Practical 6: Scanning using Nmap

===== SOURCE: Scanning_using_Nmap_Prac6.docx =====

Practical 6 :- Scanning using Nmap

1. Basic Scan

Command:
nmap -sn -Pn 192.168.1.0/24
Profile: Ping Scan
Purpose: Scans the entire subnet 192.168.1.0/24 to see which hosts are up without
doing a full port scan.
Key Flags:
o -sn: Ping scan (no port scan)
o -Pn: Treat all hosts as up, even if they don’t respond to pings (useful when
firewalls block ICMP).








2. Intense Scan
Command:
nmap scanme.nmap.org
Profile: Intense scan
Purpose: Performs a detailed scan on scanme.nmap.org, including:
o Port scanning
o Service version detection
o OS detection
o Traceroute
Note: scanme.nmap.org is a public test target provided by Nmap.





3. Basic Scan (for a website)
Command:
nmap www.google.com
Purpose: Performs a simple scan to find out which ports are open on
www.google.com.




4. Scan Specific Ports (Range)
Command:
nmap -p 1-100 www.google.com
Purpose: Scans ports 1 to 100 on www.google.com to identify which are open.




5. OS Detection
Command:
nmap -O www.google.com
Purpose: Attempts to detect the operating system of www.google.com.



6. Scan Specific Ports (Single Ports)
Command:
nmap -p 23,43 www.google.com
Purpose: Scans only ports 23 (Telnet) and 43 (whois) on www.google.com to check
their status.


7. Exclude Specific Port
Command:
nmap --exclude 23 www.google.com
Purpose: Excludes port 23 (Telnet) from the scan on www.google.com. This is useful if you don’t want to scan a specific port.



8. Exploration of Basic Commands and Scans (SYN Scan)
Command:
nmap -sS www.google.com
Purpose: Performs a SYN Scan (stealth scan) to check open ports on
www.google.com. It’s the most common type of scan because it is fast and less likely
to be detected by firewalls.



9. ACK Scan
Command:
nmap -sA www.google.com
Purpose: Performs an ACK Scan. This scan is used to map out firewall rulesets by
sending ACK packets to the target. It helps determine whether ports are filtered or
not.


10. FIN Scan
Command:
nmap -sF www.google.com
Purpose: Performs a FIN Scan. Sends FIN packets to the target. It works by trying to
confuse firewalls and is useful for stealthy scanning, but not all systems will respond
to FIN scans.


11. NULL Scan
Command:
nmap -sN www.google.com
Purpose: Performs a NULL Scan. It sends packets with no flags set (all flags are zero).
This scan can sometimes evade detection on certain firewalls.

12. XMAS Scan
Command:
nmap -sX www.google.com
Purpose: Performs an XMAS Scan. It sends packets with the FIN, URG, and PSH flags
set, which causes some systems to react unusually. This scan is useful for evading
detection on certain firewalls.

LAB SAFETY: Perform security testing only on systems, accounts, and networks you own or have explicit permission to test. Use isolated training targets and follow instructor directions.