TryHackMe, Nmap

Md Afshar Alam

An in-depth look at scanning with Nmap, a powerful network scanning tool…

To view this room: https://tryhackme.com/room/furthernmap

Press enter or click to view image in full size

Introduction

Nmap helps us establish which services are running on the targets that we are testing. We can perform a port scan to see which ports are open. Ports are necessary for making multiple multiple network requests of having multiple services available.

Every computer has a total of 65535 available ports with a few of them being standard ports. For example, port 80 would run a HTTP server and port 443 would run a HTTPS server.

Get Afsharalam’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Nmap can be used to run many different types of port scans and can determine ports to be either open, closed, or filtered.

Answers

Task 2

What networking constructs are used to direct traffic to the right application on a server?
Ports

How many of these are available on any network-enabled computer?
65535

How many of these are considered “well-known”?
1024

Task 3

What is the first switch listed in the help menu for a ‘Syn Scan’ (more on this later!)?
-sS

Which switch would you use for a “UDP scan”?
-sU

If you wanted to detect which operating system the target is running on, which switch would you use?
-O

Nmap provides a switch to detect the version of the services running on the target. What is this switch?
-sV

The default output provided by Nmap often does not provide enough information for a pentester. How would you increase the verbosity?
-v

Verbosity level one is good, but verbosity level two is better! How would you set the verbosity level to two?
-vv

What switch would you use to save the Nmap results in three major formats?
-oA

What switch would you use to save the Nmap results in a “normal” format?
-oN

A very useful output format: how would you save results in a “grepable” format?
-oG

his is a shorthand switch that activates service detection, operating system detection, a traceroute and common script scanning. How would you activate this setting?
-A

How would you set the timing template to level 5?
-T5

How would you tell Nmap to only scan port 80?
-p 80

How would you tell Nmap to scan ports 1000–1500?
-p 1000–1500

How would you tell Nmap to scan all ports?
-p-

How would you activate a script from the Nmap scripting library (lots more on this later!)?
— script

How would you activate all of the scripts in the “vuln” category?
— script=vuln

Task 5

Which RFC defines the appropriate behaviour for the TCP protocol?
RFC9293

If a port is closed, which flag should the server send back to indicate this?
RST

Task 6

There are two other names for a SYN scan, what are they?
Half-Open, Stealth

Can Nmap use a SYN scan without Sudo permissions (Y/N)?
N

Task 7

If a UDP port doesn’t respond to an Nmap scan, what will it be marked as?
open|filtered

When a UDP port is closed, by convention the target should send back a “port unreachable” message. Which protocol would it use to do so?
ICMP

Task 8

Which of the three shown scan types uses the URG flag?
xmas

Why are NULL, FIN and Xmas scans generally used?
Firewall Evasion

Which common OS may respond to a NULL, FIN or Xmas scan with a RST for every port?
Microsoft Windows

Task 9

How would you perform a ping sweep on the 172.16.x.x network (Netmask: 255.255.0.0) using Nmap? (CIDR notation)
nmap -sn 172.160.0.0/16

Task 10

What language are NSE scripts written in?
Lua

Which category of scripts would be a very bad idea to run in a production environment?
Intrusive

Task 11

What optional argument can the ftp-anon.nse script take?
maxlist

Task 12

What is the filename of the script which determines the underlying OS of the SMB server?
smb-os-discovery.nse

Read through this script. What does it depend on?
smb-brute

Task 13

Which simple (and frequently relied upon) protocol is often blocked, requiring the use of the -Pn switch?
ICMP

Which Nmap switch allows you to append an arbitrary length of random data to the end of packets?
— data-length

Task 14

Does the target IP respond to ICMP echo (ping) requests (Y/N)?
N

Perform an Xmas scan on the first 999 ports of the target — how many ports are shown to be open or filtered?
999

There is a reason given for this — what is it?
No Response

Perform a TCP SYN scan on the first 5000 ports of the target — how many ports are shown to be open?
5

Can Nmap login successfully to the FTP server on port 21? (Y/N)
Y