3001a_nmap_scanning

login to the livecd ssh -l root lcd.hacking-lab.com (password: compass)
A) Nmap Default Options
- ping 192.168.200.244 -> target is pingable
- nmap 192.168.200.244 -> default nmap scan (see 3001a_1.png)
- nmap -v 192.168.200.244 -> default nmap scan in verbose mode (see 3001a_2.png)
  - Is ARP/Ping checks active or not? yes
  - Is DNS resolution active or not? yes
  - What is the default nmap scan type? as root it is TCP SYN
  - What are the default ports being scanned if the user is not configuring the ports being scanned? By default, Nmap scans the most common 1,000 ports for each protocol. (in the default case this means tcp)

B) Nmap Runtime Parameters
- nmap --scan-delay 100ms 192.168.200.244
  - runtime interaction (as listed at https://nmap.org/book/man-runtime-interaction.html )
    - ctrl+d: print status message (as it is an unknown interactionon)
    - v: increase verbosity level
    - V: decrease verbosity level
    - d: increase debug level
    - D: decrease debug level
    - (ctrl+c: abort (this is the default way to abort smth, not ctrl+d, as this is the default to log out of the shell))
C) Nmap UDP Scan
- nmap -sU 192.168.200.244 -> udp scan
- nmap -sU --reason 192.168.200.244 -> udp scan with reason
  - Why is the STATE of some identified services "open¦filtered"? Because the request got no response
- Why is an UDP scan not very reliable? most applications don't respond on empty payload, but firewalls produce the same effect, so it can't easily be determined if there is an application just not responding, or a firewall blocking the request alltogether
- Is there a Nmap switch which could improve the scan result? -V option to scan for the version of the application behind the port (not helpful in this case, as nmap has no payload for these services, to test for the version) (see 3001a_3.png)

D) Nmap Scripting
- nmap -v -sC 192.168.200.244 (see 3001a_4.png)
- Where are the scripts stored on the local computer? /usr/share/nmap/scripts
- How many scripts are there? 601 (ls *.nse | wc -l or cat script.db | wc -l)
- How many NSE scripts are currently listed on NSE Documentation? 604 (count of rows of html table)
  - additional scripts not found locally: nbns-interfaces, nbns-interfaces, port-states

E) Nmap Grep-able Output
- nmap -oA nmapscan 192.168.200.0/24 to scan the network and save the output in nmapscan.gnmap
- cat nmapscan.gnmap | grep open | cut -d " " -f 1,2 to retrieve the host with open ports in requested format (see 3001a_5.png)