1

I know nmap is a port scanner and its output shows all the open ports, the services running on those ports, the underlying OS and technology, etc. What should one take from this result in easiest possible terms especially if someone is from application security background?

This question may sound stupid but I would prefer if people can connect all the dots from an adversary perspective.

Kind Regards,

  • 1
    Perhaps we need to ask why you ran nmap in the first place? What answers did you seek when you ran it? – schroeder Jun 6 '14 at 14:29
2

Let's see an example:

# nmap -sS foo

Starting Nmap 6.40 ( http://nmap.org ) at 2014-06-06 15:16 BST
Nmap scan report for foo (XXX.XXX.XXX.XXX)
Host is up (0.0036s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
5900/tcp open  vnc
5901/tcp open  vnc-1
6000/tcp open  X11
MAC Address: B8:27:EB:XX:XX:XX (Raspberry Pi Foundation)

Nmap done: 1 IP address (1 host up) scanned in 0.26 seconds

What should one take from this result in easiest possible terms especially if someone is from application security background?

I'm not sure what you mean by "easiest possible terms", but from the nmap scan I showed you above one can see

  • that the host is responding to ICMP probes (text removed after comment, see below)
  • that it has a bunch of open ports
  • that it is likely to be a Raspberry Pi

At this point you might want to investigate these open ports, or try a nmap -sU to check open UDP ports...

This question may sound stupid but I would prefer if people can connect all the dots from an adversary perspective.

If you meant to ask "what can an adversary do", the only limit is time, inspiration and creativity. nmap is a first point of contact with a remote host; it comes with drawbacks and caveats as most port scan can be detected (however see this for a fascinating read).

In practical terms, once you see what's open, the first step might be to assess what's actually running there; check whether it's actually protected; see if you can gain more information e.g. on the version of the servers running; perhaps enumerate username (so you can test them on another machine), and so on.

UPDATE

A commenter below made me notice that:

If the target had been on a different link-layer segment (i.e. one or more IP hops away), then ICMP would have been used (among other probes), and no MAC address would be shown. The only way you can get a MAC address and use ICMP for discovery is to add --disable-arp-ping or --send-ip. Even explicitly requesting ICMP Echo with -PE will use ARP for discovery otherwise

The current revision of the answer has been corrected.

| improve this answer | |
  • 1
    Nothing in that output indicates response to ICMP packets. The fact that you see a MAC address indicates Nmap probably used ARP requests to determine the host was up. You can add --reason to see this for certain. – bonsaiviking Jun 6 '14 at 21:12
  • @bonsaiviking actually nmap uses a ICMP ping before starting the scan. In fact, you can disable it with -P0 if you are sure the host is up. – lorenzog Jun 9 '14 at 8:13
  • 3
    As one of the core Nmap developers, I can assure you that in the scan you showed, no ICMP packets were sent. If the target had been on a different link-layer segment (i.e. one or more IP hops away), then ICMP would have been used (among other probes), and no MAC address would be shown. The only way you can get a MAC address and use ICMP for discovery is to add --disable-arp-ping or --send-ip. Even explicitly requesting ICMP Echo with -PE will use ARP for discovery otherwise. – bonsaiviking Jun 9 '14 at 12:39
  • @bonsaiviking you're right. I wanted to show a nmap scan of a remote host, but since I was at work I did not want to risk it - so I scanned a local machine. I was not aware of the difference. Thanks (I'll edit the answer shortly) – lorenzog Jun 9 '14 at 12:46
2

The short answer is it gives you information and points to where you should spend your time next.

You sort of answered your own question, in that nmap does give you:

all the open ports,services running on those ports, underlying OS and technology etc.

as well as the fact that those things are not firewalled off from the point of nmap scan.

With all of this information you can cross-reference vulnerabilities that may apply to such services, OSes, etc. Some might be current vulnerabilities with no easily-available patch, in which case you're in. Others might be older vulnerabilities, in which case you will have to test and see if the target box is up to date on patches or not.

| improve this answer | |
1

What Nmap offers is information, from a particular perspective. In general, Nmap offers the following information:

  • That a host of some kind will answer to a particular network address (host discovery)
  • That services of some kind will answer to particular ports and protocols directed at that host (port scanning)
  • Details such as version, hostname, configuration, etc. for those services (version detection and script scanning)
  • The name of operating systems that respond identically or similarly to a set of odd network packets (OS fingerprinting)

Each of these pieces of information are delivered from the perspective of the network. There are more authoritative ways of discovering all of this information from the host's own perspective:

  • Running ifconfig or ipconfig on the host can show the network addresses configured.
  • Running netstat will show the ports and protocols that are listening.
  • Running a package manager or viewing configuration files will show the names, versions, and configurations of those services.
  • Running uname or winver will show the OS version in greater detail than Nmap can deduce.

So why bother running Nmap? There are basically two reasons:

  1. The network perspective is more relevant, or
  2. It is easier than gathering the information some other way.

The network perspective may be more relevant because security controls or configurations mean that some services or network addresses are not accessible by an attacker. If a firewall is blocking all ports but 80/tcp, then it doesn't matter from a network security perspective if 445/tcp is also listening. If a switch is isolating a host into a different VLAN, then it doesn't matter what services or OS are on that host, from the perspective of an attacker on some other VLAN.

Finally, an Nmap scan may be easier than querying each host directly. From an attacker's perspective, this is obvious; the attacker does not have credentials to the target hosts, so a port scan is the only way to determine this information. Sometimes network admins don't know everything that is on their network; either they lack the proper documentation, or someone has connected an unauthorized device. In these situations, Nmap can be used to get the ground-truth answer of what addresses are being used and for what purpose.

In the end, it comes down to more information. And information is how the game is played.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.