nmap
Nmap: a free, open-source security tool for network exploration and auditing; identifies hosts, open ports, services, OS, and potential vulnerabilities.
Nmap, short for Network Mapper, is a free and open-source security tool used for network exploration, management, and security auditing. It is designed to provide users with a comprehensive and accurate view of a network's structure, devices, and services. Nmap uses a variety of techniques to identify active hosts, operating systems, open ports, and running services.
One of the primary features of Nmap is its ability to conduct "port scanning," which is the process of scanning a host or network for open ports. This is done by sending packets to various ports on the target machine, and analyzing the responses received. The information gathered from port scanning can be used to determine which services are running on the target machine, and identify potential vulnerabilities that could be exploited by an attacker.
Nmap also has the ability to detect the operating system (OS) of a target machine. This is done by analyzing the responses received from the machine during the port scanning process. Nmap uses various techniques to identify the OS, such as analyzing the TTL values of packets received, examining the responses to TCP/IP fingerprinting, and analyzing the behavior of the target machine during the scanning process.
Another feature of Nmap is its ability to perform "service enumeration," which is the process of identifying the services that are running on a target machine. This is done by analyzing the responses received from the machine during the port scanning process. Nmap can identify a wide variety of services, including HTTP, SMTP, FTP, DNS, SSH, and more.
In addition to these features, Nmap also includes a variety of other tools and features that make it a valuable security tool. For example, it includes the ability to perform "traceroute" functionality, which can be used to determine the path that packets take between two hosts. It also includes the ability to perform "ping scanning," which is the process of sending ICMP packets to a target machine to determine if it is active.
Nmap can be used by both security professionals and system administrators to identify potential vulnerabilities and security risks in their network. It can also be used by attackers to identify potential targets and vulnerabilities in a network. However, it should be noted that using Nmap for malicious purposes is illegal and can result in severe legal consequences.
Overall, Nmap is a powerful and versatile security tool that can be used to provide valuable information about a network's structure and security posture. Its ease of use, comprehensive feature set, and open-source nature make it a popular choice among security professionals and enthusiasts alike.
nmap Usage Example
Scan in verbose mode (-v), enable OS detection, version detection, script scanning, and traceroute (-A), with version detection (-sV) against the target IP (192.168.1.1):
:~# nmap -v -A -sV 192.168.1.1
Starting Nmap 6.45 ( http://nmap.org ) at 2014-05-13 18:40 MDT
NSE: Loaded 118 scripts for scanning.
NSE: Script Pre-scanning.
Initiating ARP Ping Scan at 18:40
Scanning 192.168.1.1 [1 port]
Completed ARP Ping Scan at 18:40, 0.06s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 18:40
Completed Parallel DNS resolution of 1 host. at 18:40, 0.00s elapsed
Initiating SYN Stealth Scan at 18:40
Scanning router.localdomain (192.168.1.1) [1000 ports]
Discovered open port 53/tcp on 192.168.1.1
Discovered open port 22/tcp on 192.168.1.1
Discovered open port 80/tcp on 192.168.1.1
Discovered open port 3001/tcp on 192.168.1.1nping Usage Example
Using TCP mode (–tcp) to probe port 22 (-p 22) using the SYN flag (–flags syn) with a TTL of 2 (–ttl 2) on the remote host (192.168.1.1):
ndiff Usage Example
Compare yesterday’s port scan (yesterday.xml) with the scan from today (today.xml):
ncat Usage Example
Be verbose (-v), running /bin/bash on connect (–exec “/bin/bash”), only allowing 1 IP address (–allow 192.168.1.123), listen on TCP port 4444 (-l 4444), and keep the listener open on disconnect (–keep-open):
Packages and Binaries:
ncat
ncat is a reimplementation of Netcat by the NMAP project, providing most of the features present in the original implementations, along with some new features such as IPv6 and SSL support. Port scanning support has been removed.
Installed size: 820 KB
How to install: sudo apt install ncat
ncat
Concatenate and redirect sockets
ndiff
Ndiff is a tool to aid in the comparison of Nmap scans. It takes two Nmap XML output files and prints the differences between them them: hosts coming up and down, ports becoming open or closed, and things like that. It can produce output in human-readable text or machine-readable XML formats.
Installed size: 423 KB
How to install: sudo apt install ndiff
ndiff
Utility to compare the results of Nmap scans
nmap
Nmap is a utility for network exploration or security auditing. It supports ping scanning (determine which hosts are up), many port scanning techniques, version detection (determine service protocols and application versions listening behind ports), and TCP/IP fingerprinting (remote host OS or device identification). Nmap also offers flexible target and port specification, decoy/stealth scanning, sunRPC scanning, and more. Most Unix and Windows platforms are supported in both GUI and commandline modes. Several popular handheld devices are also supported, including the Sharp Zaurus and the iPAQ.
Installed size: 4.85 MB
How to install: sudo apt install nmap
nmap
Network exploration tool and security / port scanner
nping
Network packet generation tool / ping utility
nmap-common
Nmap is a utility for network exploration or security auditing. It supports ping scanning (determine which hosts are up), many port scanning techniques, version detection (determine service protocols and application versions listening behind ports), and TCP/IP fingerprinting (remote host OS or device identification). Nmap also offers flexible target and port specification, decoy/stealth scanning, sunRPC scanning, and more. Most Unix and Windows platforms are supported in both GUI and commandline modes. Several popular handheld devices are also supported, including the Sharp Zaurus and the iPAQ.
This package contains the nmap files shared by all architectures.
Installed size: 20.74 MB
How to install: sudo apt install nmap-common
Updated on: 2023-Mar-08
Last updated
Was this helpful?