Scanning Exercise

Nmap

Nmap stands for Network Mapper. It is one of the most popular network scanner and it is widely used by network specialists to perform penetration testing as well as for scanning techniques.

Test 1: nmap -v -A -p -34.207.4.87

Command-Line Flags:

  • -v: Verbose (outputs all background processes to the console)
  • -A: Aggressive (Enables script scanning, operating system detection and tracerouting)
  • -p-: Scan the full range of all ports excluding zero


  • Result :
    
                                            Starting Nmap 7.91 ( https://nmap.org ) at 2021-10-11 11:48 EDT
                                            NSE: Loaded 153 scripts for scanning.
                                            NSE: Script Pre-scanning.
                                            Initiating NSE at 11:48
                                            Completed NSE at 11:48, 0.00s elapsed
                                            Initiating NSE at 11:48
                                            Completed NSE at 11:48, 0.00s elapsed
                                            Initiating NSE at 11:48
                                            Completed NSE at 11:48, 0.00s elapsed
                                            Initiating Ping Scan at 11:48
                                            Scanning 34.207.4.87 [2 ports]
                                            Completed Ping Scan at 11:48, 0.12s elapsed (1 total hosts)
                                            Initiating Parallel DNS resolution of 1 host. at 11:48
                                            Completed Parallel DNS resolution of 1 host. at 11:48, 0.06s elapsed
                                            Initiating Connect Scan at 11:48
                                            Scanning ec2-34-207-4-87.compute-1.amazonaws.com (34.207.4.87) [65535 ports]
                                            Discovered open port 80/tcp on 34.207.4.87
                                            Connect Scan Timing: About 3.60% done; ETC: 12:02 (0:13:51 remaining)
                                            Increasing send delay for 34.207.4.87 from 0 to 5 due to 11 out of 34 dropped probes since last increase.
                                            Connect Scan Timing: About 7.59% done; ETC: 12:01 (0:12:22 remaining)
                                            Connect Scan Timing: About 10.28% done; ETC: 12:03 (0:13:15 remaining)
                                            Increasing send delay for 34.207.4.87 from 5 to 10 due to 11 out of 33 dropped probes since last increase.
                                            Connect Scan Timing: About 12.07% done; ETC: 12:05 (0:14:41 remaining)
                                            Connect Scan Timing: About 18.02% done; ETC: 12:07 (0:15:33 remaining)
                                            Connect Scan Timing: About 42.38% done; ETC: 12:13 (0:14:34 remaining)
                                            Connect Scan Timing: About 47.47% done; ETC: 12:13 (0:13:18 remaining)
                                            Connect Scan Timing: About 52.66% done; ETC: 12:13 (0:12:01 remaining)
                                            Connect Scan Timing: About 57.57% done; ETC: 12:13 (0:10:44 remaining)
                                            Connect Scan Timing: About 62.65% done; ETC: 12:13 (0:09:28 remaining)
                                            Connect Scan Timing: About 67.95% done; ETC: 12:13 (0:08:10 remaining)
                                            Connect Scan Timing: About 73.11% done; ETC: 12:13 (0:06:52 remaining)
                                            Connect Scan Timing: About 78.09% done; ETC: 12:13 (0:05:35 remaining)
                                            Connect Scan Timing: About 83.47% done; ETC: 12:14 (0:04:17 remaining)
                                            Connect Scan Timing: About 88.59% done; ETC: 12:14 (0:02:57 remaining)
                                            Connect Scan Timing: About 93.83% done; ETC: 12:14 (0:01:38 remaining)
                                            Completed Connect Scan at 12:14, 1590.82s elapsed (65535 total ports)
                                            Initiating Service scan at 12:14
                                            Scanning 1 service on ec2-34-207-4-87.compute-1.amazonaws.com (34.207.4.87)
                                            Completed Service scan at 12:14, 6.32s elapsed (1 service on 1 host)
                                            NSE: Script scanning 34.207.4.87.
                                            Initiating NSE at 12:14
                                            Completed NSE at 12:15, 15.82s elapsed
                                            Initiating NSE at 12:15
                                            Completed NSE at 12:15, 0.43s elapsed
                                            Initiating NSE at 12:15
                                            Completed NSE at 12:15, 0.00s elapsed
                                            Nmap scan report for ec2-34-207-4-87.compute-1.amazonaws.com (34.207.4.87)
                                            Host is up (0.11s latency).
                                            Not shown: 65534 filtered ports
                                            PORT   STATE SERVICE VERSION
                                            80/tcp open  http    Apache httpd
                                            | http-methods:
                                            |_  Supported Methods: GET HEAD POST OPTIONS
                                            |_http-server-header: Apache
                                            |_http-title: Your Thoughts
                                            
                                            NSE: Script Post-scanning.
                                            Initiating NSE at 12:15
                                            Completed NSE at 12:15, 0.00s elapsed
                                            Initiating NSE at 12:15
                                            Completed NSE at 12:15, 0.00s elapsed
                                            Initiating NSE at 12:15
                                            Completed NSE at 12:15, 0.00s elapsed
                                            Read data files from: /usr/bin/../share/nmap
                                            Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
                                            Nmap done: 1 IP address (1 host up) scanned in 1615.89 seconds
                                        


    Test 2: nmap 34.207.4.87

    Result :
    
                                            Starting Nmap 7.91 ( https://nmap.org ) at 2021-10-10 04:25 EDT
                                            Nmap scan report for ec2-34-207-4-87.compute-1.amazonaws.com (34.207.4.87)
                                            Host is up (0.10s latency).
                                            Not shown: 999 filtered ports
                                            PORT   STATE SERVICE
                                            80/tcp open  http
                                            
                                            Nmap done: 1 IP address (1 host up) scanned in 10.98 seconds
                                        


    Test 3: nmap -sT -p 80,443 34.207.4.87         

    Command-Line Flags:
    • -sT: TCP connection (full open scan)
    • -p: ports 
    • 80: HTTP port
    • 443: HTTPS port
                                                                                        
    NMAP uses TCP protocol to check if ports are open. TCP protocol uses 3-way handshake to establish the connection. TCP protocol is more reliable than UDP protocol. 

    Result:
    
                                            Starting Nmap 7.91 ( https://nmap.org ) at 2021-10-11 12:52 EDT
                                            Nmap scan report for ec2-34-207-4-87.compute-1.amazonaws.com (34.207.4.87)
                                            Host is up (0.10s latency).
                                            
                                            PORT    STATE    SERVICE
                                            80/tcp    open        http
                                            443/tcp   filtered    https
                                            
                                            Nmap done: 1 IP address (1 host up) scanned in 2.04 seconds