[DumbChicken]

DISCLAIMER: This is only an introduction to nmap, for further informations about nmap, check: https://linux.die.net/man/1/nmap

Why and when to scan a network ?
  Scanning a network allows you to make a topology of the said network, you will be able to see the IP adresses of every client connected and eventually the brand/name of the client machine.

How to scan ?
  (requirement: a debian linux distro, preferably Kali or Parrot)
  There are a lot of tools to scan a network, here we will use nmap, because it's the most complete and popular one.
  First, verify that nmap is correctly installed, otherwise install it:
     

Code

sudo apt install nmap

  Firstly, find your IP (V4) address in the LAN:
     

Code

hostname -I

      if your IP address is 192.168.1.1x,
      then use 192.168.1.0 in nmap.
// ex: 182.121.1.19 --> 182.121.1.0

  Here I will show you some of the most useful nmap parameters:
 

Code

sudo nmap {ip_address}/24

  Note- I will not specify here why the range used is 24, to make it simple, most small networks work with it.
  The output look like this:

Code

Starting Nmap 7.80 ( https://nmap.org ) at 2022-01-▒▒ ▒▒:▒▒ CET
Nmap scan report for 192.168.1.▒
Host is up (0.0035s latency).
All 1000 scanned ports on 192.168.1.▒ are closed
MAC Address: ▒▒:▒▒:▒▒:▒▒:▒▒:▒▒ (▒▒▒▒▒▒▒)

Nmap scan report for 192.168.1.▒▒
Host is up (0.13s latency).
Not shown: 999 closed ports
PORT      STATE SERVICE
6▒▒▒/tcp open  iphone-sync
MAC Address: ▒▒:▒▒:▒▒:▒▒:▒▒:▒▒ (Apple)

Nmap scan report for 192.168.1.▒▒
Host is up (0.62s latency).
All 1000 scanned ports on 192.168.1.▒▒ are closed
MAC Address: ▒▒:▒▒:▒▒:▒▒:▒▒:▒▒ (Unknown)

Nmap scan report for 192.168.1.▒
Host is up (0.0066s latency).
Not shown: 981 filtered ports
PORT      STATE  SERVICE
80/tcp    open  http
▒▒▒▒/tcp  open  ▒▒▒▒
▒▒▒▒/tcp  open  ▒▒▒▒
▒▒▒▒/tcp  closed ▒▒▒▒
▒▒▒▒/tcp  closed ▒▒▒▒
▒▒▒▒/tcp  closed ▒▒▒▒
▒▒▒▒/tcp  closed ▒▒▒▒
▒▒▒▒/tcp  open  ▒▒▒▒
▒▒▒▒/tcp  open  ▒▒▒▒
▒▒▒▒/tcp  open  http-proxy
▒▒▒▒/tcp  open  ▒▒▒▒
▒▒▒▒/tcp  closed ▒▒▒▒
▒▒▒▒▒/tcp closed ▒▒▒▒
▒▒▒▒▒/tcp closed ▒▒▒▒
▒▒▒▒▒/tcp closed unknown
▒▒▒▒▒/tcp closed unknown
▒▒▒▒▒/tcp closed ▒▒▒▒
▒▒▒▒▒/tcp closed unknown
▒▒▒▒▒/tcp closed unknown
MAC Address: ▒▒:▒▒:▒▒:▒▒:▒▒:▒▒ (*ISP name*)

Nmap scan report for 192.168.1.6
Host is up (0.091s latency).
All 1000 scanned ports on 192.168.1.6 are filtered
MAC Address: ▒▒:▒▒:▒▒:▒▒:▒▒:▒▒ (iRobot)

Nmap scan report for 192.168.1.▒
Host is up (0.0037s latency).
Not shown: 996 closed ports
PORT    STATE SERVICE
2001/tcp open  dc
3000/tcp open  ppp
3001/tcp open  nessus
9998/tcp open  distinct32
MAC Address: ▒▒:▒▒:▒▒:▒▒:▒▒:▒▒ (LG Innotek)

Nmap scan report for _gateway (192.168.1.254)
Host is up (0.026s latency).
Not shown: 983 filtered ports
PORT    STATE  SERVICE
21/tcp  open  ▒▒▒▒
53/tcp  open  ▒▒▒▒
80/tcp  open  http
139/tcp  closed ▒▒▒▒
443/tcp  open  https
445/tcp  open  ▒▒▒▒
548/tcp  closed ▒▒▒▒
554/tcp  open  ▒▒▒▒
1723/tcp open  ▒▒▒▒
2020/tcp open  ▒▒▒▒
5000/tcp open  ▒▒▒▒
5001/tcp closed ▒▒▒▒
5357/tcp open  ▒▒▒▒
5678/tcp open  ▒▒▒▒
6000/tcp closed ▒▒▒▒
8090/tcp open  ▒▒▒▒
9091/tcp open  ▒▒▒▒
MAC Address: ▒▒:▒▒:▒▒:▒▒:▒▒:▒▒ (*ISP name*)

Nmap scan report for laptop (192.168.1.254)
Host is up (0.000078s latency).
Not shown: 999 closed ports
PORT    STATE SERVICE
▒▒▒▒/tcp open  ▒▒▒▒

Nmap done: 256 IP addresses (8 hosts up) scanned in 291.83 seconds

  Note- This scan can take a long time, be patient.

  Here are some variations:
 

Code

sudo nmap -O {ip_address}/24

> OS guess.
 

Code

sudo nmap -A {ip_address}/24

> agressive scan, enable parameters like OS detection, version detection etc...
 

Code

sudo nmap -6 {ip_address}/24

> Enable IPv6.
 

Code

sudo nmap -Pn {ip_address}/24

> Treat all hosts as online & skip host discovery.

  Note- you can use the specific address of a client:
 

Code

sudo nmap -O 192.168.1.6

> Guess the OS of my smart vacuum cleaner

  Obviously you can make combinations of parameters:
 

Code

sudo nmap -O -6 -Pn {ip_address}/24

- Good luck !

---

PS: Write any recommendations here, I'm wiling to improve the quality of this thread as much as possible.

[linkinpork]

PS: Write any recommendations here, I'm wiling to improve the quality of this thread as much as possible.

*Roombas use iRobot Roomba 980 vacuum cleaner with Linux 4.6 but anyway...

Service scan, banner-grabs after the port scanning is complete:

Code

nmap -sV 192.168.*.*

Ping scan, doesn't scan ports, just pings the nodes to see if they're up:

Code

nmap -sn 192.168.*.*

UDP scan, checks the UDP ports instead of the TCP ones:

Code

nmap -sU <IP address>

Checks 65,535 ports, not just the basic 1,000:

Code

nmap -p- <IP address>

"Fast mode", checks only the most basic 100 ports

Code

nmap -F <IP address>

"Paranoid template", very slow

Code

nmap -T0 <IP address>

"Insane template", very fast

Code

nmap -T5 <IP address>

[Beladonis]

https://linux.die.net/man/1/nmap

The man page of nmap, every arguments are well explained here

[๖ۣۜGC༻]

Nice guide, I'd also recommend having a go at some of the live labs on TryHackMe or similar services; you can get hands-on experience with the tool there, you can literally connect to a VM from within your browser, no installation for required.

Hope this helps.

[DumbChicken]

Nice guide, I'd also recommend having a go at some of the live labs on TryHackMe or similar services; you can get hands-on experience with the tool there, you can literally connect to a VM from within your browser, no installation for required.

Hope this helps.

Sounds quite similar to HackTheBox to me, well, I'll give it a go. Thanks!

[Scl_Nvz]

nice job very good thread