NmapNetwork Security Scanner.doc

Nmap - Network Security Scanner0360592 Project 2Ahsaan ArefeenSrabanti DeyMingyue YuInstructor: Dr. A. AggarwalContentsI. Introduction 2II. Option Observation.4 II.1 Scan type.4-sT.4-sS.6-sF.8 sX9 -sN.11-sP16-sO-sA-sW II.2 General option-PT-PS-PI-O-I-v-h-p-F-MIII. ConclusionI. IntroductionNmap is a network exploration tool and security scanner. It is designed to allow system administrators and curious individuals to scan large networks to determine which hosts are up and what services they are offering. Nmap supports a large number of scanning techniques such as: UDP, TCP connect(), TCP SYN (half open), ftp proxy (bounce attack), Reverse-ident, ICMP (ping sweep), FIN,ACK sweep, Xmas Tree, SYN sweep, IP Protocol, and Null scan. nmap also offers a number of advanced features such as remote OS detection via TCP/IP fingerprinting, stealth scanning, dynamic delay and retransmission calculations, parallel scanning, detection of down hosts via parallel pings, decoy scanning, port filtering detection, direct (non-portmapper) RPC scanning, fragmentation scanning, and flexible target and port specification.The result of running nmap is usually a list of ports on the machine being scanned. Nmap always gives the port's "well known" service name, number, state, and protocol. The state is either 'open', 'filtered', or 'unfiltered'. Open means that the target machine will accept() connections on that port. Filtered means that a firewall, filter, or other network obstacle is covering the port and preventing nmap from determining whether the port is open. Unfiltered means that the port is known by nmap to be closed and no fire wall/filter seems to be interfering with nmap's attempts to determine this. Unfiltered ports are the common case and are only shown when most of the scanned ports are in the filtered state.Depending on options used, nmap may also report the following characteristics of the remote host: OS in use, TCP sequence ability, usernames running the programs which have bound to each port, the DNS name, whether the host is a smurf address, and a few others.Nmap has the following features:· Flexible: Supports dozens of advanced techniques for mapping out networks filled with IP filters, firewalls, routers, and other obstacles. This includes many port scanning mechanisms (both TCP & UDP), OS detection, pings sweeps, and more. · Powerful: Nmap has been used to scan huge networks of literally hundreds of thousands of machines. · Portable: Most operating systems are supported, including Linux, Open/Free/Net BSD, Solaris, IRIX, Mac OS X, HP-UX, Sun OS, and more. Windows support is in beta and we are not distributing binaries yet. · Easy: Both traditional command line and graphical (GUI) versions are available to suit preference. Binaries are available for those who do not wish to compile Nmap from source. · Free: The primary goals of the Nmap Project is to help make the Internet a little more secure and to provide administrators/auditors/hackers with an advanced tool for exploring their networks. Nmap is available for free, and also comes with full source code that you may modify and redistribute under the terms of the GNU General Public License (GPL). · Well Documented: Significant effort has been put into comprehensive and up-to-date man pages, whitepapers, and tutorials. · Acclaimed: Nmap has won numerous awards, including "Information Security Product of the Year" by both Info World and Codetalker Digest. It has been featured in hundreds of magazine articles. · Popular: Thousands of people download Nmap every day, and it is included with many operating systems (Redhat Linux, Debian Linux, FreeBSD, OpenBSD, etc). It is among the top ten (out of 15,000) downloads at the Freshmeat repository. This is important because it lends Nmap its vibrant development and user support communities. II. Option ObservationNmap has two kinds of options, one is to define the scan type and using that type option to scan the ports, and the other is general option.II.1. Scan type-sTTCP connect() scan: the most basic form of TCP scanning. It is based on the method of establishing a connection in the TCP protocol, known as a three way handshake.1. The server must be ready to receive a connection (usually using the socket, bind and listen functions)2. The client starts an active connection - a call to connect (). This sends a SYN segment to the server to inform about the initial sequence number of the data that client will send during connection. The SYN usually contains an IP Header - a TCP Header and maybe some TCP option.3. The server should acknowledge the SYN sending with an ACK and a SYN with its sequence number (within the same TCP package).4. The client should acknowledge the server SYN with an ACKThis way of scanning has two advantages:· it is fast (nmap even has options that we will not analyze to make it faster on slow connections) · special privileges are not needed on the machine that launches the scanning but it has a big disadvantage. It is very simple to detect and easy to filter.The follow is the output of nmap sT davinci.newcs.uindsor.ca saturn.cspc1.uwindsor.ca# nmap -sT davinci.newcs.uwindsor.caStarting nmap V. 2.54BETA28 ( www.insecure.org/nmap/ )Interesting ports on davinci.newcs.uwindsor.ca (137.207.76.3):(The 1489 ports scanned but not shown below are in state: closed)Port State Service21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 37/tcp open time 42/tcp open nameserver 53/tcp open domain 80/tcp open http 111/tcp open sunrpc 135/tcp open loc-srv 139/tcp open netbios-ssn 143/tcp open imap2 389/tcp open ldap 491/tcp open go-login 514/tcp open shell 515/tcp open printer 587/tcp open submission 900/tcp open unknown 993/tcp open imaps 1112/tcp open msql 1357/tcp open pegboard 1358/tcp open connlcli 2040/tcp open lam 2049/tcp open nfs 2766/tcp open listen 3000/tcp open ppp 3001/tcp open nessusd 4045/tcp open lockd 6000/tcp open X11 6002/tcp open X11:2 6003/tcp open X11:3 6004/tcp open X11:4 6005/tcp open X11:5 6006/tcp open X11:6 6007/tcp open X11:7 6008/tcp open X11:8 6009/tcp open X11:9 6050/tcp open arcserve 6112/tcp open dtspc 6666/tcp open irc-serv 6667/tcp open irc 7001/tcp open afs3-callback 7002/tcp open afs3-prserver 7007/tcp open afs3-bos 7008/tcp open afs3-update 7009/tcp open afs3-rmtsys 7010/tcp open ups-onlinet 7100/tcp open font-service 8080/tcp open http-proxy 8081/tcp open blackice-icecap 8888/tcp open sun-answerbook 32771/tcp open sometimes-rpc5 32772/tcp open sometimes-rpc7 32773/tcp open sometimes-rpc9 32774/tcp open sometimes-rpc11 32775/tcp open sometimes-rpc13 32776/tcp open sometimes-rpc15 32777/tcp open sometimes-rpc17 32778/tcp open sometimes-rpc19 Nmap run completed - 1 IP address (1 host up) scanned in 4 seconds-sS TCP SYN scan: This technique is often referred to as "half-open" scanning, because you don't open a full TCP connection. You send a SYN packet, as if you are going to open a real connection and you wait for a response. A SYN|ACK indicates the port is listening. If we receive an RST instead of an ACK, then the scanned port is not active. This scanning procedure has the drawback that root privileges are needed to execute it. But it has the advantage that is difficult to detect in the scanned machine.Let's see a similar analysis of the actions done by nmap with this optionsaturn.cspc1.uwindsor.ca# nmap -sS davinci.newcs.uwindsor.caStarting nmap V. 2.54BETA28 ( www.insecure.org/nmap/ )Interesting ports on davinci.newcs.uwindsor.ca (137.207.76.3):(The 1489 ports scanned but not shown below are in state: closed)Port State Service21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 37/tcp open time 42/tcp open nameserver 53/tcp open domain 80/tcp open http 111/tcp open sunrpc 135/tcp open loc-srv 139/tcp open netbios-ssn 143/tcp open imap2 389/tcp open ldap 491/tcp open go-login 514/tcp open shell 515/tcp open printer 587/tcp open submission 900/tcp open unknown 993/tcp open imaps 1112/tcp open msql 1357/tcp open pegboard 1358/tcp open connlcli 2040/tcp open lam 2049/tcp open nfs 2766/tcp open listen 3000/tcp open ppp 3001/tcp open nessusd 4045/tcp open lockd 6000/tcp open X11 6002/tcp open X11:2 6003/tcp open X11:3 6004/tcp open X11:4 6005/tcp open X11:5 6006/tcp open X11:6 6007/tcp open X11:7 6008/tcp open X11:8 6009/tcp open X11:9 6050/tcp open arcserve 6112/tcp open dtspc 6666/tcp open irc-serv 6667/tcp open irc 7001/tcp open afs3-callback 7002/tcp open afs3-prserver 7007/tcp open afs3-bos 7008/tcp open afs3-update 7009/tcp open afs3-rmtsys 7010/tcp open ups-onlinet 7100/tcp open font-service 8080/tcp open http-proxy 8081/tcp open blackice-icecap 8888/tcp open sun-answerbook 32771/tcp open sometimes-rpc5 32772/tcp open sometimes-rpc7 32773/tcp open sometimes-rpc9 32774/tcp open sometimes-rpc11 32775/tcp open sometimes-rpc13 32776/tcp open sometimes-rpc15 32777/tcp open sometimes-rpc17 32778/tcp open sometimes-rpc19 Nmap run completed - 1 IP address (1 host up) scanned in 26 seconds-sF -sX -sNStealth FIN, Xmas Tree, or Null scan modes: This scanning is based on the fact that inactive ports on the target machine respond to a FIN package with a RST package. On the other hand, active ports simply ignore those packets. Therefore the list of interesting active ports is obtained by observing which are those that have not answered. Hosts running Microsoft operating systems can not be scanned with this method since they have a non standards-conforming implementation of the TCP protocol. sF, -sX, -sN are three types of this scan mode, and we will test all these three options as following:-sFsaturn.cspc1.uwindsor.ca# nmap -sF davinci.newcs.uwindsor.caStarting nmap V. 2.54BETA28 ( www.insecure.org/nmap/ )Interesting ports on davinci.newcs.uwindsor.ca (137.207.76.3):(The 1489 ports scanned but not shown below are in state: closed)Port State Service21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 37/tcp open time 53/tcp open domain 80/tcp open http 111/tcp open sunrpc 135/tcp open loc-srv 139/tcp open netbios-ssn 143/tcp open imap2 369/tcp filtered rpc2portmap 389/tcp open ldap 491/tcp open go-login 514/tcp open shell 515/tcp open printer 587/tcp open submission 900/tcp open unknown 993/tcp open imaps 1112/tcp open msql 1357/tcp open pegboard 1358/tcp open connlcli 2040/tcp open lam 2049/tcp open nfs 2766/tcp open listen 3000/tcp open ppp 3001/tcp open nessusd 4045/tcp open lockd 6000/tcp open X11