Nmap: Nmap Live Host Discovery — TryHackMe

Nmap, also known as network mapper, is an essential tool used in linux systems to map the network (like the name suggests). It is used to discover online/up hosts in the network, scan the ports of these devices, scripts to scan for vulnerabilities on open ports, services used in those ports and their versions, detect the system of the host and many more different and varied uses.

This writeup will try to provide some insight into the Live Host Discovery part of the use of nmap and hopefully help as it has helped me learning these things.

Before we dive into the details, I recommend you learn subnetting if you do not know how to as this is essential to the use of nmap. I recommend visiting subnetting.net and checking out the resources listed there and to test yourself at The Subnet Game. Also, knowing about OSI model layers and TCP/IP model is helpful. For this I recommend Ben Eater networking series videos at youtube.

Get Timlssnss’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The box is available at https://tryhackme.com/room/nmap01

Introduction

Nmap uses these protocols to scan for live hosts.

Nmap usually goes through these steps while running in sequence.

Subnetwork

This is the given topology with the two switches in different networks.

How many devices can see the ARP Request?

As the ARP only broadcasts in the network with Switch1, the answer is the number of devices i.e. 4.

Did computer6 receive the ARP Request? (Y/N)

No, because ARP is a Layer 2 protocol and doesn’t flow through different network.

How many devices can see the ARP Request?

All the devices in the network containing computer4 i.e. 4.

Did computer6 reply to the ARP Request? (Y/N)

Yes, because computer4 and computer6 are in the same network.

Enumerating Targets

What is the first IP address Nmap would scan if you provided 10.10.12.13/29 as your target?

The network address for the given address 10.10.12.13/29 is 10.10.12.8 so the first IP that would be scanned is 10.10.12.8.

How many IP addresses will Nmap scan if you provide the following range 10.10.0-255.101-125?

There will be 25 IPs in the last block per 1 block in the third block which has 256 blocks (0–256). So, the number of IP addresses scanned is 256*25 = 6400.

Discovering Live Hosts

Send a packet with the following:

From computer1

To computer3

Packet Type: “Ping Request”

What is the type of packet that computer1 sent before the ping?

The first packet will be ARP request to map the MAC address to the IP of the machine.

What is the type of packet that computer1 received before being able to send the ping?

The packet after ARP request is ARP response.

How many computers responded to the ping request?

One. The computer pinged responds to the request.

Send a packet with the following:

From computer2

To computer5

Packet Type: “Ping Request”

What is the name of the first device that responded to the first ARP Request?

The router replies to first ARP request to establish route to computer5 from computer2 and add the MAC id and map it to computer5 in its ARP table.

What is the name of the first device that responded to the second ARP Request?

The computer5 responds to the second ARP request.

Send another Ping Request. Did it require new ARP Requests? (Y/N)

No is doesn’t as the MAC and ip of computer is already present in the ARP table.

Nmap Host Discovery Using ARP

We will be sending broadcast ARP Requests packets with the following options:

From computer1

To computer1 (to indicate it is broadcast)

Packet Type: “ARP Request”

Data: try all the possible eight devices (other than computer1) in the network: computer2, computer3, computer4, computer5, computer6, switch1, switch2, and router.

How many devices are you able to discover using ARP requests?

Only the computers/network devices in the same network are able to be discovered using ARP so the answer is the number of devices, i.e. 3.

Nmap Host Discovery Using ICMP

All of these can easily be solved by scouring the nmap help and man pages, which is also an essential part of “linuxing”. (Help and man pages are your best friends)

What is the option required to tell Nmap to use ICMP Timestamp to discover live hosts?

• -PP

What is the option required to tell Nmap to use ICMP Address Mask to discover live hosts?

• -PM

What is the option required to tell Nmap to use ICMP Echo to discover live hosts?

• -PE

Nmap Host Discovery using TCP and UDP

These can be done using wireshark and nmapping the localhost(127.0.0.1) using sudo or without sudo.

Which TCP ping scan does not require a privileged account?

• TCP SYN Ping

Which TCP ping scan requires a privileged account?

• TCP ACK Ping

What option do you need to add to Nmap to run a TCP SYN ping scan on the telnet port?

• -PS23 (P for port, 23 for telnet port and S for SYN)

Using Reverse-DNS Lookup

We want Nmap to issue a reverse DNS lookup for all the possibles hosts on a subnet, hoping to get some insights from the names. What option should we add?

• -R

Conclusion

This box introduces us to the different use of Nmap along with basic and intermediate knowledge of networking principles. Using help and man pages to search for anything we may need. I hope you learned something new doing this box and from this writeup.

Thanks for reading!