What is Nmap?

Alright, let’s start at the very beginning! So, Nmap—short for Network Mapper—is a tool that can scan networks, detect open ports, and probe all sorts of data about a network’s hosts. In bug hunting, Nmap’s power is practically unmatched for mapping out a network and pinpointing potential vulnerabilities.

Why Use Nmap for Advanced Usage ?

Why? Because Nmap is versatile, precise, and packs a punch when it comes to finding out how a network or device might be exposed. Bug hunters rely on Nmap for identifying open ports, services, and potential entry points, which is crucial to uncover weaknesses.

Setting Up Nmap: Installation Guide

Before diving into the advanced commands, you’ll need Nmap installed. This part’s easy, even if you’re just getting started with network tools.

  1. Linux:
sudo apt-get install nmap

2. Windows:
Download the installer from Nmap.org and run the setup.

3. MacOS:

brew install nmap

After that, check your installation with a simple command:

nmap -v

Nmap Basics for Beginners

If you’re totally new to Nmap, you’ll want to start with some basic commands to get comfortable with it.

  1. Basic Host Scan:
    This command scans a specific IP or domain:
nmap scanme.nmap.org

2. Range Scan:
Scanning a range can reveal multiple hosts:

nmap 192.168.1.1-100

Advanced Nmap Techniques for Bug Bounty Hunting

Once you’ve covered the basics, it’s time to explore advanced techniques. These are commands that help you dig deeper, identify specific services, versions, and possible vulnerabilities.

  1. Service and Version Detection:
nmap -sV example.com

Use this to see which versions of services are running on each port.

2. Operating System Detection:

nmap -O example.com
  • This scans for OS fingerprints, giving you a glimpse into the server’s operating system.

3. Script Scanning with NSE (Nmap Scripting Engine):

nmap --script vuln example.com
  • Nmap’s scripting engine includes a whole set of scripts to check for vulnerabilities.

4. Aggressive Scan:

nmap -A example.com

While a bit intrusive, this command enables OS detection, version scanning, script scanning, and traceroute.

Advanced Usage Techniques for Nmap

1. Deep Vulnerability Scanning with NSE Scripts

Nmap’s Scripting Engine (NSE) is extremely powerful. It can automate checks for specific vulnerabilities and even integrate with databases to give you detailed vulnerability assessments.

  • Database Vulnerability Scans:
    To detect known vulnerabilities in databases like MySQL or PostgreSQL, you can use specialized scripts:
nmap -p 3306 --script mysql-vuln-cve2022 example.com

Custom Script Directories:
If you’ve written or downloaded custom NSE scripts, you can direct Nmap to use a specific folder:

nmap --script /path/to/custom/scripts example.com

Brute-forcing Logins:
Many NSE scripts can attempt brute-forcing common logins. For example:

nmap -p 21 --script ftp-brute example.com

2. TCP ACK Scan for Firewall Testing

This is one of those “ninja” techniques used to probe whether a firewall is blocking specific ports. The ACK scan (-sA) sends TCP packets without expecting a response. Instead, you observe how the firewall responds.

nmap -sA -p 80,443 example.com

This can help you detect firewall rules and identify open ports indirectly. If a port shows up as “unfiltered,” it means it’s likely open but hidden behind a firewall.

3. Idle Scan (Zombie Scan)

The Idle Scan (-sI) is an advanced stealth scan that involves using an idle host (a “zombie”) to send packets. This way, your IP address never shows up on the target’s logs, making it an effective way to remain anonymous.

nmap -sI zombie_host example.com

Note: Idle scans can be challenging to set up because they rely on finding a suitable “zombie” machine with predictable IP IDs.

4. Timing Optimization with Aggressive Timing (Fast Scan)

Scanning large networks or remote targets can be slow. Using aggressive timing (-T4 or -T5) can speed up scans significantly, though it may raise flags.

nmap -T5 example.com

Be careful with this, as highly aggressive timing can flood the target with requests, potentially alerting intrusion detection systems (IDS) or firewalls.

5. OS Fingerprinting with TCP/IP Stack Analysis

The TCP/IP stack behavior of a device often reveals the operating system it’s running. Use the -O option with verbose output to increase accuracy:

nmap -O --osscan-guess -v example.com

This is particularly useful for advanced bug hunting as it helps tailor exploit payloads and understand the network environment.

6. Exploiting Timing Gaps with Slow Scans

Some firewalls and IDSs detect scans based on packet frequency. Slowing down your scan with -T1 or -T0 can help evade these systems:

nmap -T1 example.com
Pro Tip: Use slow scans when working with well-protected targets, as they can reveal information over time without tripping alarms.

Evading Firewalls and IDS/IPS

1. MAC Address Spoofing

Some systems whitelist certain MAC addresses. Spoofing a MAC address can sometimes bypass access restrictions.

nmap --spoof-mac 00:11:22:33:44:55 example.com

2. Using Decoys to Mask Your IP

Decoy scanning adds a layer of obfuscation by making it appear that multiple IP addresses are scanning the target. This can confuse IDSs, making it harder for defenders to pinpoint the true source of the scan.

nmap -D decoy1,decoy2,ME example.com

3. Fragmenting Packets

Fragmented packets may evade certain firewalls or IDSs by breaking down the scan into small, inconspicuous packets.

nmap -f example.com

4. Randomizing Target Order

Scanning hosts in a predictable sequence is another thing that can alert IDSs. Randomizing the scan order helps evade detection, especially when scanning multiple IPs or ranges.

nmap --randomize-hosts example.com

Advanced Target Discovery Techniques

1. IP Range Scanning with Subnet Mask

When bug hunting across multiple devices, using CIDR notation lets you target a broader range efficiently.

nmap -sP 192.168.1.0/24

2. Discovering Hidden Services with All-Ports Scans

Some vulnerable services are hosted on unusual ports. Scanning every port can reveal these hidden gems.

nmap -p- example.com

3. Scanning IPv6 Addresses

Some targets may expose different services on IPv6 than IPv4, as many assume it’s less monitored.

nmap -6 example.com

4. Banner Grabbing for Application Fingerprinting

Banner grabbing captures information from services running on open ports, useful for identifying software and potential vulnerabilities.

nmap -sV --script=banner example.com

Essential Commands for Every Bug Hunter

When I’m on a bug hunt, there are some go-to Nmap commands that I use repeatedly. Here’s my list:

  • Port Scan with Intensity Levels
nmap -T4 -p- example.com
This scans all ports (-p-) with a moderate intensity level (-T4), allowing a faster scan.
  • Finding Open Ports Only:
nmap --open example.com
Filters out closed ports and saves you time when looking for vulnerable services.
  • Stealth Scan:
nmap -sS example.com
The stealth scan (or SYN scan) sends SYN packets to avoid detection, helping to stay under the radar in some cases.

Avoiding Detection: Best Practices

While using Nmap, detection is sometimes unavoidable, but a few tactics can help reduce your chances of being flagged.

  1. Randomize Your Scan Timings:
    Use different timing options like -T2 or -T3 to reduce scan speeds and avoid generating noticeable traffic spikes.
  2. Fragment Your Packets:
    Fragmenting packets can sometimes evade firewalls:
nmap -f example.com

3. Spoofing and Decoy Hosts:
Spoofing is a bit advanced but can help anonymize your scan:

nmap -D RND:10 example.com

Pro Tips for Effective Bug Hunting with Nmap

Now, here’s where the real magic happens. These pro tips can turn a basic scan into a targeted, sophisticated bug-hunting operation.

  • Automate with NSE Scripts:
    Nmap’s scripting engine can automate complex tasks. Try using specific scripts like --script=exploit to search for known exploits.
  • Logging Your Scans for Review:
nmap -oN output.txt example.com

Keeping a log of your scans can save tons of time when you’re revisiting a target.

  • Custom Port Range Based on Common Vulnerabilities:
nmap -p 21,22,80,443 example.com
  • Focus on ports often associated with vulnerabilities to save time.

More Advanced Nmap Usage Techniques

1. Deep Vulnerability Scanning with NSE Scripts

Use specific NSE scripts to target databases, brute-force logins, or explore vulnerabilities.

2. TCP ACK Scan for Firewall Testing

This command helps identify firewall rules.

nmap -sA -p 80,443 example.com

3. Idle Scan (Zombie Scan)

The Idle Scan (-sI) is an advanced stealth scan that involves using an idle host.

nmap -sI zombie_host example.com

Exporting and Parsing Nmap Output for Analysis

1. Exporting in XML Format for Automation

If you’re analyzing large datasets, exporting Nmap results as XML allows easier parsing and automation.

nmap -oX output.xml example.com

2. JSON Output for Integration with Other Tools

JSON output can be fed into various analytics or visualization tools.

nmap -oJ output.json example.com

3. Grepable Output for Quick Analysis

Grepable output makes it easy to quickly search and analyze results, ideal for identifying specific patterns or open ports:

nmap -oG output.grep example.com

Example of quick searching:

grep "open" output.grep

Automating Nmap Scans with Custom Scripts

For repeatable or extensive scans, automating Nmap scans via custom shell scripts or Python scripts can save time and increase accuracy.

  • Example of a Basic Automation Script:
  • #!/bin/bash for ip in $(cat targets.txt); do nmap -A -oN "$ip-scan.txt" $ip done
  • Advanced Python Script Using subprocess Module:
  • import subprocess targets = ['example.com', '192.168.1.1'] for target in targets: subprocess.run(['nmap', '-A', '-oN', f'{target}-scan.txt', target])

Automation scripts like these can cycle through targets and save detailed output, making it easy to review or generate reports later.

Final Recommendations

Mastering Nmap requires practice, patience, and sometimes, creativity. Using these advanced techniques allows you to adapt to different scenarios, avoid detection, and uncover hidden vulnerabilities that standard scans might miss. However, remember always to use Nmap ethically—unauthorized scanning can be illegal and against bug bounty policies.

This guide now delves even deeper into advanced uses of Nmap.