book

Nmap Network Exploration and Security Auditing Cookbook, Third Edition - Third Edition

Name: Nmap Network Exploration and Security Auditing Cookbook, Third Edition - Third Edition
Author: Paulino Calderon
ISBN: 9781838649357

by Paulino Calderon

September 2021

Intermediate to advanced

436 pages

7h 51m

English

Packt Publishing

Read now

Unlock full access

Nmap Network Exploration and Security Auditing Cookbook
Third EditionContributorsAbout the authorAbout the reviewer
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the color imagesConventions usedGet in touchShare Your Thoughts
Chapter 1: Nmap Fundamentals
Technical requirementsBuilding Nmap's source codeGetting readyHow to do it...How it works...There's more...Finding online hostsHow to do it...How it works...There's more...Listing open ports on a targetHow to do it...How it works...There's more...Fingerprinting OSes and services running on a targetHow to do it...How it works...There's more...Using NSE scripts against a target hostHow to do it...How it works...There's more...Scanning random targets on the internetHow to do it...How it works...There's more...Collecting signatures of web servers How to do it...How it works...There's more...Scanning with Rainmap LiteGetting readyHow to do it...How it works...There's more...
Chapter 2: Getting Familiar with Nmap's Family
Monitoring servers remotely with Nmap and NdiffGetting readyHow to do it...How it works...There's more...Crafting ICMP echo replies with NpingHow to do it...How it works...There's more...Managing multiple scanning profiles with ZenmapHow to do it...How it works...There's more...Running Lua scripts against a network connection with NcatHow to do it...How it works...There's more...Discovering systems with weak passwords with NcrackGetting readyHow to do it...How it works...There's more...Using Ncat to diagnose a network clientHow to do it...How it works...There is more...Defending against Nmap service detection scansHow to do it...How it works...There's more...
Chapter 3: Network Scanning
Discovering hosts with TCP SYN ping scans How to do it...How it works...There's more...Discovering hosts with TCP ACK ping scansHow to do it...How it works...There's more...Discovering hosts with UDP ping scansHow to do it...How it works...There's more...Selecting ports in UDP ping scansDiscovering hosts with ICMP ping scansHow to do it...How it works...There's more...Discovering hosts with SCTP INIT ping scansHow to do it...How it works...There's more...Discovering hosts with IP protocol ping scansHow to do it...How it works...There's more...Discovering hosts with ARP ping scansHow to do it...How it works...There's more...Performing advanced ping scansHow to do it...How it works...There's more...Discovering hosts with broadcast ping scansHow to do it...How it works...There's more...Scanning IPv6 addressesHow to do it...How it works...There's more...Spoofing the origin IP of a scanGetting readyHow to do it...How it works…There's more...Using port scanning for host discoveryHow to do it...How it works...There's more...
Chapter 4: Reconnaissance Tasks
Performing IP address geolocationGetting readyHow to do it...How it works...There's more...Getting information from WHOIS recordsHow to do it...How it works...There's more...Obtaining traceroute geolocation informationHow to do it...How it works...There's more...Querying Shodan to obtain target informationGetting readyHow to do it...How it works...There's more...Collecting valid email accounts and IP addresses from web serversHow to do it...How it works...There's more...Discovering hostnames pointing to the same IP addressHow to do it...How it works...There's more...Discovering hostnames by brute-forcing DNS recordsHow to do it...How it works...There's more...Matching services with public vulnerability advisories and picking the low-hanging fruitHow to do it...How it works...There's more...
Chapter 5: Scanning Web Servers
Listing supported HTTP methodsHow to do it...How it works...There's more...Discovering interesting files and folders on web serversHow to do it...How it works...There's more...Brute forcing HTTP authenticationHow to do it...How it works...There's more...Brute forcing web applicationsHow to do it...How it works...There's more...Detecting web application firewallsHow to do it...How it works...There's more...Detecting possible XST vulnerabilitiesHow to do it...How it works...There's more...Detecting XSS vulnerabilitiesHow to do it...How it works...There's more...Finding SQL injection vulnerabilitiesHow to do it...How it works...There's more…Finding web applications with default credentialsHow to do it...How it works...There's more...Detecting insecure cross-domain policiesHow to do it...How it works...There's more...Detecting exposed source code control systemsHow to do it...How it works...There's more...Auditing the strength of cipher suites in SSL serversHow to do it...How it works...There's more...
Chapter 6: Scanning Databases
Listing MySQL databasesHow to do it…How it works...There's more...Listing MySQL usersHow to do it...How it works…There's more...Listing MySQL variablesHow to do it...How it works...There's more...Brute-forcing MySQL passwordsHow to do it...How it works...There's more...Finding root accounts with an empty password in MySQL serversHow to do it...How it works... There's more...Detecting insecure configurations in MySQL serversHow to do it...How it works...There's more...Brute forcing Oracle passwordsHow to do it...How it works...There's more...Brute forcing Oracle SID namesHow to do it...How it works...There's more...Retrieving information from MS SQL serversHow to do it... How it works...There's more...Brute forcing MS SQL passwordsHow to do it...How it works...There's more...Dumping password hashes of MS SQL serversHow to do it... How it works...There's more...Running commands through xp_cmdshell in MS SQL serversHow to do it...How it works...There's more...Finding system administrator accounts with empty passwords in MS SQL serversHow to do it...How it works...There's more...Obtaining information from MS SQL servers with NTLM enabledHow to do it...How it works...There's more...Retrieving MongoDB server informationHow to do it...How it works...There's more...Detecting MongoDB instances with no authentication enabledHow to do it...How it works...There's more... Listing MongoDB databasesHow to do it...How it works...There's more...Listing CouchDB databasesHow to do it...How it works...There's more...Retrieving CouchDB database statisticsHow to do it...How it works...There's more...Detecting Cassandra databases with no authentication enabledHow to do it...How it works...There's more...Brute forcing Redis passwordsHow to do it...How it works...There's more...
Chapter 7: Scanning Mail Servers
Detecting SMTP open relaysHow to do it...How it works...There's more...Brute-forcing SMTP passwordsHow to do it...How it works...There's more...Detecting suspicious SMTP serversHow to do it...How it works...There's more...Enumerating SMTP usernamesHow to do it...How it works...There's more...Brute-forcing IMAP passwordsHow to do it...How it works...There's more...Retrieving the capabilities of an IMAP serverHow to do it...How it works...There's more...Brute-forcing POP3 passwordsHow to do it...How it works...There's more...Retrieving the capabilities of a POP3 serverHow to do it...How it works...There's more...Retrieving information from SMTP servers with NTLM authenticationHow to do it...How it works...There's more...
Chapter 8: Scanning Windows Systems
Obtaining system information from SMBHow to do it...How it works...There's more...Detecting Windows clients with SMB signing disabledHow to do it...How it works...There's more...Detecting IIS web servers that disclose Windows 8.3 namesHow to do it...How it works...There's more...Detecting Windows hosts vulnerable to MS08-067 and MS17-010How to do it...How it works...There's more...Retrieving the NetBIOS name and MAC address of a hostHow to do it...How it works...There's more...Enumerating user accounts of Windows targetsHow to do it...How it works...There's more...Enumerating shared foldersHow to do it...How it works...There's more...Enumerating SMB sessionsHow to do it...How it works...There's more...Finding domain controllersHow to do it...How it works...There's more…Detecting the Shadow Brokers' DOUBLEPULSAR SMB implantsHow to do it...How it works...There's more...Listing supported SMB protocolsHow to do it...How it works...There's more...Detecting vulnerabilities using the SMB2/3 boot-time fieldHow to do it...How it works...There's more...Detecting whether encryption is enforced in SMB serversHow to do it...How it works...There's more...

Chapter 9: Scanning ICS/SCADA Systems
Finding common ports used in ICS/SCADA systemsHow to do it...How it works...There's more...Finding HMI systemsHow to do it...How it works...There's more...Enumerating Siemens SIMATIC S7 PLCsHow to do it...How it works...There's more...Enumerating Modbus devicesHow to do it...How it works...There's more...Enumerating BACnet devicesHow to do it...How it works...There's more...Enumerating Ethernet/IP devicesHow to do it...How it works...There's more...Enumerating Niagara Fox devicesHow to do it...How it works...There's more...Enumerating ProConOS devicesHow to do it...How it works...There's more...Enumerating Omrom PLC devicesHow to do it...How it works...There's more...Enumerating PCWorx devicesHow to do it...How it works...
Chapter 10: Scanning Mainframes
Listing CICS transaction IDs in IBM mainframesHow to do it...How it works...There's more...Enumerating CICS user IDs for the CESL/CESN login screenHow to do it...How it works...There's more...Brute-forcing z/OS JES NJE node namesHow to do it...How it works...There's more...Enumerating z/OS TSO user IDsHow to do it...How it works...There's more...Brute-forcing z/OS TSO accountsHow to do it...How it works...There's more...Listing VTAM application screensHow to do it...How it works...There's more...
Chapter 11: Optimizing Scans
Skipping phases to speed up scansHow to do it...How it works...There's more...Selecting the correct timing templateHow to do it...How it works...There's more...Adjusting timing parametersHow to do it...There's more...Adjusting performance parametersHow to do it...How it works...There's more...Adjusting scan groupsHow to do it...There's more...Distributing a scan among several clients using dnmapGetting readyHow to do it...How it works...There's more...
Chapter 12: Generating Scan Reports
Saving scan results in a normal formatHow to do it...How it works...There's more...Saving scan results in an XML formatHow to do it...How it works...There's more...Saving scan results to a SQLite databaseGetting readyHow to do it...How it works...There's more...Saving scan results in a grepable formatHow to do it...How it works...There's more...Generating a network topology graph with ZenmapHow to do it...How it works...There's more...Generating HTML scan reportsGetting readyHow to do it...How it works...There's more...Reporting vulnerability checksHow to do it...How it works...There's more...Generating PDF reports with fopGetting readyHow to do it...How it works...There's more...Saving NSE reports in ElasticsearchGetting readyHow to do it...How it works...There's more...Visualizing Nmap scan results with IVREGetting readyHow to do it...How it works...There's more...
Chapter 13: Writing Your Own NSE Scripts
Making HTTP requests to identify vulnerable Supermicro IPMI/BMC controllersHow to do it...How it works...There's more...Sending UDP payloads using NSE socketsHow to do it...How it works...There's more...Generating vulnerability reports in NSE scriptsHow to do it...How it works...There's more...Exploiting an SMB vulnerabilityHow to do it...How it works...There's more...Writing brute-force password auditing scriptsHow to do it...How it works...There's more...Crawling web servers to detect vulnerabilitiesHow to do it...How it works...There's more...Working with NSE threads, condition variables, and mutexes in NSEHow to do it...How it works...There's more...Writing a new NSE library in LuaHow to do it...How it works...There's more...Writing a new NSE library in C/C++How to do it...How it works...There's more...Getting your scripts ready for submissionHow to do it...How it works...There's more...
Chapter 14: Exploiting Vulnerabilities with the Nmap Scripting Engine
Generating vulnerability reports in NSE scriptsHow to do it...How it works...There's more...Writing brute-force password auditing scriptsHow to do it...How it works...There's more...Crawling web servers to detect vulnerabilitiesHow to do it...How it works...There's more...Exploiting SMB vulnerabilitiesHow to do it...How it works...There's more...
Appendix A
– HTTP, HTTP Pipelining, and Web Crawling Configuration OptionsHTTP user agentHTTP pipeliningConfiguring the NSE httpspider library
Appendix Β
– Brute-Force Password Auditing OptionsBrute modes
Appendix C
– NSE DebuggingDebugging NSE scriptsException handling
Appendix D
– Additional Output OptionsSaving output in all formatsAppending Nmap output logsIncluding debugging information in output logsIncluding the reason for a port or host stateOS detection in verbose mode
Appendix Ε
– Introduction to LuaFlow control structuresConditional statements – if, then, elseifLoops – whileLoops – repeatLoops – forData typesString handlingCharacter classesMagic charactersPatternsCapturesRepetition operatorsConcatenationFinding substringsString repetitionString lengthFormatting stringsSplitting and joining stringsCommon data structuresTablesArraysLinked listsSetsQueuesCustom data structuresI/O operationsModesOpening a fileReading a fileWriting a fileClosing a fileCoroutinesCreating a coroutineExecuting a coroutineDetermining the current coroutineGetting the status of a coroutineYielding a coroutineMetatablesArithmetic metamethodsRelational metamethodsThings to remember when working with LuaCommentsDummy assignmentsIndexesSemanticsCoercionSafe languageBooleans
Appendix F
– References and Additional Reading
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare Your Thoughts

Content preview from Nmap Network Exploration and Security Auditing Cookbook, Third Edition - Third Edition

Chapter 14: Exploiting Vulnerabilities with the Nmap Scripting Engine

While Nmap has never tried to become an exploitation framework, it does have several features that make it a viable option. Transparent parallelism in network I/O operations allows speed and efficiency. Quick prototyping in Lua allows exploit writers to work with protocols or applications having many Nmap Scripting Engine (NSE) libraries available to save development time. NSE scripts will be ready to run on any system that can run Nmap. And they can run against entire network ranges or large lists of targets, making them ideal for vulnerability detection.

Hopefully, the previous chapter introduced you to the NSE script format, common functions, and libraries. This chapter ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

Publisher Resources

ISBN: 9781838649357

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Nmap Network Exploration and Security Auditing Cookbook, Third Edition - Third Edition

by Paulino Calderon

Chapter 14: Exploiting Vulnerabilities with the Nmap Scripting Engine

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.