100 days of Learning Penetration testing -Day 3
Hello everyone & welcome to day 3. As i told in day 2, today we will study about nmap nse and had decided to solve vulnversity lab previouslybut i had decided to do vulnversity and blue lab both at day 4. SO, without any delay, lets get started.
I have selected the NMAP post port scans room from tryhackme.
Task 2
Service Detection
-sV
will complete the tcp three way handshake.
-sV — version-intensitylevel ( -sV — version-light has intensity 2 while -sV — version-all has 9)
-sS stealth syn scan is not possible when -sV is choosen
Question
Start the target machine for this task and launch the AttackBox. Run nmap -sV — version-light 10.10.112.153via the AttackBox. What is the detected version for port 143?
ans. Dovecot imapd
Which service did not have a version detected with — version-light?
ans. rpcbind
Task3
OS Detection and Traceroute
Os detection
-O
Traceroute
— traceroute
standard traceroute on macos or tracert on windows stats with a low TTL value whereas Nmap starts with high ttl and keeps decreasing it.
Question
Run nmap with -O option against 10.10.112.153. What OS did Nmap detect?
Linux
Task 4 : Nmap scripting Engine (NSE)
WE can add custom script using LUA language
we can also find inbuilt script. we can find it on /usr/share/nmap/scripts
Nmap default scipt
-sC or — script=default
default category include: auth, broadcast, brute, default, discovery, dos, malware , version and vuln
we can specify script by name using — script “SCRIPT-NAME”
Questions
Knowing that Nmap scripts are saved in /usr/share/nmap/scripts on the AttackBox. What does the script http-robots.txt check for?
ans. disallowed enteries
Can you figure out the name for the script that checks for the remote code execution vulnerability MS15–034 (CVE2015–1635)?
Get Samin Basnet’s stories in your inbox
Join Medium for free to get updates from this writer.
ans. http-vuln-cve2015–1635
Launch the AttackBox if you haven’t already. After you ensure you have terminated the VM from Task 2, start the target machine for this task. On the AttackBox, run Nmap with the default scripts -sC against 10.10.4.21. You will notice that there is a service listening on port 53. What is its full version value?
ans. 9.18.28–1~deb12u2-Debian
Based on its description, the script ssh2-enum-algos “reports the number of algorithms (for encryption, compression, etc.) that the target SSH2 server offers.” What is the name of the server host key algorithm that relies on SHA2–512 and is supported by 10.10.4.21?
ans. rsa-sha2–512
Task 5 : saving the output
Normal
-oN
grepable
-oG
xml
-oX
All three
-oA
script kiddie
-oS filename
Question
Check the attached Nmap logs. How many systems are listening on the HTTPS port?
ans: 3
What is the IP address of the system listening on port 8089?
ans . 172.17.20.147
Summary of Day 3
-sV = determine service/version info on open ports
-sV — version-light = try the most likely probes(2)
-sV — version-all = try all available probes(9)
-O = detect OS
— traceroute
— scripts=SCRIPTS
-sC or — script=default
-A = equivalent to -sV -o -sC — traceroute
-oN = normal format
-oG = grepable
-oX = xml
- oA = all
Bye! Bye! everyone. we will do Vulnversity as well as blue lab on day 4 so stay tuned.
