Enumeration is collecting as much information as possible. The more information we have, the easier it will be for us to find vectors of attack.


Enumeration is the key.


Note: Most scanning tools have a timeout set until they receive a response from the service. If this tool does not respond within a specific time, this service/port will be marked as closed, filtered, or unknown. However, if a port is marked as closed and Nmap doesn't show it to us, we will be in a bad situation. This service/port may provide us with the opportunity to find a way to access the system. Therefore, this result can take much unnecessary time until we find it.


Introduction to Nmap

Network Mapper (Nmap) is an open-source network analysis and security auditing tool written in C, C++, Python, and Lua. It is designed to scan networks and identify which hosts are available on the network using raw packets, and services and applications, including the name and version, where possible. It can also identify the operating systems and versions of these hosts. Besides other features, Nmap also offers scanning capabilities that can determine if packet filters, firewalls, or intrusion detection systems (IDS) are configured as needed.


Nmap Architecture

Nmap offers many different types of scans that can be used to obtain various results about our targets. Basically, Nmap can be divided into the following scanning techniques:

  1. Host discovery
  2. Port scanning
  3. Service enumeration and detection
  4. OS detection
  5. Scriptable interaction with the target service (Nmap Scripting Engine)

$ nmap <scan types> <options> <target>



Host Discovery

When we need to conduct an internal penetration test for the entire network of a company, for example, then we should, first of all, get an overview of which systems are online that we can work with. To actively discover such systems on the network, we can use various Nmap host discovery options. There are many options Nmap provides to determine whether our target is alive or not. The most effective host discovery method is to use ICMP echo requests, which we will look into.It is always recommended to store every single scan. This can later be used for comparison, documentation, and reporting. After all, different tools may produce different results. Therefore it can be beneficial to distinguish which tool produces which results.

$ sudo nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5
$ sudo nmap -sn -oA tnet -iL hosts.lst | grep for | cut -d" " -f5 # ip List
$ sudo nmap -sn -oA tnet 10.129.2.18 10.129.2.19 10.129.2.20| grep for | cut -d" " -f5 # multiple ips
$ sudo nmap -sn -oA tnet 10.129.2.18-20| grep for | cut -d" " -f5# multiple ips
$ sudo nmap 10.129.2.18 -sn -oA host # single ip



This scanning method works only if the firewalls of the hosts allow it. Otherwise, we can use other scanning techniques to find out if the hosts are active or not.


If we disable port scan (-sn), Nmap automatically ping scan with ICMP Echo Requests (-PE). Once such a request is sent, we usually expect an ICMP reply if the pinging host is alive. The more interesting fact is that our previous scans did not do that because before Nmap could send an ICMP echo request, it would send an ARP ping resulting in an ARP reply. We can confirm this with the "--packet-trace" option. To ensure that ICMP echo requests are sent, we also define the option (-PE) for this.


$ sudo nmap 10.129.2.18 -sn -oA host -PE --packet-trace

Another way to determine why Nmap has our target marked as "alive" is with the "--reason" option.


$ sudo nmap 10.129.2.18 -sn -oA host -PE --reason


We see here that Nmap does indeed detect whether the host is alive or not through the ARP request and ARP reply alone.


To disable ARP requests and scan our target with the desired ICMP echo requests, we can disable ARP pings by setting the "--disable-arp-ping" option. Then we can scan our target again and look at the packets sent and received.


$ sudo nmap 10.129.2.18 -sn -oA host -PE --packet-trace --disable-arp-ping