Lab 3 - Scanning with Nmap

For this lab, we are going to be scanning the Metasploitable2 VM using Nmap.

Activities

Part 1 - Setup

Launch both Kali Linux and the Metasploitable2 VM and ensure that they are on the same isolated network.

On Kali, check which version of nmap you have installed. The nmap commands have evolved slightly over time. It's important to ensure you are following documentation for the version of the program you are using.

$ nmap --version

Part 2 - Host Discovery

On your Kali VM, perform a basic nmap host discovery scan without port scanning. Normally this would be used to scan an entire subnet (or larger), but for this lab, we're going to target specific IPs of interest.

First, target just the Metasploitable2 VM by its IP address.

$ sudo nmap -sn TARGET

Note: Using sudo so that Nmap can generate arbitrary network packets for this scan

From the Nmap documentation: "The default host discovery done with -sn consists of an ICMP echo request, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request by default. When executed by an unprivileged user, only SYN packets are sent (using a connect call) to ports 80 and 443 on the target. When a privileged user tries to scan targets on a local ethernet network, ARP requests are used unless --send-ip was specified." -- https://nmap.org/book/man-host-discovery.html

Second, target the IP 8.8.8.8, which will map to whatever public Google DNS server happens to be the closet to us geographically (a feature known as "IP Anycast"). Google won't mind a little more scanning traffic, right? As before, just do a basic Nmap host discovery scan without port scanning.

Part 3 - TCP Port Scanning

On your Kali VM, perform a Nmap TCP port scan of the Metasploitable2 VM to detect active services. Either a connect scan (-sT) or a SYN scan (-sS) is fine.

$ sudo nmap -sT TARGET
$ sudo nmap -sS TARGET

Note: Using sudo so that Nmap can generate arbitrary network packets for this scan

Part 4 - UDP Port Scanning

On your Kali VM, perform a Nmap UDP port scan of the Metasploitable2 VM to detect active services.

$ sudo nmap -sU TARGET

Note: Using sudo so that Nmap can generate arbitrary network packets for this scan

Tip 1: Unlike TCP, there is no generic way to see if a UDP port is open or not, since UDP is connectionless. Thus, you will have much more accurate results (and be able to fully answer the lab question) if you also enable service and version scanning with your UDP scan. The CLI argument is provided below.

Tip 2 If you accept the default options, this scan will take a very long time. However, you can make Nmap go faster by specifying a non-default Timing Template. Given that the target is a VM on the same computer (even better than on the same local area network!), shorter timeouts should be perfectly safe.

Tip 3 If you only care about the most popular services (which is sufficient for this lab), you can use the --top-ports=N argument to only scan the N most popular service ports.

Part 5 - OS Detection

Perform a Nmap OS Detection scan on the Metasploitable2 VM. Note that implicit with OS detection is port discovery.

$ sudo nmap -O TARGET

Note: Using sudo so that Nmap can generate arbitrary network packets for this scan

Part 6 - Version and Service Scanning

Perform a Nmap version and service scan of the Metasploitable2 VM:

$ sudo nmap -sV TARGET

Note: Using sudo so that Nmap can generate arbitrary network packets for this scan

Part 7 - Complete Scanning

Perform an "everything and the kitchen sink" scan against the Metasploitable2 VM using the -A (for all) option. This is the most time consuming scan (at least for TCP) and the most verbose. As such, it is best run against very specific hosts that (a) you know exist, and (b) you know have specific services of interest to you.

$ sudo nmap -A TARGET

Note: Using sudo so that Nmap can generate arbitrary network packets for this scan