Skip to content

🔍 Scanning Networks

After getting public information about a target, the next step is to gather as much information as possible about the target’s network.

This is done by scanning the target’s network for active hosts, open ports, and services running on those ports.

nmap is the most popular open-source network scanner.

It is used to discover hosts and services on a computer network by sending packets and analyzing the responses.

Host discovery is the process of identifying active devices on a network.

Terminal window
# ARP ping scan
nmap -sn -PR TARGET
# UDP ping scan
nmap -sn -PU TARGET
# ICMP echo scan
nmap -sn -PE TARGET
# TCP SYN ping scan
nmap -sn -PS TARGET

Port and service discovery is the process of identifying open ports and services running on a target.

Terminal window
# TCP SYN scan
nmap -sS TARGET
# TCP connect scan
nmap -sT TARGET
# TCP ACK scan
nmap -sA TARGET

OS discovery is the process of identifying the operating system running on a target by analyzing the responses to various probes.

Terminal window
# OS detection
nmap -O TARGET
# Aggressive scan
nmap -A TARGET

Scanning beyond an IDS or firewall is the process of bypassing security measures to identify open ports and services.

Terminal window
# Split packets into smaller fragments
nmap -f TARGET
# Port manipulation
nmap -g 80 TARGET
# Smaller packets
nmap -mtu 8 TARGET
# Decoy scan
nmap -D RND:10 TARGET
# Randomize MAC
nmap --spoof-mac 0 TARGET