmap knows the running service and it’s version ?

In Nmap, after it discovers that a port is open, it tries to identify the service running on that port using its internal database located in /usr/share/nmap/nmap-service-probes . This file contains many ready-made request messages (probes) for different protocols like HTTP, DNS, SSH, and others. When you use the -sV option, Nmap selects an appropriate probe based on the port number and the most likely service, then sends a specially crafted packet to that open port and waits for a response. It compares the reply with known patterns stored in its database to determine the service name and sometimes even its version. If the first probe does not produce a clear match, Nmap may send additional probes to try to identify the service more accurately, depending on the version detection intensity .

In some cases ,Banner grabbing is the technique of connecting to a service and reading the information it sends back automatically , many services send a “banner” (welcome massage) upon a connection . example from the http header you can see the version also when you connect to ssh there is banner massage sent, and many other .

In this way, Nmap goes beyond simply detecting open ports and actively analyzes responses to understand which application is actually running on the target system. And here you can use option --version-intensity *<intensity>*

version intensity in Nmap as controlling how many service detection probes are allowed to be used. Each probe in the file has a rarity value between 0 and 9. The default is 7 . imagin this option as describe the common probes , so 0 only try the most common probe to scan the port and 9 mean try the all probes common and rare . The higher number, the more probes Nmap will send. A higher value makes the scan slower but more accurate, while a lower value makes it faster but less accurate.

first pic more accurate

NOTE : -sV option by default makes port scanning so you can use it without -sS , -sT , -sU and other scan types.

Some other option we can use is -O OS fingerprinting (the kernel version or the OS version of my machine) this is also may have vulnerability . -O make by default port scanning and host discovery and it must be an open port in the target machine so nmap can guess from it the os version . example open SHH port indicate that the os is Linux and SMB indicate that the os is windows , their is an indicator so nmap know the version which is TTL ( time to live value). TTL withe 64 is the default for linux and TTL with 128 this is windows .

OS fingerprinting

Once the service and version are known, the next step is to look for known vulnerabilities (CVEs) for that version, which could potentially be used to exploit the system if it has unpatched vulnerability . this is call

these are common vulnerability for MySQL 5.0.51

Nmap provides additional functionality through the Nmap Scripting Engine (NSE). These scripts extend Nmap’s capabilities beyond simple port scanning (mean it must ba an open port in the target)by allowing deeper enumeration, vulnerability detection, and service analysis.

nmap --scripts <script name> < target>