Digging deeper with Nmap

Okay everyone knows the basic nmap usage such as treating all hosts online with the "-PN" command, or probing ports to determine the services/versions are with the "-sV" command but I wanted to talk about alittle bit more than that. 


Here we will spoof our mac while scanning an intruder connected to our network  in order to determine what services they're running, then log in XML format for further analyzing while only displaying the open ports.


nmap 192.168.1.100 -sV --spoof-mac Cisco -oX nlog --open


We can also play with the nmap scripts that come packaged with the tool, these are excellent and if you haven't used them before than you're missing out. We will use the discovery scripts to obtain more information.


nmap 192.168.1.100 -sV --spoof-mac Cisco -oX nlog --open --script=discovery


We could also increase the intensity of the service detection (-sV) with "--version-all". This would try every probe that's available. We may also want to enable OS detection by issuing the "-O" option. We could also just use the "-A" command to enable OS and service detection, traceroute and default script scanning. Keep in mind doing this would make for a noisy and potentially detectable scan. I


In addition to the discovery scripts we could use other script categories such as the "intrusive" or "auth" categories which you can read more about here - http://nmap.org/book/nse-usage.html

We can also do things to increase anonymity and evade Intrusion Detection Systems (IDS) such as using the SYN stealth scan, adding random data to the packets sent and fragmenting them, we will also use the "-iR" command to scan random IP's.

nmap -iR 100 -sS --spoof-mac Cisco --data-length 9 -f


That's where I'll end this little "tutorial", hope someone finds this useful.

Basic Tshark Capture Filters

Well I've been playing around with Tshark so I decided I should make a quick post on using basic filters because it's a great feature and really makes Tshark worth using. For those who don't know what Tshark is, it's the terminal based version of Wireshark.


Getting down to it, if we want to only monitor activity on a certain port, IRC for example, we would issue the following command.


tshark -f "tcp port 6667" -i eth0


If we wanted to log the packets we could do this;


tshark -f "tcp port 6667" -w /home/tlog -i eth0


This would log the packets but it wouldn't allow us to see the packets in real time, so to override that we can add a "-S". You can also just use -f "port 6667" if you want both UDP and TCP packets. You can also increase the information that's displayed by increasing the verbosity with "-V"


tshark -f "port 6667" -w /home/tlog -S -V -i eth0


If perhaps we were looking to filter out specific websites we could use the following;


tshark -f "src www.hakhub.blogspot.com" -w /home/tlog -S -V -i eth0


You could also specify a port like this;


tshark -f "src www.hakhub.blogspot.com and port 80" -w /home/tlog -S -V -i eth0


And this is where I'll end this example of the tshark capture filter usage, there's also a read filter which you can find more information about here - http://www.wireshark.org/docs/man-pages/wireshark-filter.html

Nmap Log Parser - Creates an IP list from a log

Well I've made this quick log parser in Java for use with Nmap logs and grabbing the IP's to be written to another file in a list format for use with other tools. Below you can find both the source and the jar.

Source - http://pastebin.com/M5pLbQ2C
Jar - http://www.mediafire.com/?bp86q62t3pdrvd3

Quick way to find IP/Mac's on your network.

Normally I use fping to find out if there's other people on the network but came across a slightly quicker way - "arp-scan". You can get it through your distro's repositories. A quick example usage below;

arp-scan -l -v -I wlan0

The "-l" displays the ip and mac's on the network and the "-v" is just for verbosity, because we all love that.

Interface: eth0, datalink type: EN10MB (Ethernet)
DEBUG: pcap filter string: "arp and ether dst 00:17:31:da:98:14"
DEBUG: Loaded 10353 IEEE OUI/Vendor entries from /usr/share/arp-scan/ieee-oui.txt.
DEBUG: Loaded 1892 IEEE IAB/Vendor entries from /usr/share/arp-scan/ieee-iab.txt.
DEBUG: Loaded 5 MAC/Vendor entries from /usr/share/arp-scan/mac-vendor.txt.
DEBUG: Using 10.0.0.0:255.255.255.0 for localnet
DEBUG: pkt len=64 bytes, bandwidth=256000 bps, interval=2000 us
Starting arp-scan 1.6 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
10.0.0.1    60:20:11:a3:e4:76    (Unknown)    Padding=0000000000000000000000000000e8f6
10.0.0.5                    00:f4:19:84:0d:4d    (Unknown)    Padding=0000000000000000000000000000c9e0
---    Pass 1 complete
---    Pass 2 complete

2 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.6: 256 hosts scanned in 1.419 seconds (180.41 hosts/sec).  2 responded