Nmap Basics for Capture The Flag (CTF)

Intro

nmap is Network Mapper used for network discovery and security auditing. Nmap can be used for enumeration to identify open ports and services. Enumeration in Cybersecurity is information gathering technique.

Some of the scripts in this category are considered intrusive and should not be run against a target network without permission.

# Active host, network discovery
sudo nmap -sn 10.10.0.0/24

# Scan all ports, takes longer.
sudo nmap -p- <target-ip-addr>

# Enable version detection, name and description of identified services.
sudo nmap -sV <target-ip-addr>

# Performs a script scan using the default set of scripts
sudo nmap -sC <target-ip-addr>

# Aggressive scan.
nmap -A <target-ip-addr>

# Aggressive, OS detection, Time Template Aggressive, Scan for vulnerability.
nmap -A -O -T4 --script=vuln <target-ip-addr>

# Version, perform script, 5000 packets per second, all ports
nmap -sV -sC -T4 –min-rate 5000 -p- <target-ip-addr>

RFC 9293 states that: “If the connection is CLOSED or doesn’t exists, then a RST is sent in response.”

ping sweep

For black box penetration testing, “ping sweep” become very handy to map network structure with active IP address of hosts. Nmap provides -sn switch followed by IP range or CIDR notation to perform it.

nmap -sn 10.0.0.1-254
or
nmap -sn 10.10.0.0/24

Nmap Options

Timing Templates

Understanding Network Traffic

Changing the TCP connection options in nmap or using browser changes the type of network traffic in Wireshark. Differentiating all network scan traffic:

• Browser: The network traffic captured shows full TCP handshake (SYN, SYN-ACK, ACK) for each new TCP connection. This is because the browser is establishing a full connection to retrieve the requested web page.
• Nmap Scan with -sS (TCP SYN Scan): The network traffic sent is (SYN, SYN-ACK). If nmap receives SYN-ACK then it indicates the port is open. There is no complete handshake with an ACK packet instead Nmap immediately sends an RST packet to close the connection referred to as (a half-open scan). This makes the scan faster and less likely to be logged by the target system.
• Nmap Scan with -sT (TCP Connect Scan): The network traffic sent is a full TCP connection (SYN, SYN-ACK, ACK) with each target port. This type of scan is more likely to be logged by the target system because it establishes a full connection

Understanding NSE

The Nmap Scripting Engine (NSE) is a powerful reconnaissance tool used for vulnerabilities scan, automating exploits.

Some categories include (Reference: TryHackMe):

References

• https://nmap.org/book/performance-timing-templates.html
• https://nmap.org/nsedoc/categories/vuln.html
• https://nmap.org/book/nse-usage.html
• https://mohomedarfath.medium.com/nmap-tryhackme-room-level-1-level-7-41ba9ff689ae