Script started on Sat Nov 23 17:36:38 2002 [mcarroll@red scripts]$ ls 02-09-16a 02-09-26a 02-10-20_mozilla 02-10-27_tty 02-11-07_wmgui 02-09-16b 02-10-03 02-10-20_mozilla-b 02-11-03_bbconf 02-11-09_htdig 02-09-16c 02-10-05_lynx 02-10-20_wm 02-11-03_blackbox 02-11-22_nmap 02-09-16d 02-10-13_php 02-10-27_firehol 02-11-03_kde 02-11-22_nmap2 02-09-17 02-10-14_php 02-10-27_firewall 02-11-07_wm 02-11-7_poldek [mcarroll@red scripts]$ cd .. [mcarroll@red mcarroll]$ cd nmap [mcarroll@red nmap]$ cd n* [mcarroll@red nmap-3.00]$ ls CHANGELOG Makefile output.h charpool.c Makefile.in portlist.c charpool.h mswin32 portlist.h config.guess nbase protocols.c config.h nmap-3.00-1.spec protocols.h config.h.in nmap.c README-WIN32 config.log nmap_error.c scan_engine.c config.status nmap_error.h scan_engine.h config.sub nmapfe services.c configure nmapfe.desktop services.h configure.in nmap.h shtool COPYING nmap-os-fingerprints targets.c docs nmap-protocols targets.h global_structures.h nmap-rpc tcpip.c HACKING nmap_rpc.c tcpip.h idle_scan.c nmap_rpc.h timing.c idle_scan.h nmap-services timing.h INSTALL nmap_winconfig.h utils.c install-sh osscan.c utils.h libpcap-possiblymodified osscan.h main.c output.c [mcarroll@red nmap-3.00]$ make Compiling libpcap make[1]: Entering directory `/home/mcarroll/nmap/nmap-3.00/libpcap-possiblymodified' gcc -I. -g -O2 -DHAVE_CONFIG_H -c ./pcap-linux.c gcc -I. -g -O2 -DHAVE_CONFIG_H -c ./pcap.c gcc -I. -g -O2 -DHAVE_CONFIG_H -c ./inet.c gcc -I. -g -O2 -DHAVE_CONFIG_H -c ./gencode.c gcc -I. -g -O2 -DHAVE_CONFIG_H -c ./optimize.c gcc -I. -g -O2 -DHAVE_CONFIG_H -c ./nametoaddr.c gcc -I. -g -O2 -DHAVE_CONFIG_H -c ./etherent.c gcc -I. -g -O2 -DHAVE_CONFIG_H -c ./savefile.c rm -f bpf_filter.c ln -s ./bpf/net/bpf_filter.c bpf_filter.c gcc -I. -g -O2 -DHAVE_CONFIG_H -c bpf_filter.c gcc -I. -g -O2 -DHAVE_CONFIG_H -c ./bpf_image.c gcc -I. -g -O2 -DHAVE_CONFIG_H -c ./bpf_dump.c gcc -I. -g -O2 -DHAVE_CONFIG_H -c scanner.c gcc -I. -g -O2 -DHAVE_CONFIG_H -Dyylval=pcap_lval -c grammar.c sed -e 's/.*/char pcap_version[] = "&";/' ./VERSION > version.c gcc -I. -g -O2 -DHAVE_CONFIG_H -c version.c ar rc libpcap.a pcap-linux.o pcap.o inet.o gencode.o optimize.o nametoaddr.o etherent.o savefile.o bpf_filter.o bpf_image.o bpf_dump.o scanner.o grammar.o version.o ranlib libpcap.a make[1]: Leaving directory `/home/mcarroll/nmap/nmap-3.00/libpcap-possiblymodified' Compiling libnbase cd nbase; make make[1]: Entering directory `/home/mcarroll/nmap/nmap-3.00/nbase' gcc -I/usr/local/include -Wall -g -DHAVE_CONFIG_H -DNCRACK_VERSION=\"\" -DHAVE_CONFIG_H=1 -c -o snprintf.o snprintf.c gcc -I/usr/local/include -Wall -g -DHAVE_CONFIG_H -DNCRACK_VERSION=\"\" -DHAVE_CONFIG_H=1 -c -o nbase_str.o nbase_str.c gcc -I/usr/local/include -Wall -g -DHAVE_CONFIG_H -DNCRACK_VERSION=\"\" -DHAVE_CONFIG_H=1 -c -o nbase_misc.o nbase_misc.c Compiling libnbase rm -f libnbase.a ar cr libnbase.a snprintf.o nbase_str.o nbase_misc.o ranlib libnbase.a make[1]: Leaving directory `/home/mcarroll/nmap/nmap-3.00/nbase' gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o main.o main.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o nmap.o nmap.c nmap.c: In function `parse_scanflags': nmap.c:68: warning: implicit declaration of function `strcasestr' gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o targets.o targets.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o tcpip.o tcpip.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o nmap_error.o nmap_error.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o utils.o utils.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o idle_scan.o idle_scan.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o osscan.o osscan.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o output.o output.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o scan_engine.o scan_engine.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o timing.o timing.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o charpool.o charpool.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o services.o services.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o protocols.o protocols.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o nmap_rpc.o nmap_rpc.c gcc -g -I/usr/local/include -Wall -Ilibpcap-possiblymodified -Inbase -DHAVE_CONFIG_H -DNMAP_VERSION=\"3.00\" -DNMAP_NAME=\"nmap\" -DNMAP_URL=\"www.insecure.org/nmap/\" -DNMAP_PLATFORM=\"i686-pc-linux-gnu\" -DNMAPDATADIR=\"/usr/local/share/nmap\" -Ilibpcap-possiblymodified -c -o portlist.o portlist.c Compiling nmap rm -f nmap gcc -Llibpcap-possiblymodified -L/usr/local/lib -Lnbase -o nmap main.o nmap.o targets.o tcpip.o nmap_error.o utils.o idle_scan.o osscan.o output.o scan_engine.o timing.o charpool.o services.o protocols.o nmap_rpc.o portlist.o -lm -lnbase -lpcap cd nmapfe; test -f Makefile && make VERSION=3.00 STATIC=; make[1]: Entering directory `/home/mcarroll/nmap/nmap-3.00/nmapfe' gcc -g -O2 -I/usr/include/gtk-1.2 -I/usr/include/glib-1.2 -I/usr/lib/glib/include -I/usr/X11R6/include -Wall -I../nbase -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\" -DPACKAGE_VERSION=\"\" -DPACKAGE_STRING=\"\" -DPACKAGE_BUGREPORT=\"\" -DLINUX=1 -DPCAP_TIMEOUT_IGNORED=1 -DVERSION=\"3.00\" -DHAVE_CONFIG_H=1 -I. -c nmapfe.c gcc -g -O2 -I/usr/include/gtk-1.2 -I/usr/include/glib-1.2 -I/usr/lib/glib/include -I/usr/X11R6/include -Wall -I../nbase -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\" -DPACKAGE_VERSION=\"\" -DPACKAGE_STRING=\"\" -DPACKAGE_BUGREPORT=\"\" -DLINUX=1 -DPCAP_TIMEOUT_IGNORED=1 -DVERSION=\"3.00\" -DHAVE_CONFIG_H=1 -I. -c nmapfe_sig.c gcc -g -O2 -I/usr/include/gtk-1.2 -I/usr/include/glib-1.2 -I/usr/lib/glib/include -I/usr/X11R6/include -Wall -I../nbase -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\" -DPACKAGE_VERSION=\"\" -DPACKAGE_STRING=\"\" -DPACKAGE_BUGREPORT=\"\" -DLINUX=1 -DPCAP_TIMEOUT_IGNORED=1 -DVERSION=\"3.00\" -DHAVE_CONFIG_H=1 -I. -c nmapfe_error.c gcc -g -O2 -I/usr/include/gtk-1.2 -I/usr/include/glib-1.2 -I/usr/lib/glib/include -I/usr/X11R6/include -Wall -I../nbase -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\" -DPACKAGE_VERSION=\"\" -DPACKAGE_STRING=\"\" -DPACKAGE_BUGREPORT=\"\" -DLINUX=1 -DPCAP_TIMEOUT_IGNORED=1 -DVERSION=\"3.00\" -DHAVE_CONFIG_H=1 -I. -L../nbase -o nmapfe nmapfe.o nmapfe_sig.o nmapfe_error.o -L/usr/lib -L/usr/X11R6/lib -lgtk -lgdk -rdynamic -lgmodule -lglib -ldl -lXi -lXext -lX11 -lm -lnbase make[1]: Leaving directory `/home/mcarroll/nmap/nmap-3.00/nmapfe' [mcarroll@red nmap-3.00]$ make install            su make install su: user make does not exist [mcarroll@red nmap-3.00]$ su Password: red# mmake install ./shtool mkdir -f -p -m 755 /usr/local/bin /usr/local/man/man1 /usr/local/share/nmap /usr/local/share/gnome/apps/Utilities ./shtool install -c -m 755 nmap /usr/local/bin/nmap If the next command fails -- you cannot use the X front end test -f nmapfe/nmapfe && ./shtool install -c -m 755 nmapfe/nmapfe /usr/local/bin/nmapfe && ./shtool mkln -f -s /usr/local/bin/nmapfe /usr/local/bin/xnmap && ./shtool install -c -m 644 nmapfe.desktop /usr/local/share/gnome/apps/Utilities/nmapfe.desktop && ./shtool install -c -m 644 docs/nmapfe.1 /usr/local/man/man1/nmapfe.1 && ./shtool install -c -m 644 docs/xnmap.1 /usr/local/man/man1/xnmap.1 ./shtool install -c -m 644 docs/nmap.1 /usr/local/man/man1/nmap.1 ./shtool install -c -m 644 nmap-os-fingerprints /usr/local/share/nmap/nmap-os-fingerprints ./shtool install -c -m 644 nmap-services /usr/local/share/nmap/nmap-services ./shtool install -c -m 644 nmap-protocols /usr/local/share/nmap/nmap-protocols ./shtool install -c -m 644 nmap-rpc /usr/local/share/nmap/nmap-rpc red# eexit [mcarroll@red nmap-3.00]$ man nmap [?1h=NMAP(1) NMAP(1) NAME nmap - Network exploration tool and security scanner SYNOPSIS nmap [Scan Type(s)] [Options] DESCRIPTION Nmap is designed to allow system administrators and curi- ous individuals to scan large networks to determine which hosts are up and what services they are offering. nmap supports a large number of scanning techniques such as: UDP, TCP connect(), TCP SYN (half open), ftp proxy (bounce attack), Reverse-ident, ICMP (ping sweep), FIN, ACK sweep, Xmas Tree, SYN sweep, IP Protocol, and Null scan. See the Scan Types section for more details. nmap also offers a number of advanced features such as remote OS detection via TCP/IP fingerprinting, stealth scanning, dynamic delay and retransmission calculations, parallel scanning, detec- tion of down hosts via parallel pings, decoy scanning, port filtering detection, direct (non-portmapper) RPC scanning, fragmentation scanning, and flexible target and port specification. Significant effort has been put into decent nmap perfor- mance for non-root users. Unfortunately, many critical kernel interfaces (such as raw sockets) require root priv- ileges. nmap should be run as root whenever possible (not setuid root, of course). : ESCESCOOBB The result of running nmap is usually a list of interest- : ESCESCOOBB ing ports on the machine(s) being scanned (if any). Nmap : ESCESCOOBB always gives the port's "well known" service name (if : ESCESCOOBB any), number, state, and protocol. The state is either : ESCESCOOBB 'open', 'filtered', or 'unfiltered'. Open means that the : ESCESCOOBB target machine will accept() connections on that port. : ESCESCOOBB Filtered means that a firewall, filter, or other network : ESCESCOOBB obstacle is covering the port and preventing nmap from : ESCESCOOBB determining whether the port is open. Unfiltered means : ESCESCOOBB that the port is known by nmap to be closed and no fire- : ESCESCOOBB wall/filter seems to be interfering with nmap's attempts : ESCESCOOBB to determine this. Unfiltered ports are the common case : ESCESCOOBB and are only shown when most of the scanned ports are in : ESCESCOOBB the filtered state. : ESCESCOOBB : ESCESCOOBB Depending on options used, nmap may also report the fol- : ESCESCOOBB lowing characteristics of the remote host: OS in use, TCP : ESCESCOOBB sequencability, usernames running the programs which have : ESCESCOOBB bound to each port, the DNS name, whether the host is a : ESCESCOOBB smurf address, and a few others. : ESCESCOOBB : ESCESCOOBBOPTIONS : ESCESCOOBB Options that make sense together can generally be com- : ESCESCOOBB bined. Some options are specific to certain scan modes. : ESCESCOOBB nmap tries to catch and warn the user about psychotic or : ESCESCOOBB unsupported option combinations. : ESCESCOOBB : ESCESCOOBB If you are impatient, you can skip to the examples section : ESCESCOOBB at the end, which demonstrates common usage. You can also : ESCESCOOBB run nmap -h for a quick reference page listing all the : ESCESCOOBB options. : ESCESCOOBB : ESCESCOOBB SCAN TYPES : ESCESCOOBB : ESCESCOOBB -sS TCP SYN scan: This technique is often referred to : ESCESCOOBB as "half-open" scanning, because you don't open a : ESCESCOOBB full TCP connection. You send a SYN packet, as if : ESCESCOOBB you are going to open a real connection and you : ESCESCOOBB wait for a response. A SYN|ACK indicates the port : ESCESCOOBB is listening. A RST is indicative of a non-lis- : ESCESCOOBB tener. If a SYN|ACK is received, a RST is immedi- : ESCESCOOBB ately sent to tear down the connection (actually : ESCESCOOBB our OS kernel does this for us). The primary advan- : ESCESCOOBB tage to this scanning technique is that fewer sites : ESCESCOOBB will log it. Unfortunately you need root privi- : ESCESCOOBB leges to build these custom SYN packets. This is : ESCESCOOBB the default scan type for privileged users. : ESCESCOOBB : ESCESCOOBB -sT TCP connect() scan: This is the most basic form of : ESCESCOOBB TCP scanning. The connect() system call provided by : ESCESCOOBB your operating system is used to open a connection : ESCESCOOBB to every interesting port on the machine. If the : ESCESCOOBB port is listening, connect() will succeed, other- : ESCESCOOBB wise the port isn't reachable. One strong advantage : ESCESCOOBB to this technique is that you don't need any spe- : ESCESCOOBB cial privileges. Any user on most UNIX boxes is : ESCESCOOBB free to use this call. : ESCESCOOBB : ESCESCOOBB This sort of scan is easily detectable as target : ESCESCOOBB host logs will show a bunch of connection and error : ESCESCOOBB messages for the services which accept() the con- : ESCESCOOBB nection just to have it immediately shutdown. This : ESCESCOOBB is the default scan type for unprivileged users. : ESCESCOOBB : ESCESCOOBB -sF -sX -sN : ESCESCOOBB Stealth FIN, Xmas Tree, or Null scan modes: There : ESCESCOOBB are times when even SYN scanning isn't clandestine : ESCESCOOBB enough. Some firewalls and packet filters watch for : ESCESCOOBB SYNs to restricted ports, and programs like Synlog- : ESCESCOOBB ger and Courtney are available to detect these : ESCESCOOBB scans. These advanced scans, on the other hand, may : ESCESCOOBB be able to pass through unmolested. : ESCESCOOBB : ESCESCOOBB The idea is that closed ports are required to reply : ESCESCOOBB to your probe packet with an RST, while open ports : ESCESCOOBB must ignore the packets in question (see RFC 793 pp : ESCESCOOBB 64). The FIN scan uses a bare (surprise) FIN : ESCESCOOBB packet as the probe, while the Xmas tree scan turns : ESCESCOOBB on the FIN, URG, and PUSH flags. The Null scan : ESCESCOOBB turns off all flags. Unfortunately Microsoft (like : ESCESCOOBB usual) decided to completely ignore the standard : ESCESCOOBB and do things their own way. Thus this scan type : ESCESCOOBB will not work against systems running Windows95/NT. : ESCESCOOBB On the positive side, this is a good way to distin- : ESCESCOOBB guish between the two platforms. If the scan finds : ESCESCOOBB open ports, you know the machine is not a Windows : ESCESCOOBB box. If a -sF,-sX,or -sN scan shows all ports : ESCESCOOBB closed, yet a SYN (-sS) scan shows ports being : ESCESCOOBB opened, you are probably looking at a Windows box. : ESCESCOOBB This is less useful now that nmap has proper OS : ESCESCOOBB detection built in. There are also a few other : ESCESCOOBB systems that are broken in the same way Windows is. : ESCESCOOBB They include Cisco, BSDI, HP/UX, MVS, and IRIX. : ESCESCOOBB All of the above send resets from the open ports : ESCESCOOBB when they should just drop the packet. : ESCESCOOAAM : ESCESCOOAAM is the default scan type for unprivileged users. : ESCESCOOAAM nection just to have it immediately shutdown. This : ESCESCOOBB They include Cisco, BSDI, HP/UX, MVS, and IRIX. : ESCESCOOBB All of the above send resets from the open ports : ESCESCOOBB when they should just drop the packet. : ESCESCOOBB : ESCESCOOBB -sP Ping scanning: Sometimes you only want to know : ESCESCOOBB which hosts on a network are up. Nmap can do this : ESCESCOOBB by sending ICMP echo request packets to every IP : ESCESCOOBB address on the networks you specify. Hosts that : ESCESCOOBB respond are up. Unfortunately, some sites such as : ESCESCOOBB microsoft.com block echo request packets. Thus : ESCESCOOBB nmap can also send a TCP ack packet to (by default) : ESCESCOOBB port 80. If we get an RST back, that machine is : ESCESCOOBB up. A third technique involves sending a SYN : ESCESCOOBB packet and waiting for a RST or a SYN/ACK. For : ESCESCOOBB non-root users, a connect() method is used. : ESCESCOOBB : ESCESCOOBB By default (for root users), nmap uses both the : ESCESCOOAAM packet as the probe, while the Xmas tree scan turns : ESCESCOOAAM 64). The FIN scan uses a bare (surprise) FIN : ESCESCOOAAM must ignore the packets in question (see RFC 793 pp : ESCESCOOAAM to your probe packet with an RST, while open ports : ESCESCOOAAM The idea is that closed ports are required to reply : ESCESCOOAAM : ESCESCOOAAM be able to pass through unmolested. : ESCESCOOAAM scans. These advanced scans, on the other hand, may : ESCESCOOAAM ger and Courtney are available to detect these : ESCESCOOAAM SYNs to restricted ports, and programs like Synlog- : ESCESCOOAAM enough. Some firewalls and packet filters watch for : ESCESCOOAAM are times when even SYN scanning isn't clandestine : ESCESCOOAAM Stealth FIN, Xmas Tree, or Null scan modes: There : ESCESCOOAAM -sF -sX -sN : ESCESCOOAAM : ESCESCOOAAM is the default scan type for unprivileged users. : ESCESCOOAAM nection just to have it immediately shutdown. This : ESCESCOOAAM messages for the services which accept() the con- : ESCESCOOBB systems that are broken in the same way Windows is. : ESCESCOOBB They include Cisco, BSDI, HP/UX, MVS, and IRIX. : ESCESCOOBB All of the above send resets from the open ports : ESCESCOOBB when they should just drop the packet. : ESCESCOOBB : ESCESCOOBB -sP Ping scanning: Sometimes you only want to know : ESCESCOOBB which hosts on a network are up. Nmap can do this : ESCESCOOBB by sending ICMP echo request packets to every IP : ESCESCOOBB address on the networks you specify. Hosts that : ESCESCOOBB respond are up. Unfortunately, some sites such as : ESCESCOOBB microsoft.com block echo request packets. Thus : ESCESCOOBB nmap can also send a TCP ack packet to (by default) : ESCESCOOBB port 80. If we get an RST back, that machine is : ESCESCOOBB up. A third technique involves sending a SYN : ESCESCOOBB packet and waiting for a RST or a SYN/ACK. For : ESCESCOOBB non-root users, a connect() method is used. : ESCESCOOBB : ESCESCOOBB By default (for root users), nmap uses both the : ESCESCOOBB ICMP and ACK techniques in parallel. You can : ESCESCOOBB change the -P option described later. : ESCESCOOBB : ESCESCOOBB Note that pinging is done by default anyway, and : ESCESCOOBB only hosts that respond are scanned. Only use this : ESCESCOOBB option if you wish to ping sweep without doing any : ESCESCOOBB actual port scans. : ESCESCOOBB : ESCESCOOBB -sU UDP scans: This method is used to determine which : ESCESCOOBB UDP (User Datagram Protocol, RFC 768) ports are : ESCESCOOBB open on a host. The technique is to send 0 byte : ESCESCOOBB udp packets to each port on the target machine. If : ESCESCOOBB we receive an ICMP port unreachable message, then : ESCESCOOBB the port is closed. Otherwise we assume it is : ESCESCOOBB open. : ESCESCOOBB : ESCESCOOBB Some people think UDP scanning is pointless. I usu- : ESCESCOOBB ally remind them of the recent Solaris rcpbind : ESCESCOOBB hole. Rpcbind can be found hiding on an undocu- : ESCESCOOBB mented UDP port somewhere above 32770. So it : ESCESCOOBB doesn't matter that 111 is blocked by the firewall. : ESCESCOOBB But can you find which of the more than 30,000 high : ESCESCOOBB ports it is listening on? With a UDP scanner you : ESCESCOOBB can! There is also the cDc Back Orifice backdoor : ESCESCOOBB program which hides on a configurable UDP port on : ESCESCOOBB Windows machines. Not to mention the many commonly : ESCESCOOBB vulnerable services that utilize UDP such as snmp, : ESCESCOOBB tftp, NFS, etc. : ESCESCOOBB : ESCESCOOBB Unfortunately UDP scanning is sometimes painfully : ESCESCOOBB slow since most hosts implement a suggestion in RFC : ESCESCOOBB 1812 (section 4.3.2.8) of limiting the ICMP error : ESCESCOOBB message rate. For example, the Linux kernel (in : ESCESCOOBB net/ipv4/icmp.h) limits destination unreachable : ESCESCOOBB message generation to 80 per 4 seconds, with a 1/4 : ESCESCOOBB second penalty if that is exceeded. Solaris has : ESCESCOOBB much more strict limits (about 2 messages per sec- : ESCESCOOBB ond) and thus takes even longer to scan. nmap : ESCESCOOBB detects this rate limiting and slows down accord- : ESCESCOOBB ingly, rather than flood the network with useless : ESCESCOOBB packets that will be ignored by the target machine. : ESCESCOOBB : ESCESCOOBB As is typical, Microsoft ignored the suggestion of : ESCESCOOBB the RFC and does not seem to do any rate limiting : ESCESCOOBB at all on Win95 and NT machines. Thus we can scan : ESCESCOOBB all 65K ports of a Windows machine very quickly. : ESCESCOOBB Woop! : ESCESCOOBB : ESCESCOOBB -sO IP protocol scans: This method is used to determine : ESCESCOOBB which IP protocols are supported on a host. The : ESCESCOOBB technique is to send raw IP packets without any : further protocol header to each specified protocol on the target machine. If we receive an ICMP pro- tocol unreachable message, then the protocol is not in use. Otherwise we assume it is open. Note that some hosts (AIX, HP-UX, Digital UNIX) and firewalls may not send protocol unreachable messages. This causes all of the protocols to appear "open". Because the implemented technique is very similar to UDP port scanning, ICMP rate limit might apply too. But the IP protocol field has only 8 bits, so at most 256 protocols can be probed which should be possible in reasonable time anyway. -sI  Idlescan: This advanced scan method allows for a truly blind TCP port scan of the target (meaning no packets are sent to the target from your real IP address). Instead, a unique side-channel attack exploits predictable "IP fragmentation ID" sequence generation on the zombie host to glean information about the open ports on the target. IDS systems will display the scan as coming from the zombie machine you specify (which must be up and meet cer- tain criteria). I am planning to put a more detailed explanation up at http://www.inse- cure.org/nmap/nmap_documentation.html in the near future. Besides being extraordinarily stealthy (due to its blind nature), this scan type permits mapping out : IP-based trust relationships between machines. The port listing shows open ports from the perspective of the zombie host. So you can try scanning a tar- get using various zombies that you think might be trusted (via router/packet filter rules). Obvi- ously this is crucial information when prioritizing attack targets. Otherwise, you penetration testers might have to expend considerable resources "own- ing" an intermediate system, only to find out that its IP isn't even trusted by the target host/net- work you are ultimately after. You can add a colon followed by a port number if you wish to probe a particular port on the zombie host for IPID changes. Otherwise Nmap will use the port it uses by default for "tcp pings". -sA ACK scan: This advanced method is usually used to map out firewall rulesets. In particular, it can help determine whether a firewall is stateful or just a simple packet filter that blocks incoming SYN packets. This scan type sends an ACK packet (with random looking acknowledgement/sequence numbers) to the ports specified. If a RST comes back, the ports is classified as "unfiltered". If nothing comes back (or if an ICMP unreachable is returned), the port is classified as "filtered". Note that nmap usu- ally doesn't print "unfiltered" ports, so getting no ports shown in the output is usually a sign that : all the probes got through (and returned RSTs). This scan will obviously never show ports in the "open" state. -sW Window scan: This advanced scan is very similar to the ACK scan, except that it can sometimes detect open ports as well as filtered/nonfiltered due to an anomaly in the TCP window size reporting by some operating systems. Systems vulnerable to this include at least some versions of AIX, Amiga, BeOS, BSDI, Cray, Tru64 UNIX, DG/UX, OpenVMS, Digital UNIX, FreeBSD, HP-UX, OS/2, IRIX, MacOS, NetBSD, OpenBSD, OpenStep, QNX, Rhapsody, SunOS 4.X, Ultrix, VAX, and VxWorks. See the nmap-hackers mailing list archive for a full list. -sR RPC scan. This method works in combination with the various port scan methods of Nmap. It takes all the TCP/UDP ports found open and then floods them with SunRPC program NULL commands in an attempt to determine whether they are RPC ports, and if so, what program and version number they serve up. Thus you can effectively obtain the same info as firewall (or protected by TCP wrappers). Decoys do not currently work with RPC scan, at some point I may add decoy support for UDP RPC scans. -sL List scan. This method simply generates and prints a list of IPs/Names without actually pinging or port scanning them. DNS name resolution will be performed unless you use -n. : -b  FTP bounce attack: An interesting "feature" of the ftp protocol (RFC 959) is support for "proxy" ftp connections. In other words, I should be able to connect from evil.com to the FTP server of tar- get.com and request that the server send a file ANYWHERE on the internet! Now this may have worked well in 1985 when the RFC was written. But in today's Internet, we can't have people hijacking ftp servers and requesting that data be spit out to arbitrary points on the internet. As *Hobbit* wrote back in 1995, this protocol flaw "can be used to post virtually untraceable mail and news, hammer on servers at various sites, fill up disks, try to hop firewalls, and generally be annoying and hard to track down at the same time." What we will exploit this for is to (surprise, surprise) scan TCP ports from a "proxy" ftp server. Thus you could connect to an ftp server behind a firewall, and then scan ports that are more likely to be blocked (139 is a good one). If the ftp server allows reading from and writing to some directory (such as /incoming), you can send arbitrary data to ports that you do find open (nmap doesn't do this for you though). The argument passed to the 'b' option is the host you want to use as a proxy, in standard URL nota- tion. The format is: username:pass- word@server:port. Everything but server is optional. To determine what servers are vulnerable : to this attack, you can see my article in Phrack 51. And updated version is available at the nmap URL (http://www.insecure.org/nmap). GENERAL OPTIONS None of these are required but some can be quite useful. -P0 Do not try and ping hosts at all before scanning them. This allows the scanning of networks that don't allow ICMP echo requests (or responses) through their firewall. microsoft.com is an exam- ple of such a network, and thus you should always use -P0 or -PT80 when portscanning microsoft.com. -PT Use TCP "ping" to determine what hosts are up. Instead of sending ICMP echo request packets and waiting for a response, we spew out TCP ACK packets throughout the target network (or to a single machine) and then wait for responses to trickle back. Hosts that are up should respond with a RST. This option preserves the efficiency of only scan- ning hosts that are up while still allowing you to scan networks/hosts that block ping packets. For non root users, we use connect(). To set the des- tination port of the probe packets use -PT. The default port is 80, since this port is often not filtered out. -PS This option uses SYN (connection request) packets instead of ACK packets for root users. Hosts that : are up should respond with a RST (or, rarely, a SYN|ACK). You can set the destination port in the same manner as -PT above. -PI This option uses a true ping (ICMP echo request) packet. It finds hosts that are up and also looks for subnet-directed broadcast addresses on your network. These are IP addresses which are exter- nally reachable and translate to a broadcast of incomming IP packets to a subnet of computers. These should be eliminated if found as they allow for numerous denial of service attacks (Smurf is the most common). -PP Uses an ICMP timestamp request (code 13) packet to find listening hosts. -PM Same as -PI and -PP except uses a netmask request (ICMP code 17). -PB This is the default ping type. It uses both the ACK ( -PT ) and ICMP echo request ( -PI ) sweeps in parallel. This way you can get firewalls that fil- ter either one (but not both). The TCP probe des- tination port can be set in the same manner as with -PT above. -O This option activates remote host identification via TCP/IP fingerprinting. In other words, it uses a bunch of techniques to detect subtleties in the underlying operating system network stack of the : computers you are scanning. It uses this informa- tion to create a 'fingerprint' which it compares with its database of known OS fingerprints (the nmap-os-fingerprints file) to decide what type of system you are scanning. If Nmap is unable to guess the OS of a machine, and conditions are good (eg at least one open port), Nmap will provide a URL you can use to submit the fingerprint if you know (for sure) the OS running on the machine. By doing this you contribute to the pool of operating systems known to nmap and thus it will be more accurate for everyone. Note that if you leave an IP address on the form, the machine may be scanned when we add the fingerprint (to validate that it works). The -O option also enables several other tests. One is the "Uptime" measurement, which uses the TCP timestamp option (RFC 1323) to guess when a machine was last rebooted. This is only reported for machines which provide this information. Another test enabled by -O is TCP Sequence Pre- dictability Classification. This is a measure that describes approximately how hard it is to establish a forged TCP connection against the remote host. This is useful for exploiting source-IP based trust relationships (rlogin, firewall filters, etc) or for hiding the source of an attack. The actual difficulty number is based on statistical sampling : and may fluctuate. It is generally better to use the English classification such as "worthy chal- lenge" or "trivial joke". This is only reported in normal output with -v. When verbose mode (-v) is on with -O, IPID Sequence Generation is also reported. Most machines are in the "incremental" class, which means that they increment the "ID" field in the IP header for each packet they send. This makes them vulnerable to several advanced information gathering and spoofing attacks. -I This turns on TCP reverse ident scanning. As noted by Dave Goldsmith in a 1996 Bugtraq post, the ident protocol (rfc 1413) allows for the disclosure of the username that owns any process connected via TCP, even if that process didn't initiate the con- nection. So you can, for example, connect to the http port and then use identd to find out whether the server is running as root. This can only be done with a full TCP connection to the target port (i.e. the -sT scanning option). When -I is used, the remote host's identd is queried for each open port found. Obviously this won't work if the host is not running identd. -f This option causes the requested SYN, FIN, XMAS, or NULL scan to use tiny fragmented IP packets. The idea is to split up the TCP header over several packets to make it harder for packet filters, : intrusion detection systems, and other annoyances to detect what you are doing. Be careful with this! Some programs have trouble handling these tiny packets. My favorite sniffer segmentation faulted immediately upon receiving the first 36-byte frag- ment. After that comes a 24 byte one! While this method won't get by packet filters and firewalls that queue all IP fragments (like the CON- FIG_IP_ALWAYS_DEFRAG option in the Linux kernel), some networks can't afford the performance hit this causes and thus leave it disabled. Note that I do not yet have this option working on all systems. It works fine for my Linux, FreeBSD, and OpenBSD boxes and some people have reported success with other *NIX variants. -v Verbose mode. This is a highly recommended option and it gives out more information about what is going on. You can use it twice for greater effect. You can also use -d a few of times if you really want to get crazy with scrolling the screen! -h This handy option display a quick reference screen of nmap usage options. As you may have noticed, this man page is not exactly a 'quick reference' :) -oN  This logs the results of your scans in a normal human readable form into the file you specify as an argument. : -oX  This logs the results of your scans in XML form into the file you specify as an argument. This allows programs to easily capture and interpret Nmap results. You can give the argument '-' (with- out quotes) to shoot output into stdout (for shell pipelines, etc). In this case normal output will be suppressed. Watch out for error messages if you use this (they will still go to stderr). Also note that '-v' may cause some extra information to be printed. The Document Type Definition (DTD) defin- ing the XML output structure is available at http://www.insecure.org/nmap/nmap.dtd . -oG  This logs the results of your scans in a grepable form into the file you specify as an argument. This simple format provides all the information on one line (so you can easily grep for port or OS information and see all the IPs. This used to be the preferred mechanism for programs to interact with Nmap, but now we recommend XML output (-oX instead). This simple format may not contain as much information as the other formats. You can give the argument '-' (without quotes) to shoot output into stdout (for shell pipelines, etc). In this case normal output will be suppressed. Watch out for error messages if you use this (they will still go to stderr). Also note that '-v' will cause some extra information to be printed. : -oA  This tells Nmap to log in ALL the majore formats (normal, grepable, and XML). You give a base for the filename, and the output files will be base.nmap, base.gnmap, and base.xml. -oS  thIs l0gz th3 r3suLtS of YouR ScanZ iN a s| A network scan that is cancelled due to control-C, network outage, etc. can be resumed using this option. The logfilename must be either a normal (-oN) or machine parsable (-oM) log from the aborted scan. No other options can be given (they will be the same as the aborted scan). Nmap will start on the machine after the last one success- fully scanned in the log file. --append_output Tells Nmap to append scan results to any output files you have specified rather than overwriting those files. -iL  Reads target specifications from the file specified RATHER than from the command line. The file should : contain a list of host or network expressions seperated by spaces, tabs, or newlines. Use a hyphen (-) as inputfilename if you want nmap to read host expressions from stdin (like at the end of a pipe). See the section target specification for more information on the expressions you fill the file with. -iR This option tells Nmap to generate its own hosts to scan by simply picking random numbers :). It will never end. This can be useful for statistical sam- pling of the Internet to estimate various things. If you are ever really bored, try nmap -sS -iR -p 80 to find some web servers to look at. -p  This option specifies what ports you want to spec- ify. For example '-p 23' will only try port 23 of the target host(s). '-p 20-30,139,60000-' scans ports between 20 and 30, port 139, and all ports greater than 60000. The default is to scan all ports between 1 and 1024 as well as any ports listed in the services file which comes with nmap. For IP protocol scanning (-sO), this specifies the protocol number you wish to scan for (0-255). When scanning both TCP and UDP ports, you can spec- ify a particular protocol by preceding the port numbers by "T:" or "U:". The qualifier lasts until you specify another qualifier. For example, the argument "-p U:53,111,137,T:21-25,80,139,8080" : would scan UDP ports 53,111,and 137, as well as the listed TCP ports. Note that to scan both UDP & TCP, you have to specify -sU and at least one TCP scan type (such as -sS, -sF, or -sT). If no proto- col qualifier is given, the port numbers are added to all protocol lists. -F Fast scan mode. Specifies that you only wish to scan for ports listed in the services file which comes with nmap (or the protocols file for -sO). This is obviously much faster than scanning all 65535 ports on a host. -D  Causes a decoy scan to be performed which makes it appear to the remote host that the host(s) you specify as decoys are scanning the target network too. Thus their IDS might report 5-10 port scans from unique IP addresses, but they won't know which IP was scanning them and which were innocent decoys. While this can be defeated through router path tracing, response-dropping, and other "active" mechanisms, it is generally an extremely effective technique for hiding your IP address. Separate each decoy host with commas, and you can optionally use 'ME' as one of the decoys to repre- sent the position you want your IP address to be used. If your put 'ME' in the 6th position or later, some common port scan detectors (such as : Solar Designer's excellent scanlogd) are unlikeley to show your IP address at all. If you don't use 'ME', nmap will put you in a random position. Note that the hosts you use as decoys should be up or you might accidently SYN flood your targets. Also it will be pretty easy to determine which host is scanning if only one is actually up on the net- work. You might want to use IP addresses instead of names (so the decoy networks don't see you in their nameserver logs). Also note that some (stupid) "port scan detectors" will firewall/deny routing to hosts that attempt port scans. Thus you might inadvertantly cause the machine you scan to lose connectivity with the decoy machines you are using. This could cause the target machines major problems if the decoy is, say, its internet gateway or even "localhost". Thus you might want to be careful of this option. The real moral of the story is that detectors of spoofable port scans should not take action against the machine that seems like it is port scanning them. It could just be a decoy! Decoys are used both in the initial ping scan (using ICMP, SYN, ACK, or whatever) and during the actual port scanning phase. Decoys are also used during remote OS detection ( -O ). It is worth noting that using too many decoys may : slow your scan and potentially even make it less accurate. Also, some ISPs will filter out your spoofed packets, although many (currently most) do not restrict spoofed IP packets at all. -S  In some circumstances, nmap may not be able to determine your source address ( nmap will tell you if this is the case). In this situation, use -S with your IP address (of the interface you wish to send packets through). Another possible use of this flag is to spoof the scan to make the targets think that someone else is scanning them. Imagine a company being repeatedly port scanned by a competitor! This is not a sup- ported usage (or the main purpose) of this flag. I just think it raises an interesting possibility that people should be aware of before they go accusing others of port scanning them. -e would generally be required for this sort of usage. -e  Tells nmap what interface to send and receive pack- ets on. Nmap should be able to detect this but it will tell you if it cannot. -g  Sets the source port number used in scans. Many naive firewall and packet filter installations make an exception in their ruleset to allow DNS (53) or :[?1l>[mcarroll@red nmap-3.00]$ nmap -v -  sT ils.unc.edu Starting nmap V. 3.00 ( www.insecure.org/nmap/ ) WARNING! The following files exist and are readable: /usr/local/share/nmap/nmap-services and ./nmap-services. I am choosing /usr/local/share/nmap/nmap-services for security reasons. set NMAPDIR=. to give priority to files in your local directory Machine 152.2.81.1 MIGHT actually be listening on probe port 80 Host ruby.ils.unc.edu (152.2.81.1) appears to be up ... good. Initiating Connect() Scan against ruby.ils.unc.edu (152.2.81.1) Adding open port 22370/tcp Adding open port 515/tcp Adding open port 111/tcp Adding open port 23/tcp Adding open port 109/tcp Adding open port 2049/tcp Adding open port 32772/tcp Adding open port 9090/tcp Adding open port 32774/tcp Adding open port 6547/tcp Adding open port 6000/tcp Adding open port 8080/tcp Adding open port 4045/tcp Adding open port 37/tcp Adding open port 7100/tcp Adding open port 587/tcp Adding open port 110/tcp Adding open port 80/tcp Adding open port 5050/tcp Adding open port 554/tcp Adding open port 32775/tcp Adding open port 143/tcp Adding open port 7070/tcp Adding open port 32771/tcp Adding open port 21/tcp Adding open port 25/tcp Adding open port 22/tcp Adding open port 32773/tcp Adding open port 6548/tcp caught SIGINT signal, cleaning up [mcarroll@red nmap-3.00]$ nmap -v -sT ils.unc.eduils.unc.edu           localhostt  Starting nmap V. 3.00 ( www.insecure.org/nmap/ ) WARNING! The following files exist and are readable: /usr/local/share/nmap/nmap-services and ./nmap-services. I am choosing /usr/local/share/nmap/nmap-services for security reasons. set NMAPDIR=. to give priority to files in your local directory Host localhost.localdomain (127.0.0.1) appears to be up ... good. Initiating Connect() Scan against localhost.localdomain (127.0.0.1) Adding open port 8009/tcp Adding open port 111/tcp Adding open port 25/tcp Adding open port 8082/tcp Adding open port 8081/tcp Adding open port 21/tcp Adding open port 8080/tcp Adding open port 22/tcp Adding open port 6667/tcp The Connect() Scan took 0 seconds to scan 1601 ports. Interesting ports on localhost.localdomain (127.0.0.1): (The 1592 ports scanned but not shown below are in state: closed) Port State Service 21/tcp open ftp 22/tcp open ssh 25/tcp open smtp 111/tcp open sunrpc 6667/tcp open irc 8009/tcp open ajp13 8080/tcp open http-proxy 8081/tcp open blackice-icecap 8082/tcp open blackice-alerts Nmap run completed -- 1 IP address (1 host up) scanned in 0 seconds [mcarroll@red nmap-3.00]$ nmap -v -sT localhost         127.0.0.1 Starting nmap V. 3.00 ( www.insecure.org/nmap/ ) WARNING! The following files exist and are readable: /usr/local/share/nmap/nmap-services and ./nmap-services. I am choosing /usr/local/share/nmap/nmap-services for security reasons. set NMAPDIR=. to give priority to files in your local directory Host localhost.localdomain (127.0.0.1) appears to be up ... good. Initiating Connect() Scan against localhost.localdomain (127.0.0.1) Adding open port 21/tcp Adding open port 6667/tcp Adding open port 25/tcp Adding open port 111/tcp Adding open port 8080/tcp Adding open port 8081/tcp Adding open port 8009/tcp Adding open port 8082/tcp Adding open port 22/tcp The Connect() Scan took 1 second to scan 1601 ports. Interesting ports on localhost.localdomain (127.0.0.1): (The 1592 ports scanned but not shown below are in state: closed) Port State Service 21/tcp open ftp 22/tcp open ssh 25/tcp open smtp 111/tcp open sunrpc 6667/tcp open irc 8009/tcp open ajp13 8080/tcp open http-proxy 8081/tcp open blackice-icecap 8082/tcp open blackice-alerts Nmap run completed -- 1 IP address (1 host up) scanned in 1 second [mcarroll@red nmap-3.00]$ nmap -v -sT 127.0.0.1 2 Starting nmap V. 3.00 ( www.insecure.org/nmap/ ) WARNING! The following files exist and are readable: /usr/local/share/nmap/nmap-services and ./nmap-services. I am choosing /usr/local/share/nmap/nmap-services for security reasons. set NMAPDIR=. to give priority to files in your local directory Host (127.0.0.2) appears to be up ... good. Initiating Connect() Scan against (127.0.0.2) Adding open port 8081/tcp Adding open port 8009/tcp Adding open port 21/tcp Adding open port 8080/tcp Adding open port 22/tcp Adding open port 8082/tcp Adding open port 111/tcp Adding open port 6667/tcp The Connect() Scan took 0 seconds to scan 1601 ports. Interesting ports on (127.0.0.2): (The 1593 ports scanned but not shown below are in state: closed) Port State Service 21/tcp open ftp 22/tcp open ssh 111/tcp open sunrpc 6667/tcp open irc 8009/tcp open ajp13 8080/tcp open http-proxy 8081/tcp open blackice-icecap 8082/tcp open blackice-alerts Nmap run completed -- 1 IP address (1 host up) scanned in 0 seconds [mcarroll@red nmap-3.00]$ nmap -v -sT 127.0.0.2         192.168.1.100 Starting nmap V. 3.00 ( www.insecure.org/nmap/ ) WARNING! The following files exist and are readable: /usr/local/share/nmap/nmap-services and ./nmap-services. I am choosing /usr/local/share/nmap/nmap-services for security reasons. set NMAPDIR=. to give priority to files in your local directory caught SIGINT signal, cleaning up [mcarroll@red nmap-3.00]$ ifcong fig en0 bash: ifconfig: command not found [mcarroll@red nmap-3.00]$ ifconfig en0nmap -v -sT 192.168.1.100             66.57.242.138 Starting nmap V. 3.00 ( www.insecure.org/nmap/ ) WARNING! The following files exist and are readable: /usr/local/share/nmap/nmap-services and ./nmap-services. I am choosing /usr/local/share/nmap/nmap-services for security reasons. set NMAPDIR=. to give priority to files in your local directory Host (66.57.242.138) appears to be down, skipping it. Note: Host seems down. If it is really up, but blocking our ping probes, try -P0 Nmap run completed -- 1 IP address (0 hosts up) scanned in 60 seconds [mcarroll@red nmap-3.00]$ nmap -v -sT 66.57.242.138T 66.57.242.138 66.57.242.138p 66.57.242.1380 66.57.242.138v -p0 66.57.242.138 -p0 66.57.242.138-p0 66.57.242.138 Ports to be scanned must be between 1 and 65535 inclusive QUITTING! [mcarroll@red nmap-3.00]$ nmap -p0 66.57.242.138 66.57.242.138 2 Ports to be scanned must be between 1 and 65535 inclusive QUITTING! [mcarroll@red nmap-3.00]$ nmap -p0 66.57.242.132 66.57.242.132 66.57.242.132s 66.57.242.132T 66.57.242.132 Starting nmap V. 3.00 ( www.insecure.org/nmap/ ) WARNING! The following files exist and are readable: /usr/local/share/nmap/nmap-services and ./nmap-services. I am choosing /usr/local/share/nmap/nmap-services for security reasons. set NMAPDIR=. to give priority to files in your local directory Interesting ports on rdu57-242-132.nc.rr.com (66.57.242.132): (The 1596 ports scanned but not shown below are in state: closed) Port State Service 69/tcp filtered tftp 137/tcp filtered netbios-ns 138/tcp filtered netbios-dgm 139/tcp filtered netbios-ssn 445/tcp filtered microsoft-ds Nmap run completed -- 1 IP address (1 host up) scanned in 12 seconds [mcarroll@red nmap-3.00]$ connect 66.57.242.132:445 bash: connect: command not found [mcarroll@red nmap-3.00]$ connect 66.57.242.132:445t 66.57.242.132:445 66.57.242.132:445 66.57.242.132:445 66.57.242.132:445 66.57.242.132:445 66.57.242.132:445 66.57.242.132:445 bash: 66.57.242.132:445: command not found [mcarroll@red nmap-3.00]$ 66.57.242.132:445o66.57.242.132:445p66.57.242.132:445e66.57.242.132:445n66.57.242.132:445 66.57.242.132:445 bash: open: command not found [mcarroll@red nmap-3.00]$ open 66.57.242.132:445 66.57.242.132:445 66.57.242.132:445 66.57.242.132:445 66.57.242.132:44566.57.242.132:445t 66.57.242.132:445e 66.57.242.132:445l 66.57.242.132:445n 66.57.242.132:445e 66.57.242.132:445t 66.57.242.132:445 66.57.242.132:445 telnet: 66.57.242.132:445: Name or service not known [mcarroll@red nmap-3.00]$ telnet 66.57.242.132:44566.57.242.132:445 66.57.242.132:445 66.57.242.132:445 66.57.242.132:445 66.57.242.132:445 66.57.242.132:445 66.57.242.132:445s 66.57.242.132:445s 66.57.242.132:445h 66.57.242.132:445 ssh: 66.57.242.132:445: Name or service not known [mcarroll@red nmap-3.00]$ ssh 66.57.242.132:445   69 66.57.242.132:69 66.57.242.132:69 66.57.242.132:69t 66.57.242.132:69f 66.57.242.132:69t 66.57.242.132:69p 66.57.242.132:69 bash: tftp: command not found [mcarroll@red nmap-3.00]$ tftp 66.57.242.132:69fftp 66.57.242.132:69 ftp: 66.57.242.132:69: Name or service not known ftp> ls Not connected. ftp> connect ?Invalid command ftp> open (to) 66.57.242.132.69 ftp: 66.57.242.132.69: Name or service not known ftp> quit [mcarroll@red nmap-3.00]$ ftp 66.57.242.132:69tftp 66.57.242.132:69ftp 66.57.242.132:69  137 66.57.242.132:137 66.57.242.132:137 66.57.242.132:137t 66.57.242.132:137c 66.57.242.132:137p 66.57.242.132:137 bash: tcp: command not found [mcarroll@red nmap-3.00]$ tcp 66.57.242.132:137ftp 66.57.242.132:69p 66.57.242.132:69 66.57.242.132:69 66.57.242.132:69t 66.57.242.132:69e 66.57.242.132:69l 66.57.242.132:69n 66.57.242.132:69e 66.57.242.132:69t 66.57.242.132:69 telnet: 66.57.242.132:69: Name or service not known [mcarroll@red nmap-3.00]$ telnet 66.57.242.132:69  22 telnet: 66.57.242.132:22: Name or service not known [mcarroll@red nmap-3.00]$ telnet 66.57.242.132:222 5t 66.57.242.132:25 66.57.242.132:25 66.57.242.132:25 66.57.242.132:25 66.57.242.132:25 66.57.242.132:25s 66.57.242.132:25m 66.57.242.132:25t 66.57.242.132:25p 66.57.242.132:25 bash: smtp: command not found [mcarroll@red nmap-3.00]$ smtp 66.57.242.132:25telnet 66.57.242.132:2269cp 66.57.242.132:137ftp 66.57.242.132:69tftp 66.57.242.132:69ssh 66.57.242.132:445telnet 66.57.242.132:445 open 66.57.242.132:44566.57.242.132:445connect 66.57.242.132:445nmap -sT 66.57.242.132p0 66.57.242.13282sT 66.57.242.132 6 Starting nmap V. 3.00 ( www.insecure.org/nmap/ ) WARNING! The following files exist and are readable: /usr/local/share/nmap/nmap-services and ./nmap-services. I am choosing /usr/local/share/nmap/nmap-services for security reasons. set NMAPDIR=. to give priority to files in your local directory ccaught SIGINT signal, cleaning up [mcarroll@red nmap-3.00]$ nmap -sT 66.57.242.136  28 Starting nmap V. 3.00 ( www.insecure.org/nmap/ ) WARNING! The following files exist and are readable: /usr/local/share/nmap/nmap-services and ./nmap-services. I am choosing /usr/local/share/nmap/nmap-services for security reasons. set NMAPDIR=. to give priority to files in your local directory Note: Host seems down. If it is really up, but blocking our ping probes, try -P0 Nmap run completed -- 1 IP address (0 hosts up) scanned in 60 seconds [mcarroll@red nmap-3.00]$ exit exit Script done on Sat Nov 23 18:25:24 2002