diff --git a/docs/nmap.1 b/docs/nmap.1 index dab5231a3..d7998da19 100644 --- a/docs/nmap.1 +++ b/docs/nmap.1 @@ -1,11 +1,11 @@ .\" Title: nmap .\" Author: Gordon \(lqFyodor\(rq Lyon .\" Generator: DocBook XSL Stylesheets v1.73.2 -.\" Date: 06/30/2008 -.\" Manual: Nmap Network Scanning (PRE-RELEASE BETA VERSION) +.\" Date: 07/31/2008 +.\" Manual: Nmap Network Scanning .\" Source: Insecure.Org Zero Day .\" -.TH "NMAP" "1" "06/30/2008" "Insecure.Org Zero Day" "Nmap Network Scanning (PRE-REL" +.TH "NMAP" "1" "07/31/2008" "Insecure.Org Zero Day" "Nmap Network Scanning" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) @@ -20,11 +20,14 @@ nmap - Network exploration tool and security / port scanner Nmap (\(lqNetwork Mapper\(rq) is an open source tool for network exploration and security auditing\. It was designed to rapidly scan large networks, although it works fine against single hosts\. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics\. While Nmap is commonly used for security audits, many systems and network administrators find it useful for routine tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime\. .PP The output from Nmap is a list of scanned targets, with supplemental information on each depending on the options used\. Key among that information is the -\(lqinteresting ports table\(rq\. That table lists the port number and protocol, service name, and state\. The state is either +\(lqinteresting ports table\(rq\. +That table lists the port number and protocol, service name, and state\. The state is either open, filtered, closed, or -unfiltered\. Open means that an application on the target machine is listening for connections/packets on that port\. +unfiltered\. +Open +means that an application on the target machine is listening for connections/packets on that port\. Filtered means that a firewall, filter, or other network obstacle is blocking the port so that Nmap cannot tell whether it is open @@ -42,7 +45,7 @@ when it cannot determine which of the two states describe a port\. The port tabl In addition to the interesting ports table, Nmap can provide further information on targets, including reverse DNS names, operating system guesses, device types, and MAC addresses\. .PP A typical Nmap scan is shown in -Example\ 15.1, \(lqA representative Nmap scan\(rq\. The only Nmap arguments used in this example are +Example\ 15.1\. The only Nmap arguments used in this example are \fB\-A\fR, to enable OS and version detection, script scanning, and traceroute; \fB\-T4\fR for faster execution; and then the two target hostnames\. @@ -54,7 +57,7 @@ for faster execution; and then the two target hostnames\. # nmap \-A \-T4 scanme\.nmap\.org playground Starting Nmap ( http://nmap\.org ) -Interesting ports on scanme\.nmap\.org (205\.217\.153\.62): +Interesting ports on scanme\.nmap\.org (64\.13\.134\.52): (The 1663 ports scanned but not shown below are in state: filtered) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 3\.9p1 (protocol 1\.99) @@ -99,6 +102,9 @@ This options summary is printed when Nmap is run with no arguments, and the late .PP + + + .sp .RS 4 .nf @@ -211,17 +217,19 @@ SEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES .fi .RE .sp + + .SH "TARGET SPECIFICATION" .PP Everything on the Nmap command\-line that isn\'t an option (or option argument) is treated as a target host specification\. The simplest case is to specify a target IP address or hostname for scanning\. .PP -Sometimes you wish to scan a whole network of adjacent hosts\. For this, Nmap supports CIDR\-style addressing\. You can append -/\fInumbits\fR +Sometimes you wish to scan a whole network of adjacent hosts\. For this, Nmap supports CIDR\-style addressing\. +You can append /\fInumbits\fR to an IP address or hostname and Nmap will scan every IP address for which the first \fInumbits\fR are the same as for the reference IP or hostname given\. For example, 192\.168\.10\.0/24 would scan the 256 hosts between 192\.168\.10\.0 (binary: 11000000 10101000 00001010 00000000) and 192\.168\.10\.255 (binary: -11000000 10101000 00001010 11111111), inclusive\. 192\.168\.10\.40/24 would do exactly the same thing\. Given that the host scanme\.nmap\.org is at the IP address 205\.217\.153\.62, the specification scanme\.nmap\.org/16 would scan the 65,536 IP addresses between 205\.217\.0\.0 and 205\.217\.255\.255\. The smallest allowed value is /0, which scans the whole Internet\. The largest value is 32, which scans just the named host or IP address because all address bits are fixed\. +11000000 10101000 00001010 11111111), inclusive\. 192\.168\.10\.40/24 would do exactly the same thing\. Given that the host scanme\.nmap\.org is at the IP address 64\.13\.134\.52, the specification scanme\.nmap\.org/16 would scan the 65,536 IP addresses between 64\.13\.0\.0 and 64\.13\.255\.255\. The smallest allowed value is /0, which scans the whole Internet\. The largest value is /32, which scans just the named host or IP address because all address bits are fixed\. .PP CIDR notation is short but not always flexible enough\. For example, you might want to scan 192\.168\.0\.0/16 but skip any IPs ending with \.0 or \.255 because they are commonly broadcast addresses\. Nmap supports this through octet range addressing\. Rather than specify a normal IP address, you can specify a comma separated list of numbers or ranges for each octet\. For example, 192\.168\.0\-255\.1\-254 will skip all addresses in the range that end in \.0 and or \.255\. Ranges need not be limited to the final octets: the specifier 0\-255\.0\-255\.13\.37 will perform an Internet\-wide scan for all IP addresses ending in 13\.37\. This sort of broad sampling can be useful for Internet surveys and research\. .PP @@ -233,7 +241,7 @@ does what you would expect\. .PP While targets are usually specified on the command lines, the following options are also available to control target selection: .PP -\fB\-iL \fR (Input from list) +\fB\-iL \fR\fB\fIinputfilename\fR\fR (Input from list) .RS 4 Reads target specifications from \fIinputfilename\fR\. Passing a huge list of hosts is often awkward on the command line, yet it is a common desire\. For example, your DHCP server might export a list of 10,000 current leases that you wish to scan\. Or maybe you want to scan all IP addresses @@ -243,7 +251,7 @@ for those to locate hosts using unauthorized static IP addresses\. Simply genera option\. Entries can be in any of the formats accepted by Nmap on the command line (IP address, hostname, CIDR, IPv6, or octet ranges)\. Each entry must be separated by one or more spaces, tabs, or newlines\. You can specify a hyphen (\-) as the filename if you want Nmap to read hosts from standard input rather than an actual file\. .RE .PP -\fB\-iR \fR (Choose random targets) +\fB\-iR \fR\fB\fInum hosts\fR\fR (Choose random targets) .RS 4 For Internet\-wide surveys and other research, you may want to choose targets at random\. The \fInum hosts\fR @@ -251,15 +259,18 @@ argument tells Nmap how many IPs to generate\. Undesirable IPs such as those in 0 can be specified for a never\-ending scan\. Keep in mind that some network administrators bristle at unauthorized scans of their networks and may complain\. Use this option at your own risk! If you find yourself really bored one rainy afternoon, try the command \fBnmap \-sS \-PS80 \-iR 0 \-p 80\fR + + + to locate random web servers for browsing\. .RE .PP -\fB\-\-exclude \fR (Exclude hosts/networks) +\fB\-\-exclude \fR\fB\fIhost1\fR\fR\fB[,\fIhost2\fR[,\.\.\.]]\fR (Exclude hosts/networks) .RS 4 Specifies a comma\-separated list of targets to be excluded from the scan even if they are part of the overall network range you specify\. The list you pass in uses normal Nmap syntax, so it can include hostnames, CIDR netblocks, octet ranges, etc\. This can be useful when the network you wish to scan includes untouchable mission\-critical servers, systems that are known to react adversely to port scans, or subnetworks administered by other people\. .RE .PP -\fB\-\-excludefile \fR (Exclude list from file) +\fB\-\-excludefile \fR\fB\fIexclude_file\fR\fR (Exclude list from file) .RS 4 This offers the same functionality as the \fB\-\-exclude\fR @@ -275,23 +286,23 @@ Because host discovery needs are so diverse, Nmap offers a wide variety of optio ping tool\. Users can skip the ping step entirely with a list scan (\fB\-sL\fR) or by disabling ping (\fB\-PN\fR), or engage the network with arbitrary combinations of multi\-port TCP SYN/ACK, UDP, and ICMP probes\. The goal of these probes is to solicit responses which demonstrate that an IP address is actually active (is being used by a host or network device)\. On many networks, only a small percentage of IP addresses are active at any given time\. This is particularly common with private address space such as 10\.0\.0\.0/8\. That network has 16 million IPs, but I have seen it used by companies with less than a thousand machines\. Host discovery can find those machines in a sparsely allocated sea of IP addresses\. .PP -If no host discovery options are given, Nmap sends a TCP ACK packet destined for port 80 and an ICMP echo request query to each target machine\. An exception to this is that an ARP scan is used for any targets which are on a local ethernet network\. For unprivileged Unix shell users, a SYN packet is sent instead of the ack using the -\fBconnect()\fR -system call\. These defaults are equivalent to the +If no host discovery options are given, Nmap sends a TCP ACK packet destined for port 80 and an ICMP echo request query to each target machine\. An exception to this is that an ARP scan is used for any targets which are on a local ethernet network\. For unprivileged Unix shell users, a SYN packet is sent instead of the ACK using the +\fBconnect\fR +system call\. +These defaults are equivalent to the \fB\-PA \-PE\fR options\. This host discovery is often sufficient when scanning local networks, but a more comprehensive set of discovery probes is recommended for security auditing\. .PP The \fB\-P*\fR -options (which select ping types) can be combined\. You can increase your odds of penetrating strict firewalls by sending many probe types using different TCP ports/flags and ICMP codes\. Also note that ARP discovery (\fB\-PR\fR) is done by default against targets on a local ethernet network even if you specify other +options (which select ping types) can be combined\. You can increase your odds of penetrating strict firewalls by sending many probe types using different TCP ports/flags and ICMP codes\. Also note that ARP discovery (\fB\-PR\fR) +is done by default against targets on a local ethernet network even if you specify other \fB\-P*\fR options, because it is almost always faster and more effective\. .PP By default, Nmap does host discovery and then performs a port scan against each host it determines is online\. This is true even if you specify non\-default host discovery types such as UDP probes (\fB\-PU\fR)\. Read about the \fB\-sP\fR -option to learn how to perform -\fIonly\fR -host discovery, or use +option to learn how to perform only host discovery, or use \fB\-PN\fR to skip host discovery and port scan all target hosts\. The following options control host discovery: .PP @@ -299,7 +310,9 @@ to skip host discovery and port scan all target hosts\. The following options co .RS 4 The list scan is a degenerate form of host discovery that simply lists each host of the network(s) specified, without sending any packets to the target hosts\. By default, Nmap still does reverse\-DNS resolution on the hosts to learn their names\. It is often surprising how much useful information simple hostnames give out\. For example, fw\.chi -is the name of one company\'s Chicago firewall\. Nmap also reports the total number of IP addresses at the end\. The list scan is a good sanity check to ensure that you have proper IP addresses for your targets\. If the hosts sport domain names you do not recognize, it is worth investigating further to prevent scanning the wrong company\'s network\. +is the name of one company\'s Chicago firewall\. + +Nmap also reports the total number of IP addresses at the end\. The list scan is a good sanity check to ensure that you have proper IP addresses for your targets\. If the hosts sport domain names you do not recognize, it is worth investigating further to prevent scanning the wrong company\'s network\. .sp Since the idea is to simply print a list of target hosts, options for higher level functionality such as port scanning, OS detection, or ping scanning cannot be combined with this\. If you wish to disable ping scanning while still performing such higher level functionality, read up on the \fB\-PN\fR @@ -308,17 +321,15 @@ option\. .PP \fB\-sP\fR (Ping Scan) .RS 4 -This option tells Nmap to -\fIonly\fR -perform a ping scan (host discovery), then print out the available hosts that responded to the scan\. No further testing (such as port scanning or OS detection) is performed\. This is one step more intrusive than the list scan, and can often be used for the same purposes\. It allows light reconnaissance of a target network without attracting much attention\. Knowing how many hosts are up is more valuable to attackers than the list provided by list scan of every single IP and host name\. +This option tells Nmap to only perform a ping scan (host discovery), then print out the available hosts that responded to the scan\. Traceroute and NSE host scripts are also run if requested, but no further testing (such as port scanning or OS detection) is performed\. This is by default one step more intrusive than the list scan, and can often be used for the same purposes\. It allows light reconnaissance of a target network without attracting much attention\. Knowing how many hosts are up is more valuable to attackers than the list provided by list scan of every single IP and host name\. .sp Systems administrators often find this option valuable as well\. It can easily be used to count available machines on a network or monitor server availability\. This is often called a ping sweep, and is more reliable than pinging the broadcast address because many hosts do not reply to broadcast queries\. .sp The \fB\-sP\fR -option sends an ICMP echo request and a TCP packet to port 80 by default\. When executed by an unprivileged user, only a SYN packet is sent (using a -\fBconnect()\fR -call) to port 80 on the target\. When a privileged user tries to scan targets on a local ethernet network, ARP requests (\fB\-PR\fR) are used unless +option sends an ICMP echo request and a TCP ACK packet to port 80 by default\. When executed by an unprivileged user, only a SYN packet is sent (using a +\fBconnect\fR +call) to port 80 on the target\. When a privileged user tries to scan targets on a local ethernet network, ARP requests are used unless \fB\-\-send\-ip\fR was specified\. The \fB\-sP\fR @@ -336,17 +347,22 @@ causes Nmap to attempt the requested scanning functions against \fIevery\fR target IP address specified\. So if a class B sized target address space (/16) is specified on the command line, all 65,536 IP addresses are scanned\. Proper host discovery is skipped as with the list scan, but instead of stopping and printing the target list, Nmap continues to perform requested functions as if each target IP is active\. For machines on a local ethernet network, ARP scanning will still be performed (unless \fB\-\-send\-ip\fR -is specified) because Nmap needs MAC addresses to further scan target hosts\. This option flag for this used to be +is specified) because Nmap needs MAC addresses to further scan target hosts\. This option flag used to be \fBP0\fR (uses zero), but was renamed to avoid confusion with protocol ping\'s \fBPO\fR (uses the letter O) flag\. .RE .PP -\fB\-PS [portlist]\fR (TCP SYN Ping) +\fB\-PS \fR\fB\fIportlist\fR\fR (TCP SYN Ping) .RS 4 -This option sends an empty TCP packet with the SYN flag set\. The default destination port is 80 (configurable at compile time by changing DEFAULT_TCP_PROBE_PORT_SPEC in -\fInmap\.h\fR)\. Alternate ports can be specified as a parameter\. The syntax is the same as for the +This option sends an empty TCP packet with the SYN flag set\. The default destination port is 80 (configurable at compile time by changing +\fIDEFAULT_TCP_PROBE_PORT_SPEC\fR + +in +\fInmap\.h\fR)\. + +Alternate ports can be specified as a parameter\. The syntax is the same as for the \fB\-p\fR except that port type specifiers like T: @@ -357,24 +373,36 @@ and \fB\-PS\fR and the port list\. If multiple probes are specified they will be sent in parallel\. .sp -The SYN flag suggests to the remote system that you are attempting to establish a connection\. Normally the destination port will be closed, and a RST (reset) packet sent back\. If the port happens to be open, the target will take the second step of a TCP 3\-way\-handshake by responding with a SYN/ACK TCP packet\. The machine running Nmap then tears down the nascent connection by responding with a RST rather than sending an ACK packet which would complete the 3\-way\-handshake and establish a full connection\. The RST packet is sent by the kernel of the machine running Nmap in response to the unexpected SYN/ACK, not by Nmap itself\. +The SYN flag suggests to the remote system that you are attempting to establish a connection\. Normally the destination port will be closed, and a RST (reset) packet sent back\. If the port happens to be open, the target will take the second step of a TCP 3\-way\-handshake +by responding with a SYN/ACK TCP packet\. The machine running Nmap then tears down the nascent connection by responding with a RST rather than sending an ACK packet which would complete the 3\-way\-handshake and establish a full connection\. The RST packet is sent by the kernel of the machine running Nmap in response to the unexpected SYN/ACK, not by Nmap itself\. .sp Nmap does not care whether the port is open or closed\. Either the RST or SYN/ACK response discussed previously tell Nmap that the host is available and responsive\. .sp On Unix boxes, only the privileged user root -is generally able to send and receive raw TCP packets\. For unprivileged users, a workaround is automatically employed whereby the connect() system call is initiated against each target port\. This has the effect of sending a SYN packet to the target host, in an attempt to establish a connection\. If connect() returns with a quick success or an ECONNREFUSED failure, the underlying TCP stack must have received a SYN/ACK or RST and the host is marked available\. If the connection attempt is left hanging until a timeout is reached, the host is marked as down\. This workaround is also used for IPv6 connections, as raw IPv6 packet building support is not yet available in Nmap\. +is generally able to send and receive raw TCP packets\. +For unprivileged users, a workaround is automatically employed +whereby the +\fBconnect\fR +system call is initiated against each target port\. This has the effect of sending a SYN packet to the target host, in an attempt to establish a connection\. If +\fBconnect\fR +returns with a quick success or an ECONNREFUSED failure, the underlying TCP stack must have received a SYN/ACK or RST and the host is marked available\. If the connection attempt is left hanging until a timeout is reached, the host is marked as down\. This workaround is also used for IPv6 connections, as raw IPv6 packet building support is not yet available in Nmap\. .RE .PP -\fB\-PA [portlist]\fR (TCP ACK Ping) +\fB\-PA \fR\fB\fIportlist\fR\fR (TCP ACK Ping) .RS 4 The TCP ACK ping is quite similar to the just\-discussed SYN ping\. The difference, as you could likely guess, is that the TCP ACK flag is set instead of the SYN flag\. Such an ACK packet purports to be acknowledging data over an established TCP connection, but no such connection exists\. So remote hosts should always respond with a RST packet, disclosing their existence in the process\. .sp The \fB\-PA\fR -option uses the same default port as the SYN probe (80) and can also take a list of destination ports in the same format\. If an unprivileged user tries this, or an IPv6 target is specified, the connect() workaround discussed previously is used\. This workaround is imperfect because connect() is actually sending a SYN packet rather than an ACK\. +option uses the same default port as the SYN probe (80) and can also take a list of destination ports in the same format\. If an unprivileged user tries this, or an IPv6 target is specified, the +\fBconnect\fR +workaround discussed previously is used\. This workaround is imperfect because +\fBconnect\fR +is actually sending a SYN packet rather than an ACK\. .sp -The reason for offering both SYN and ACK ping probes is to maximize the chances of bypassing firewalls\. Many administrators configure routers and other simple firewalls to block incoming SYN packets except for those destined for public services like the company web site or mail server\. This prevents other incoming connections to the organization, while allowing users to make unobstructed outgoing connections to the Internet\. This non\-stateful approach takes up few resources on the firewall/router and is widely supported by hardware and software filters\. The Linux Netfilter/iptables firewall software offers the +The reason for offering both SYN and ACK ping probes is to maximize the chances of bypassing firewalls\. Many administrators configure routers and other simple firewalls to block incoming SYN packets except for those destined for public services like the company web site or mail server\. This prevents other incoming connections to the organization, while allowing users to make unobstructed outgoing connections to the Internet\. This non\-stateful approach takes up few resources on the firewall/router and is widely supported by hardware and software filters\. The Linux Netfilter/iptables +firewall software offers the \fB\-\-syn\fR convenience option to implement this stateless approach\. When stateless firewall rules such as this are in place, SYN ping probes (\fB\-PS\fR) are likely to be blocked when sent to closed target ports\. In such cases, the ACK probe shines as it cuts right through these rules\. .sp @@ -386,7 +414,7 @@ and \fB\-PA\fR\. .RE .PP -\fB\-PU [portlist]\fR (UDP Ping) +\fB\-PU \fR\fB\fIportlist\fR\fR (UDP Ping) .RS 4 Another host discovery option is the UDP ping, which sends an empty (unless \fB\-\-data\-length\fR @@ -394,8 +422,11 @@ is specified) UDP packet to the given ports\. The portlist takes the same format \fB\-PS\fR and \fB\-PA\fR -options\. If no ports are specified, the default is 31338\. This default can be configured at compile\-time by changing DEFAULT_UDP_PROBE_PORT_SPEC in -\fInmap\.h\fR\. A highly uncommon port is used by default because sending to open ports is often undesirable for this particular scan type\. +options\. If no ports are specified, the default is 31338\. This default can be configured at compile\-time by changing +\fIDEFAULT_UDP_PROBE_PORT_SPEC\fR +in +\fInmap\.h\fR\. +A highly uncommon port is used by default because sending to open ports is often undesirable for this particular scan type\. .sp Upon hitting a closed port on the target machine, the UDP probe should elicit an ICMP port unreachable packet in return\. This signifies to Nmap that the machine is up and available\. Many other types of ICMP errors, such as host/network unreachables or TTL exceeded are indicative of a down or unreachable host\. A lack of response is also interpreted this way\. If an open port is reached, most services simply ignore the empty packet and fail to return any response\. This is why the default probe port is 31338, which is highly unlikely to be in use\. A few services, such as chargen, will respond to an empty UDP packet, and thus disclose to Nmap that the machine is available\. .sp @@ -406,7 +437,8 @@ The primary advantage of this scan type is that it bypasses firewalls and filter .RS 4 In addition to the unusual TCP and UDP host discovery types discussed previously, Nmap can send the standard packets sent by the ubiquitous ping -program\. Nmap sends an ICMP type 8 (echo request) packet to the target IP addresses, expecting a type 0 (echo reply) in return from available hosts\. Unfortunately for network explorers, many hosts and firewalls now block these packets, rather than responding as required by +program\. Nmap sends an ICMP type 8 (echo request) packet to the target IP addresses, expecting a type 0 (echo reply) in return from available hosts\. +Unfortunately for network explorers, many hosts and firewalls now block these packets, rather than responding as required by \fIRFC 1122\fR\&[1]\. For this reason, ICMP\-only scans are rarely reliable enough against unknown targets over the Internet\. But for system administrators monitoring an internal network, they can be a practical and efficient approach\. Use the \fB\-PE\fR option to enable this echo request behavior\. @@ -419,10 +451,13 @@ and options, respectively\. A timestamp reply (ICMP code 14) or address mask reply (code 18) discloses that the host is available\. These two queries can be valuable when administrators specifically block echo request packets while forgetting that other ICMP queries can be used for the same purpose\. .RE .PP -\fB\-PO [protolist]\fR (IP Protocol Ping) +\fB\-PO \fR\fB\fIprotolist\fR\fR (IP Protocol Ping) .RS 4 -The newest host discovery option is the IP protocol ping, which sends IP packets with the specified protocol number set in their IP header\. The protocol list takes the same format as do port lists in the previously discussed TCP and UDP host discovery options\. If no protocols are specified, the default is to send multiple IP packets for ICMP (protocol 1), IGMP (protocol 2), and IP\-in\-IP (protocol 4)\. The default protocols can be configured at compile\-time by changing DEFAULT_PROTO_PROBE_PORT_SPEC in -\fInmap\.h\fR\. Note that for the ICMP, IGMP, TCP (protocol 6), and UDP (protocol 17), the packets are sent with the proper protocol headers while other protocols are sent with no additional data beyond the IP header (unless the +The newest host discovery option is the IP protocol ping, which sends IP packets with the specified protocol number set in their IP header\. The protocol list takes the same format as do port lists in the previously discussed TCP and UDP host discovery options\. If no protocols are specified, the default is to send multiple IP packets for ICMP (protocol 1), IGMP (protocol 2), and IP\-in\-IP (protocol 4)\. The default protocols can be configured at compile\-time by changing +\fIDEFAULT_PROTO_PROBE_PORT_SPEC\fR +in +\fInmap\.h\fR\. +Note that for the ICMP, IGMP, TCP (protocol 6), and UDP (protocol 17), the packets are sent with the proper protocol headers while other protocols are sent with no additional data beyond the IP header (unless the \fB\-\-data\-length\fR option is specified)\. .sp @@ -443,9 +478,9 @@ or .PP \fB\-\-traceroute\fR (Trace path to host) .RS 4 -Traceroutes are performed post\-scan using information from the scan results to determine the port and protocol most likely to reach the target\. It works with all scan types except connect scans (\-sT) and idle scans (\-sI)\. All traces use Nmap\'s dynamic timing model and are performed in parallel\. +Traceroutes are performed post\-scan using information from the scan results to determine the port and protocol most likely to reach the target\. It works with all scan types except connect scans (\fB\-sT\fR) and idle scans (\fB\-sI\fR)\. All traces use Nmap\'s dynamic timing model and are performed in parallel\. .sp -Traceroute works by sending packets with a low TTL (time\-to\-live) in an attempt to elicit ICMP Time Exceeded messages from intermediate hops between the scanner and the target host\. Standard traceroute implementation start with a TTL of 1 and increment the TTL until the destination host is reached\. Nmap\'s traceroute starts with a high TTL and then decrements the TTL until it reaches 0\. Doing it backwards lets nmap employ clever caching algorithms to speed up traces over multiple hosts\. On average nmap sends 5\-10 fewer packets per host, depending on network conditions\. If a single subnet is being scanned (i\.e\. 192\.168\.0\.0/24) nmap may only have to send a single packet to most hosts\. +Traceroute works by sending packets with a low TTL (time\-to\-live) in an attempt to elicit ICMP Time Exceeded messages from intermediate hops between the scanner and the target host\. Standard traceroute implementations start with a TTL of 1 and increment the TTL until the destination host is reached\. Nmap\'s traceroute starts with a high TTL and then decrements the TTL until it reaches 0\. Doing it backwards lets nmap employ clever caching algorithms to speed up traces over multiple hosts\. On average nmap sends 5\-10 fewer packets per host, depending on network conditions\. If a single subnet is being scanned (i\.e\. 192\.168\.0\.0/24) nmap may only have to send a single packet to most hosts\. .RE .PP \fB\-\-reason\fR (Host and port state reasons) @@ -454,16 +489,19 @@ Shows the reason each port is set to a specific state and the reason each host i RST packet from a closed port or an echo reply from an alive host\. The information Nmap can provide is determined by the type of scan or ping\. The SYN scan and SYN ping (\fB\-sS\fR and -\fB\-PT\fR) are very detailed, but the TCP connect scan and ping (\fB\-sT\fR) are limited by the implementation of the -connect -system call\. This feature is automatically enabled by the debug option (\fB\-d\fR) and the results are stored in XML log files even if this option is not specified\. +\fB\-PS\fR) are very detailed, but the TCP connect scan (\fB\-sT\fR) is limited by the implementation of the +\fBconnect\fR +system call\. This feature is automatically enabled by the debug option (\fB\-d\fR) +and the results are stored in XML log files even if this option is not specified\. .RE .PP \fB\-n\fR (No DNS resolution) .RS 4 Tells Nmap to \fInever\fR -do reverse DNS resolution on the active IP addresses it finds\. Since DNS can be slow even with Nmap\'s built\-in parallel stub resolver, this option can slash scanning times\. +do reverse DNS + +resolution on the active IP addresses it finds\. Since DNS can be slow even with Nmap\'s built\-in parallel stub resolver, this option can slash scanning times\. .RE .PP \fB\-R\fR (DNS resolution for all targets) @@ -475,10 +513,12 @@ do reverse DNS resolution on the target IP addresses\. Normally reverse DNS is o .PP \fB\-\-system\-dns\fR (Use system DNS resolver) .RS 4 -By default, Nmap resolves IP addresses by sending queries directly to the name servers configured on your host and then listening for responses\. Many requests (often dozens) are performed in parallel to improve performance\. Specify this option to use your system resolver instead (one IP at a time via the getnameinfo() call)\. This is slower and rarely useful unless you find a bug in the Nmap parallel resolver (please let us know if you do)\. The system resolver is always used for IPv6 scans\. +By default, Nmap resolves IP addresses by sending queries directly to the name servers configured on your host and then listening for responses\. Many requests (often dozens) are performed in parallel to improve performance\. Specify this option to use your system resolver instead (one IP at a time via the +\fBgetnameinfo\fR +call)\. This is slower and rarely useful unless you find a bug in the Nmap parallel resolver (please let us know if you do)\. The system resolver is always used for IPv6 scans\. .RE .PP -\fB\-\-dns\-servers \fR (Servers to use for reverse DNS queries) +\fB\-\-dns\-servers \fR\fB\fIserver1\fR\fR\fB[,\fIserver2\fR[,\.\.\.]]\fR\fB \fR (Servers to use for reverse DNS queries) .RS 4 By default Nmap will try to determine your DNS servers (for rDNS resolution) from your resolv\.conf file (Unix) or the Registry (Win32)\. Alternatively, you may use this option to specify alternate servers\. This option is not honored if you are using \fB\-\-system\-dns\fR @@ -528,7 +568,7 @@ The unfiltered state means that a port is accessible, but Nmap is unable to dete .PP open|filtered .RS 4 -Nmap places ports in this state when it is unable to determine whether a port is open or filtered\. This occurs for scan types in which open ports give no response\. The lack of response could also mean that a packet filter dropped the probe or any response it elicited\. So Nmap does not know for sure whether the port is open or being filtered\. The UDP, IP protocol, FIN, null, and Xmas scans classify ports this way\. +Nmap places ports in this state when it is unable to determine whether a port is open or filtered\. This occurs for scan types in which open ports give no response\. The lack of response could also mean that a packet filter dropped the probe or any response it elicited\. So Nmap does not know for sure whether the port is open or being filtered\. The UDP, IP protocol, FIN, NULL, and Xmas scans classify ports this way\. .RE .PP closed|filtered @@ -537,11 +577,14 @@ This state is used when Nmap is unable to determine whether a port is closed or .RE .SH "PORT SCANNING TECHNIQUES" .PP -As a novice performing automotive repair, I can struggle for hours trying to fit my rudimentary tools (hammer, duct tape, wrench, etc\.) to the task at hand\. When I fail miserably and tow my jalopy to a real mechanic, he invariably fishes around in a huge tool chest until pulling out the perfect gizmo which makes the job seem effortless\. The art of port scanning is similar\. Experts understand the dozens of scan techniques and choose the appropriate one (or combination) for a given task\. Inexperienced users and script kiddies, on the other hand, try to solve every problem with the default SYN scan\. Since Nmap is free, the only barrier to port scanning mastery is knowledge\. That certainly beats the automotive world, where it may take great skill to determine that you need a strut spring compressor, then you still have to pay thousands of dollars for it\. +As a novice performing automotive repair, I can struggle for hours trying to fit my rudimentary tools (hammer, duct tape, wrench, etc\.) to the task at hand\. When I fail miserably and tow my jalopy to a real mechanic, he invariably fishes around in a huge tool chest until pulling out the perfect gizmo which makes the job seem effortless\. The art of port scanning is similar\. Experts understand the dozens of scan techniques and choose the appropriate one (or combination) for a given task\. Inexperienced users and script kiddies, +on the other hand, try to solve every problem with the default SYN scan\. Since Nmap is free, the only barrier to port scanning mastery is knowledge\. That certainly beats the automotive world, where it may take great skill to determine that you need a strut spring compressor, then you still have to pay thousands of dollars for it\. .PP -Most of the scan types are only available to privileged users\. This is because they send and receive raw packets, which requires root access on Unix systems\. Using an administrator account on Windows is recommended, though Nmap sometimes works for unprivileged users on that platform when WinPcap has already been loaded into the OS\. Requiring root privileges was a serious limitation when Nmap was released in 1997, as many users only had access to shared shell accounts\. Now, the world is different\. Computers are cheaper, far more people have always\-on direct Internet access, and desktop Unix systems (including Linux and Mac OS X) are prevalent\. A Windows version of Nmap is now available, allowing it to run on even more desktops\. For all these reasons, users have less need to run Nmap from limited shared shell accounts\. This is fortunate, as the privileged options make Nmap far more powerful and flexible\. +Most of the scan types are only available to privileged users\. +This is because they send and receive raw packets, +which requires root access on Unix systems\. Using an administrator account on Windows is recommended, though Nmap sometimes works for unprivileged users on that platform when WinPcap has already been loaded into the OS\. Requiring root privileges was a serious limitation when Nmap was released in 1997, as many users only had access to shared shell accounts\. Now, the world is different\. Computers are cheaper, far more people have always\-on direct Internet access, and desktop Unix systems (including Linux and Mac OS X) are prevalent\. A Windows version of Nmap is now available, allowing it to run on even more desktops\. For all these reasons, users have less need to run Nmap from limited shared shell accounts\. This is fortunate, as the privileged options make Nmap far more powerful and flexible\. .PP -While Nmap attempts to produce accurate results, keep in mind that all of its insights are based on packets returned by the target machines (or firewalls in front of them)\. Such hosts may be untrustworthy and send responses intended to confuse or mislead Nmap\. Much more common are non\-RFC\-compliant hosts that do not respond as they should to Nmap probes\. FIN, null, and Xmas scans are particularly susceptible to this problem\. Such issues are specific to certain scan types and so are discussed in the individual scan type entries\. +While Nmap attempts to produce accurate results, keep in mind that all of its insights are based on packets returned by the target machines (or firewalls in front of them)\. Such hosts may be untrustworthy and send responses intended to confuse or mislead Nmap\. Much more common are non\-RFC\-compliant hosts that do not respond as they should to Nmap probes\. FIN, NULL, and Xmas scans are particularly susceptible to this problem\. Such issues are specific to certain scan types and so are discussed in the individual scan type entries\. .PP This section documents the dozen or so port scan techniques supported by Nmap\. Only one method may be used at a time, except that UDP scan (\fB\-sU\fR) may be combined with any one of the TCP scan types\. As a memory aid, port scan type options are of the form \fB\-s\fR\fB\fIC\fR\fR, where @@ -550,7 +593,7 @@ is a prominent character in the scan name, usually the first\. The one exception .PP \fB\-sS\fR (TCP SYN scan) .RS 4 -SYN scan is the default and most popular scan option for good reasons\. It can be performed quickly, scanning thousands of ports per second on a fast network not hampered by restrictive firewalls\. SYN scan is relatively unobtrusive and stealthy, since it never completes TCP connections\. It also works against any compliant TCP stack rather than depending on idiosyncrasies of specific platforms as Nmap\'s FIN/null/Xmas, Maimon and idle scans do\. It also allows clear, reliable differentiation between the +SYN scan is the default and most popular scan option for good reasons\. It can be performed quickly, scanning thousands of ports per second on a fast network not hampered by restrictive firewalls\. SYN scan is relatively unobtrusive and stealthy, since it never completes TCP connections\. It also works against any compliant TCP stack rather than depending on idiosyncrasies of specific platforms as Nmap\'s FIN/NULL/Xmas, Maimon and idle scans do\. It also allows clear, reliable differentiation between the open, closed, and filtered @@ -562,11 +605,11 @@ This technique is often referred to as half\-open scanning, because you don\'t o \fB\-sT\fR (TCP connect scan) .RS 4 TCP connect scan is the default TCP scan type when SYN scan is not an option\. This is the case when a user does not have raw packet privileges or is scanning IPv6 networks\. Instead of writing raw packets as most other scan types do, Nmap asks the underlying operating system to establish a connection with the target machine and port by issuing the -connect() +\fBconnect\fR system call\. This is the same high\-level system call that web browsers, P2P clients, and most other network\-enabled applications use to establish a connection\. It is part of a programming interface known as the Berkeley Sockets API\. Rather than read raw packet responses off the wire, Nmap uses this API to obtain status information on each connection attempt\. .sp When SYN scan is available, it is usually a better choice\. Nmap has less control over the high level -connect() +\fBconnect\fR call than with raw packets, making it less efficient\. The system call completes connections to open target ports rather than performing the half\-open reset that SYN scan does\. Not only does this take longer and require more packets to obtain the same information, but target machines are more likely to log the connection\. A decent IDS will catch either, but most machines have no such alarm system\. Many services on your average Unix system will add a note to syslog, and sometimes a cryptic error message, when Nmap connects and then closes the connection without sending data\. Truly pathetic services crash when this happens, though that is uncommon\. An administrator who sees a bunch of connection attempts in her logs from a single system should know that she has been connect scanned\. .RE .PP @@ -584,9 +627,10 @@ UDP scan works by sending an empty (no data) UDP header to every targeted port\. closed\. Other ICMP unreachable errors (type 3, codes 1, 2, 9, 10, or 13) mark the port as filtered\. Occasionally, a service will respond with a UDP packet, proving that it is open\. If no response is received after retransmissions, the port is classified as -open|filtered\. This means that the port could be open, or perhaps packet filters are blocking the communication\. Versions scan (\fB\-sV\fR) can be used to help differentiate the truly open ports from the filtered ones\. +open|filtered\. This means that the port could be open, or perhaps packet filters are blocking the communication\. Version detection (\fB\-sV\fR) can be used to help differentiate the truly open ports from the filtered ones\. .sp -A big challenge with UDP scanning is doing it quickly\. Open and filtered ports rarely send any response, leaving Nmap to time out and then conduct retransmissions just in case the probe or response were lost\. Closed ports are often an even bigger problem\. They usually send back an ICMP port unreachable error\. But unlike the RST packets sent by closed TCP ports in response to a SYN or connect scan, many hosts rate limit ICMP port unreachable messages by default\. Linux and Solaris are particularly strict about this\. For example, the Linux 2\.4\.20 kernel limits destination unreachable messages to one per second (in +A big challenge with UDP scanning is doing it quickly\. Open and filtered ports rarely send any response, leaving Nmap to time out and then conduct retransmissions just in case the probe or response were lost\. Closed ports are often an even bigger problem\. They usually send back an ICMP port unreachable error\. But unlike the RST packets sent by closed TCP ports in response to a SYN or connect scan, many hosts rate limit +ICMP port unreachable messages by default\. Linux and Solaris are particularly strict about this\. For example, the Linux 2\.4\.20 kernel limits destination unreachable messages to one per second (in \fInet/ipv4/icmp\.c\fR)\. .sp Nmap detects rate limiting and slows down accordingly to avoid flooding the network with useless packets that the target machine will drop\. Unfortunately, a Linux\-style limit of one packet per second makes a 65,536\-port scan take more than 18 hours\. Ideas for speeding your UDP scans up include scanning more hosts in parallel, doing a quick scan of just the popular ports first, scanning from behind the firewall, and using @@ -594,7 +638,7 @@ Nmap detects rate limiting and slows down accordingly to avoid flooding the netw to skip slow hosts\. .RE .PP -\fB\-sN\fR; \fB\-sF\fR; \fB\-sX\fR (TCP Null, FIN, and Xmas scans) +\fB\-sN\fR; \fB\-sF\fR; \fB\-sX\fR (TCP NULL, FIN, and Xmas scans) .RS 4 These three scan types (even more are possible with the \fB\-\-scanflags\fR @@ -604,7 +648,7 @@ to differentiate between open and closed -ports\. Page 65 says that +ports\. Page 65 of RFC 793 says that \(lqif the [destination] port state is CLOSED \.\.\.\. an incoming segment not containing a RST causes a RST to be sent in response\.\(rq Then the next page discusses packets sent to open ports without the SYN, RST, or ACK bits set, stating that: \(lqyou are unlikely to get here, but if you do, drop the segment, and return\.\(rq @@ -683,7 +727,11 @@ filtered, the system is most likely susceptible\. Occasionally, systems will eve .PP \fB\-sM\fR (TCP Maimon scan) .RS 4 -The Maimon scan is named after its discoverer, Uriel Maimon\. He described the technique in Phrack Magazine issue #49 (November 1996)\. Nmap, which included this technique, was released two issues later\. This technique is exactly the same as null, FIN, and Xmas scans, except that the probe is FIN/ACK\. According to +The Maimon scan is named after its discoverer, Uriel Maimon\. +He described the technique in +Phrack +Magazine issue #49 (November 1996)\. +Nmap, which included this technique, was released two issues later\. This technique is exactly the same as NULL, FIN, and Xmas scans, except that the probe is FIN/ACK\. According to \fIRFC 793\fR\&[5] (TCP), a RST packet should be generated in response to such a probe whether the port is open or closed\. However, Uriel noticed that many BSD\-derived systems simply drop the packet if the port is open\. .RE @@ -692,7 +740,9 @@ The Maimon scan is named after its discoverer, Uriel Maimon\. He described the t .RS 4 Truly advanced Nmap users need not limit themselves to the canned scan types offered\. The \fB\-\-scanflags\fR -option allows you to design your own scan by specifying arbitrary TCP flags\. Let your creative juices flow, while evading intrusion detection systems whose vendors simply paged through the Nmap man page adding specific rules! +option allows you to design your own scan by specifying arbitrary TCP flags\. +Let your creative juices flow, while evading intrusion detection systems +whose vendors simply paged through the Nmap man page adding specific rules! .sp The \fB\-\-scanflags\fR @@ -715,14 +765,15 @@ port, while a FIN scan treats the same as open|filtered\. Nmap will behave the same way it does for the base scan type, except that it will use the TCP flags you specify instead\. If you don\'t specify a base type, SYN scan is used\. .RE .PP -\fB\-sI \fR (idle scan) +\fB\-sI \fR\fB\fIzombie host\fR\fR\fB[:\fIprobeport\fR]\fR (idle scan) .RS 4 This advanced scan method allows for a truly blind TCP port scan of the target (meaning no packets are sent to the target from your real IP address)\. Instead, a unique side\-channel attack exploits predictable IP fragmentation ID sequence generation on the zombie host to glean information about the open ports on the target\. IDS systems will display the scan as coming from the zombie machine you specify (which must be up and meet certain criteria)\. This fascinating scan type is too complex to fully describe in this reference guide, so I wrote and posted an informal paper with full details at \fI\%http://nmap.org/book/idlescan.html\fR\. .sp Besides being extraordinarily stealthy (due to its blind nature), this scan type permits mapping out IP\-based trust relationships between machines\. The port listing shows open ports \fIfrom the perspective of the zombie host\.\fR -So you can try scanning a target using various zombies that you think might be trusted (via router/packet filter rules)\. +So you can try scanning a target using various zombies that you think might be trusted +(via router/packet filter rules)\. .sp You can add a colon followed by a port number to the zombie host if you wish to probe a particular port on the zombie for IP ID changes\. Otherwise Nmap will use the port it uses by default for TCP pings (80)\. .RE @@ -733,9 +784,11 @@ IP protocol scan allows you to determine which IP protocols (TCP, ICMP, IGMP, et \fB\-p\fR option to select scanned protocol numbers, reports its results within the normal port table format, and even uses the same underlying scan engine as the true port scanning methods\. So it is close enough to a port scan that it belongs here\. .sp -Besides being useful in its own right, protocol scan demonstrates the power of open source software\. While the fundamental idea is pretty simple, I had not thought to add it nor received any requests for such functionality\. Then in the summer of 2000, Gerhard Rieger conceived the idea, wrote an excellent patch implementing it, and sent it to the +Besides being useful in its own right, protocol scan demonstrates the power of open\-source software\. While the fundamental idea is pretty simple, I had not thought to add it nor received any requests for such functionality\. Then in the summer of 2000, Gerhard Rieger +conceived the idea, wrote an excellent patch implementing it, and sent it to the nmap\-hackers -mailing list\. I incorporated that patch into the Nmap tree and released a new version the next day\. Few pieces of commercial software have users enthusiastic enough to design and contribute their own improvements! +mailing list\. +I incorporated that patch into the Nmap tree and released a new version the next day\. Few pieces of commercial software have users enthusiastic enough to design and contribute their own improvements! .sp Protocol scan works in a similar fashion to UDP scan\. Instead of iterating through the port number field of a UDP packet, it sends IP packet headers and iterates through the 8\-bit IP protocol field\. The headers are usually empty, containing no data and not even the proper header for the claimed protocol\. The three exceptions are TCP, UDP, and ICMP\. A proper protocol header for those is included since some systems won\'t send them otherwise and because Nmap already has functions to create them\. Instead of watching for ICMP port unreachable messages, protocol scan is on the lookout for ICMP \fIprotocol\fR @@ -750,7 +803,7 @@ at the same time)\. If no response is received after retransmissions, the protoc open|filtered .RE .PP -\fB\-b \fR (FTP bounce scan) +\fB\-b \fR\fB\fIFTP relay host\fR\fR (FTP bounce scan) .RS 4 An interesting feature of the FTP protocol (\fIRFC 959\fR\&[6]) is support for so\-called proxy FTP connections\. This allows a user to connect to one FTP server, then ask that files be sent to a third\-party server\. Such a feature is ripe for abuse on many levels, so most servers have ceased supporting it\. One of the abuses this feature allows is causing the FTP server to port scan other hosts\. Simply ask the FTP server to send a file to each interesting port of a target host in turn\. The error message will describe whether the port is open or not\. This is a good way to bypass firewalls because organizational FTP servers are often placed where they have more access to other internal hosts than any old Internet host would\. Nmap supports FTP bounce scan with the \fB\-b\fR @@ -772,11 +825,13 @@ In addition to all of the scan methods discussed previously, Nmap offers options \fInmap\-services\fR file for the protocol(s) being scanned\. .PP -\fB\-p \fR (Only scan specified ports) +\fB\-p \fR\fB\fIport ranges\fR\fR (Only scan specified ports) .RS 4 -This option specifies which ports you want to scan and overrides the default\. Individual port numbers are OK, as are ranges separated by a hyphen (e\.g\. 1\-1023)\. The beginning and/or end values of a range may be omitted, causing Nmap to use 1 and 65535, respectively\. So you can specify +This option specifies which ports you want to scan and overrides the default\. Individual port numbers are OK, as are ranges separated by a hyphen (e\.g\. +1\-1023)\. The beginning and/or end values of a range may be omitted, causing Nmap to use 1 and 65535, respectively\. So you can specify \fB\-p\-\fR -to scan ports from 1 through 65535\. Scanning port zero is allowed if you specify it explicitly\. For IP protocol scanning (\fB\-sO\fR), this option specifies the protocol numbers you wish to scan for (0\-255)\. +to scan ports from 1 through 65535\. Scanning port zero +is allowed if you specify it explicitly\. For IP protocol scanning (\fB\-sO\fR), this option specifies the protocol numbers you wish to scan for (0\-255)\. .sp When scanning both TCP and UDP ports, you can specify a particular protocol by preceding the port numbers by T: @@ -790,6 +845,7 @@ and at least one TCP scan type (such as \fB\-sF\fR, or \fB\-sT\fR)\. If no protocol qualifier is given, the port numbers are added to all protocol lists\. .sp + Ports can also be specified by name according to what the port is referred to in the \fInmap\-services\fR\. You can even use the wildcards * and ? with the names\. For example, to scan FTP and all ports whose names begin with http, use \fB\-p ftp,http*\fR\. Be careful about shell expansions and quote the argument to @@ -829,13 +885,17 @@ for sequential port scanning instead\. .PP Point Nmap at a remote machine and it might tell you that ports 25/tcp, 80/tcp, and 53/udp are open\. Using its \fInmap\-services\fR -database of about 2,200 well\-known services, Nmap would report that those ports probably correspond to a mail server (SMTP), web server (HTTP), and name server (DNS) respectively\. This lookup is usually accurate\(emthe vast majority of daemons listening on TCP port 25 are, in fact, mail servers\. However, you should not bet your security on this! People can and do run services on strange ports\. +database of about 2,200 well\-known services, +Nmap would report that those ports probably correspond to a mail server (SMTP), web server (HTTP), and name server (DNS) respectively\. This lookup is usually accurate\(emthe vast majority of daemons listening on TCP port 25 are, in fact, mail servers\. However, you should not bet your security on this! People can and do run services on strange ports\. .PP Even if Nmap is right, and the hypothetical server above is running SMTP, HTTP, and DNS servers, that is not a lot of information\. When doing vulnerability assessments (or even simple network inventories) of your companies or clients, you really want to know which mail and DNS servers and versions are running\. Having an accurate version number helps dramatically in determining which exploits a server is vulnerable to\. Version detection helps you obtain this information\. .PP After TCP and/or UDP ports are discovered using one of the other scan methods, version detection interrogates those ports to determine more about what is actually running\. The \fInmap\-service\-probes\fR -database contains probes for querying various services and match expressions to recognize and parse responses\. Nmap tries to determine the service protocol (e\.g\. FTP, SSH, telnet, HTTP), the application name (e\.g\. ISC BIND, Apache httpd, Solaris telnetd), the version number, hostname, device type (e\.g\. printer, router), the OS family (e\.g\. Windows, Linux) and sometimes miscellaneous details like whether an X server is open to connections, the SSH protocol version, or the KaZaA user name)\. Of course, most services don\'t provide all of this information\. If Nmap was compiled with OpenSSL support, it will connect to SSL servers to deduce the service listening behind that encryption layer\. When RPC services are discovered, the Nmap RPC grinder (\fB\-sR\fR) is automatically used to determine the RPC program and version numbers\. Some UDP ports are left in the +database contains probes for querying various services and match expressions to recognize and parse responses\. Nmap tries to determine the service protocol (e\.g\. FTP, SSH, telnet, HTTP), the application name (e\.g\. ISC BIND, Apache httpd, Solaris telnetd), the version number, hostname, device type (e\.g\. printer, router), the OS family (e\.g\. Windows, Linux) and sometimes miscellaneous details like whether an X server is open to connections, the SSH protocol version, or the KaZaA user name)\. Of course, most services don\'t provide all of this information\. If Nmap was compiled with OpenSSL support, it will connect to SSL servers to deduce the service listening behind that encryption layer\. +When RPC services are discovered, the Nmap RPC grinder +(\fB\-sR\fR) +is automatically used to determine the RPC program and version numbers\. Some UDP ports are left in the open|filtered state after a UDP port scan is unable to determine whether the port is open or filtered\. Version detection will try to elicit a response from these ports (just as it does with open ports), and change the state to open if it succeeds\. open|filtered @@ -866,9 +926,13 @@ Exclude directive\. .RE .PP -\fB\-\-version\-intensity \fR (Set version scan intensity) +\fB\-\-version\-intensity \fR\fB\fIintensity\fR\fR (Set version scan intensity) .RS 4 -When performing a version scan (\fB\-sV\fR), nmap sends a series of probes, each of which is assigned a rarity value between 1 and 9\. The lower\-numbered probes are effective against a wide variety of common services, while the higher numbered ones are rarely useful\. The intensity level specifies which probes should be applied\. The higher the number, the more likely it is the service will be correctly identified\. However, high intensity scans take longer\. The intensity must be between 0 and 9\. The default is 7\. When a probe is registered to the target port via the +When performing a version scan (\fB\-sV\fR), nmap sends a series of probes, each of which is assigned a rarity value between 1 and 9\. The lower\-numbered probes are effective against a wide variety of common services, while the higher numbered ones are rarely useful\. The intensity level specifies which probes should be applied\. The higher the number, the more likely it is the service will be correctly identified\. However, high intensity scans take longer\. The intensity must be between 0 and 9\. + +The default is 7\. + +When a probe is registered to the target port via the \fInmap\-service\-probes\fR ports directive, that probe is tried regardless of intensity level\. This ensures that the DNS probes will always be attempted against any open port 53, the SSL probe will be done against 443, etc\. @@ -896,7 +960,8 @@ This causes Nmap to print out extensive debugging info about what version scanni .RS 4 This method works in conjunction with the various port scan methods of Nmap\. It takes all the TCP/UDP ports found open and floods them with SunRPC program NULL commands in an attempt to determine whether they are RPC ports, and if so, what program and version number they serve up\. Thus you can effectively obtain the same info as \fBrpcinfo \-p\fR -even if the target\'s portmapper is behind a firewall (or protected by TCP wrappers)\. Decoys do not currently work with RPC scan\. This is automatically enabled as part of version scan (\fB\-sV\fR) if you request that\. As version detection includes this and is much more comprehensive, +even if the target\'s portmapper is behind a firewall (or protected by TCP wrappers)\. Decoys do not currently work with RPC scan\. +This is automatically enabled as part of version scan (\fB\-sV\fR) if you request that\. As version detection includes this and is much more comprehensive, \fB\-sR\fR is rarely needed\. .RE @@ -904,7 +969,7 @@ is rarely needed\. .PP One of Nmap\'s best\-known features is remote OS detection using TCP/IP stack fingerprinting\. Nmap sends a series of TCP and UDP packets to the remote host and examines practically every bit in the responses\. After performing dozens of tests such as TCP ISN sampling, TCP options support and ordering, IP ID sampling, and the initial window size check, Nmap compares the results to its \fInmap\-os\-db\fR -database of more than 800 known OS fingerprints and prints out the OS details if there is a match\. Each fingerprint includes a freeform textual description of the OS, and a classification which provides the vendor name (e\.g\. Sun), underlying OS (e\.g\. Solaris), OS generation (e\.g\. 10), and device type (general purpose, router, switch, game console, etc)\. +database of more than a thousand known OS fingerprints and prints out the OS details if there is a match\. Each fingerprint includes a freeform textual description of the OS, and a classification which provides the vendor name (e\.g\. Sun), underlying OS (e\.g\. Solaris), OS generation (e\.g\. 10), and device type (general purpose, router, switch, game console, etc)\. .PP If Nmap is unable to guess the OS of a machine, and conditions are good (e\.g\. at least one open port and one closed port were found), Nmap will provide a URL you can use to submit the fingerprint if you know (for sure) the OS running on the machine\. By doing this you contribute to the pool of operating systems known to Nmap and thus it will be more accurate for everyone\. .PP @@ -951,65 +1016,27 @@ value (such as 1) speeds Nmap up, though you miss out on retries which could pot .RE .SH "NMAP SCRIPTING ENGINE (NSE)" .PP -The Nmap Scripting Engine (NSE) combines the efficiency of Nmap\'s network handling with the versatility of the lightweight scripting language -\fILua\fR\&[8], thus providing innumerable opportunities\. A more extensive documentation of the NSE (including its API) can be found -at \fI\%http://nmap.org/book/nse.html\fR\. - -The target of the NSE is to provide Nmap with a flexible infrastructure for extending its capabilities and offering its users a simple way of creating customized tests\. Uses for the NSE include (but definitely are not limited to): +The Nmap Scripting Engine (NSE) is one of Nmap\'s most powerful and flexible features\. It allows users to write (and share) simple scripts (using the +\fILua programming language\fR\&[8], +) to automate a wide variety of networking tasks\. Those scripts are executed in parallel with the speed and efficiency you expect from Nmap\. Users can rely on the growing and diverse set of scripts distributed with Nmap, or write their own to meet custom needs\. .PP - -\fIEnhanced version detection\fR -(category -version)\(emWhile Nmap already offers its Service and Version detection system, which is unmatched in terms of efficiency and scope, this power has its downside when it comes to services requiring more complex probes\. The Skype\-Protocol version 2 for instance can be identified by sending 2 independent probes to it, which the built\-in system is not laid out for: a simple NSE\-script can do the job and update the port\'s service information\. +Tasks we had in mind when creating the system include network discovery, more sophisticated version detection, vulnerability detection\. NSE can even be used for vulnerability exploitation\. .PP - -\fIMalware\-detection\fR -(category -malware)\(emBoth attackers and worms often leave backdoors\(embe it in form of SMTP\-servers listening on uncommon ports mostly used by spammers for mail relay, or in form of an FTP\-server giving crackers access to critical data\. A few lines of Lua code can help to identify those loopholes easily\. -.PP - -\fIVulnerability Detection\fR -(category -vuln)\(emNSE\'s capacity in detecting risks ranges from testing whether an SMTP server supports relaying mail from arbitrary domains to testing whether an HTTP server is vulnerable to directory traversal attacks\. -.PP - -\fIDetermination of Authentication Credentials\fR -(category -auth)\(emNSE can be used for determining authentication credentials on the target\'s services, with a common method being brute\-force attack\. -.PP - -\fINetwork Discovery and Information Gathering\fR -(categories +To reflect those different uses and to simplify the choice of which scripts to run, each script contains a field associating it with one or more categories\. Currently defined categories are safe, -intrusive -and -discovery)\(emBy providing you with a scripting language and a really efficient asynchronous network API on the one hand and the information gathered during earlier stages of a scan on the other hand the NSE is suited to write client programs for the services listening on a target machine\. These clients may collect information like: listings of available NFS/SMB/RPC shares, the number of channels of an irc\-network or currently logged on users\. +intrusive, +malware, +version, +discovery, +vuln, +auth, and +default\. These are all described +at \fI\%http://nmap.org/book/nse-usage.html#nse-categories\fR\. .PP -To reflect those different uses and to simplify the choice of which scripts to run, each script contains a field associating it with one or more of the above mentioned categories\. To maintain the matching from scripts to categories a file called -\fIscript\.db\fR -is installed along with the distributed scripts\. Therefore, if you, for example, want to see if a machine is infected by any worm Nmap provides a script for you can simply run -\fBnmap \-\-script=malware target\-ip\fR -and check the output afterwards\. The -version -scripts are always run implicitly when a script\-scan is requested\. The -\fIscript\.db\fR -is a Lua\-script itself and can be updated through the -\fB\-\-script\-updatedb\fR -option\. -.PP -A NSE\-script basically is a chunk of Lua\-code which has (among some informational fields, like name, id and categories) 2 functions: a test whether the particular script should be run against a certain host or port (called a -hostrule -or -portrule -respectively) and an -action -to be carried out if the test returns true\. Scripts have access to most information gathered by Nmap during earlier stages\. For each host this includes the IP address, hostname and (if available) operating system\. If a script is targeted at a port it has access to the portnumber, the protocol (tcp, -udp -or -ssl), the service running behind that port, and optionally information from a version\-scan\. NSE scripts by convention have an -nse -extension\. Although you are not required to follow this for the moment, this may change in the future\. Nmap will issue a warning if a file has any other extension\. More extensive documentation on the NSE, including a description of its API can be found -at \fI\%http://nmap.org/book/nse.html\fR\. +The Nmap Scripting Engine is described in detail +at \fI\%http://nmap.org/book/nse.html\fR + +and is controlled by the following options: .PP \fB\-sC\fR .RS 4 @@ -1017,41 +1044,43 @@ Performs a script scan using the default set of scripts\. It is equivalent to \fB\-\-script=default\fR\. Some of the scripts in this category are considered intrusive and should not be run against a target network without permission\. .RE .PP -\fB\-\-script \fR +\fB\-\-script \fR\fB\fIscript\-categories\fR\fR\fB|\fR\fB\fIdirectory\fR\fR\fB|\fR\fB\fIfilename\fR\fR\fB|all\fR .RS 4 Runs a script scan (like -\fB\-sC\fR) with the scripts you have chosen rather than the defaults\. Arguments can be script categories, single scripts or directories with scripts which are to be run against the target hosts instead of the default set\. Nmap will try to interpret the arguments at first as categories and afterwards as files or directories\. Absolute paths are used as is, relative paths are searched in the following places until found: - +\fB\-sC\fR) using the comma\-separated list of script categories, individual scripts, or directories containing scripts, rather than the default set\. Nmap first tries to interpret the arguments as categories, then (if that fails) as files or directories\. A script or directory of scripts may be specified as an absolute or relative path\. Absolute paths are used as supplied\. Relative paths are searched for in the following places until found: \fI\-\-datadir/\fR; -\fI$(NMAPDIR)/\fR; -\fI~user/nmap/\fR +\fI$NMAPDIR/\fR; +\fI~/\.nmap/\fR (not searched on Windows); -\fINMAPDATADIR/\fR -or +NMAPDATADIR/ or \fI\./\fR\. A \fIscripts/\fR -subdirectory is also tried in each of these\. Give the argument -all -to execute all scripts in the Nmap script database\. +subdirectory is also tried in each of these\. .sp -If a directory is specified and found, Nmap loads all NSE scripts (any filenames with the +If a directory is specified and found, Nmap loads all NSE scripts (any filenames ending with +\.nse) from that directory\. Filenames without the nse -extension) from that directory\. They must have the filename extension -nse\. Nmap does not recurse into subdirectories to find scripts\. When individual file names are specified, the file extension does not have to be +extension are ignored\. Nmap does not search recursively into subdirectories to find scripts\. If individual file names are specified, the file extension does not have to be nse\. .sp Nmap scripts are stored in a \fIscripts\fR -subdirectory of the Nmap data directory by default\. Scripts are indexed in a database stored in -\fIscripts/script\.db\fR\. The database lists all of the scripts in each category\. A single script may be in several categories\. +subdirectory of the Nmap data directory by default (see +Chapter\ 14, Understanding and Customizing Nmap Data Files)\. For efficiency, scripts are indexed in a database stored in +\fIscripts/script\.db\fR\. +which lists the category or categories in which each script belongs\. Give the argument +all +to execute all scripts in the Nmap script database\. +.sp +Malicious scripts are not run in a sandbox and thus could damage your system or invade your privacy\. Never run scripts from third parties unless you trust the authors or have carefully audited the scripts yourself\. .RE .PP -\fB\-\-script\-args \fR +\fB\-\-script\-args \fR\fB\fIname1\fR\fR\fB=\fR\fB\fIvalue1\fR\fR\fB,\fR\fB\fIname2\fR\fR\fB={\fR\fB\fIname3\fR\fR\fB=\fR\fB\fIvalue3\fR\fR\fB},\fR\fB\fIname4\fR\fR\fB=\fR\fB\fIvalue4\fR\fR .RS 4 -lets you provide arguments to NSE\-scripts\. Arguments are passed as +lets you provide arguments to NSE scripts\. Arguments are passed as name=value pairs\. The provided argument is processed and stored inside a Lua table, to which all scripts have access\. The names are taken as strings (which must be alphanumeric values) and used as keys inside the -argument\-table\. Values are either strings or tables themselves (surrounded by \(oq{\(cq and \(oq}\(cq\. Subtables make it possible to override arguments for specific scripts (e\.g\. when you want to provide different login/password pairs for different scripts)\. For example, you could pass the comma\-separated arguments: +argument\-table\. Values are either strings or tables themselves (surrounded by \(oq{\(cq and \(oq}\(cq)\. Subtables make it possible to override arguments for specific scripts (e\.g\. when you want to provide different login/password pairs for different scripts)\. For example, you could pass the comma\-separated arguments: user=bar,password=foo, and anonFTP={password=nobody@foobar\.com}\. If you want to override an option to a script, you should index the subtable with the script\'s id, since this is the only way the script knows about its special argument\. @@ -1066,13 +1095,12 @@ does, just one ISO layer higher\. If this option is specified all incoming and o .PP \fB\-\-script\-updatedb\fR .RS 4 -updates the script database which stores a mapping from category tags to filenames\. The database is a Lua script which is interpreted once to choose a set of scripts from the categories provided to the -\fB\-\-script\fR -argument\. It should be run if you have changed the -categories -field of a script, if you have added new scripts or if you have removed scripts from the -\fIscripts/\fR -directory\. +This option updates the script database found in +\fIscripts/script\.db\fR +which is used by Nmap to determine the available default scripts and categories\. It is only necessary to update the database if you have added or removed NSE scripts from the default +\fIscripts\fR +directory or if you have changed the categories of any script\. This option is generally used by itself: +\fBnmap \-\-script\-updatedb\fR\. .RE .SH "TIMING AND PERFORMANCE" .PP @@ -1090,7 +1118,7 @@ arguments 15m all do the same thing\. .PP -\fB\-\-min\-hostgroup \fR; \fB\-\-max\-hostgroup \fR (Adjust parallel scan group sizes) +\fB\-\-min\-hostgroup \fR\fB\fInumhosts\fR\fR; \fB\-\-max\-hostgroup \fR\fB\fInumhosts\fR\fR (Adjust parallel scan group sizes) .RS 4 Nmap has the ability to port scan or version scan multiple hosts in parallel\. Nmap does this by dividing the target IP space into groups and then scanning one group at a time\. In general, larger groups are more efficient\. The downside is that host results can\'t be provided until the whole group is finished\. So if Nmap started out with a group size of 50, the user would not receive any reports (except for the updates offered in verbose mode) until the first 50 hosts are completed\. .sp @@ -1106,7 +1134,7 @@ These options do not have an effect during the host discovery phase of a scan\. The primary use of these options is to specify a large minimum group size so that the full scan runs more quickly\. A common choice is 256 to scan a network in Class C sized chunks\. For a scan with many ports, exceeding that number is unlikely to help much\. For scans of just a few port numbers, host group sizes of 2048 or more may be helpful\. .RE .PP -\fB\-\-min\-parallelism \fR; \fB\-\-max\-parallelism \fR (Adjust probe parallelization) +\fB\-\-min\-parallelism \fR\fB\fInumprobes\fR\fR; \fB\-\-max\-parallelism \fR\fB\fInumprobes\fR\fR (Adjust probe parallelization) .RS 4 These options control the total number of probes that may be outstanding for a host group\. They are used for port scanning and host discovery\. By default, Nmap calculates an ever\-changing ideal parallelism based on network performance\. If packets are being dropped, Nmap slows down and allows fewer outstanding probes\. The ideal probe number slowly rises as the network proves itself worthy\. These options place minimum or maximum bounds on that variable\. By default, the ideal parallelism can drop to 1 if the network proves unreliable and rise to several hundred in perfect conditions\. .sp @@ -1121,7 +1149,7 @@ option is sometimes set to one to prevent Nmap from sending more than one probe (discussed later), although the latter usually serves the purpose well enough by itself\. .RE .PP -\fB\-\-min\-rtt\-timeout