Nmap Explained

Nmap Security Scanner
Screenshot Size:260px
Author:Gordon Lyon (Fyodor)
Latest Release Version:
Programming Language:C, C++, Python, Lua
Operating System:Cross-platform
Language:English
Genre:Network security
License:NPSL[1] or modified GPLv2[2] or proprietary

Nmap (Network Mapper) is a network scanner created by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich).[3] Nmap is used to discover hosts and services on a computer network by sending packets and analyzing the responses.[4]

Nmap provides a number of features for probing computer networks, including host discovery and service and operating system detection. These features are extensible by scripts that provide more advanced service detection,[5] vulnerability detection,[5] and other features. Nmap can adapt to network conditions including latency and congestion during a scan.

Nmap started as a Linux utility[6] and was ported to other systems including Windows, macOS, and BSD.[7] It is most popular on Linux, followed by Windows.[8]

Features

Nmap features include:

Nmap can provide further information on targets, including reverse DNS names, device types, and MAC addresses.[11]

Typical uses of Nmap:

User interfaces

NmapFE, originally written by Kanchan, was Nmap's official GUI for Nmap versions 2.2 to 4.22. For Nmap 4.50 (originally in the 4.22SOC development series) NmapFE was replaced with Zenmap, a new official graphical user interface based on UMIT, developed by Adriano Monteiro Marques.

Web-based interfaces exist that allow either controlling Nmap or analysing Nmap results from a web browser, such as IVRE.[18]

Output

Four different output formats are offered by Nmap. Everything is saved to a file except the interactive output. Text processing software can be used to modify Nmap output, allowing the user to customize reports.[19]

Interactive: presented and updated real time when a user runs Nmap from the command line. Various options can be entered during the scan to facilitate monitoring.
  • XML: a format that can be further processed by XML tools. It can be converted into a HTML report using XSLT.
  • Grepable: output that is tailored to line-oriented processing tools such as grep, sed, or awk.
  • Normal: the output as seen while running Nmap from the command line, but saved to a file.
  • Script kiddie:meant to be an amusing way to format the interactive output replacing letters with their visually alike number representations. For example, Interesting ports becomes Int3rest1ng p0rtz. This is known as Leet.
  • History

    Nmap was first published in September 1997, as an article in Phrack Magazine with source-code included.[20] With help and contributions of the computer security community, development continued. Enhancements included operating system fingerprinting, service fingerprinting, code rewrites (C to C++), additional scan types, protocol support (e.g. IPv6, SCTP[21]) and new programs that complement Nmap's core features.

    Major releases include:

    Date Version Significance
    Nmap 2.00 Nmap 2.00 is released, including Operating System fingerprinting[22]
    NmapFE A GTK+ front end, is bundled with Nmap
    Windows port[23]
    Rewrite from C to C++
    The first public release to include service version detection
    Nmap 3.70 Core scan engine rewritten for version 3.70. New engine is called ultra_scan[24]
    Summer 2005 Nmap selected for participation in Google Summer of Code.[25] Added features included Zenmap, Nmap Scripting Engine (NSE), Ncat, and 2nd-generation OS detection.
    Nmap 4.50 Nmap 4.50, the 10th Anniversary Edition, was released. Included Zenmap, 2nd-generation OS detection, and the Nmap Scripting Engine[26]
    Nmap 4.85BETA5 Emergency release of Nmap 4.85BETA5, leveraging NSE to detect Conficker infections[27]
    Nmap 5.00 Included netcat-replacement Ncat and Ndiff scan comparison tool[28]
    Nmap 5.50 Included Nping packet generation response analysis and response time measurement, including TCP, UDP and ICMP probe modes.[29] [30]
    Nmap 6.00 Released with full IPv6 support.
    Nmap 7.00 [31]
    Nmap 7.40
    Nmap 7.70 [32]
    Nmap 7.80 [33]
    Nmap 7.90 [34] The new fingerprints allow better operating system and service/version detection. 3 new NSE scripts, new protocol library and payloads for host discovery, port scanning and version detection. Npcap 1.0.0, the first fully stable version of the Windows raw packet capturing/sending driver.

    Legal issues

    Nmap is a tool that can be used to discover services running on Internet connected systems. Like any tool, it could potentially be used for black hat hacking,[35] as a precursor to attempts to gain unauthorized access to computer systems. However, Nmap is also used by security and systems administrators to assess their own networks for vulnerabilities (i.e. white hat hacking).

    System administrators can use Nmap to search for unauthorized servers, or for computers that do not conform to security standards.[36]

    In 2003 Supreme Court of Finland has ruled that port scanning has amounted to an attempted computer break in, which was illegal under Finnish Penal code at the time:[37]

    In its ruling the Supreme Court stated that the defendant had systematically carried out port scanning operations to gather information for the purpose of unauthorised break-in to the bank's computer network. This amounted to an attempted computer break in.

    License

    Nmap was originally distributed under the GNU General Public License (GPL). In later releases, Nmap's authors added clarifications and specific interpretations to the license where they felt the GPL was unclear or lacking.[38] For instance, Nmap 3.50 specifically revoked the license of SCO Group to distribute Nmap software because of their views on the SCO-Linux controversies.[39]

    Starting with version 7.90, Nmap transitions to a new custom license NPSL, dual-licensing versions 7.90, 7.91, and 7.92 under both old and new licenses.[40] Several Linux distributions consider the new license non-free.[41] [42]

    In popular culture

    In The Matrix Reloaded, Trinity is seen using Nmap to access a power plant's computer system,[43] allowing Neo to "physically" break into a building. The appearance of Nmap in the film was widely discussed on Internet forums and hailed as an unusually realistic example of hacking.[44]

    Nmap and NmapFE were used in The Listening, a 2006 movie about a former NSA officer who defects and mounts a clandestine counter-listening station high in the Italian alps.

    Nmap source code can be seen in the movie Battle Royale, as well as brief views of the command line version of Nmap executing in Live Free or Die Hard and Bourne Ultimatum. In 2013, Nmap continued to make appearances in movies including popular sci-fi movie Elysium.

    The film Dredd, a film adaptation of the famous Judge Dredd comics, was released in 2012 and also contains multiple Nmap scenes.[43] Nmap is used for network reconnaissance and exploitation of the slum tower network. It is even seen briefly in the movie's trailer.

    The command Nmap is widely used in the video game Hacknet, allowing to probe the network ports of a target system to hack it.

    In Snowden, Nmap is used in the aptitude test scene about 14 minutes into the movie.

    In academia

    Nmap is an integral part of academic activities. It has been used for research involving the TCP/IP protocol suite and networking in general.[45] Besides being a research tool, Nmap has also become a research topic.[46]

    Examples

    $ nmap -A scanme.nmap.orgStarting Nmap 6.47 (https://nmap.org) at 2014-12-29 20:02 CETNmap scan report for scanme.nmap.org (74.207.244.221)Host is up (0.16s latency).Not shown: 997 filtered portsPORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 5.3p1 Debian 3ubuntu7.1 (Ubuntu Linux; protocol 2.0)| ssh-hostkey:| 1024 8d:60:f1:7c:ca:b7:3d:0a:d6:67:54:9d:69:d9:b9:dd (DSA)|_ 2048 79:f8:09:ac:d4:e2:32:42:10:49:d3:bd:20:82:85:ec (RSA)80/tcp open http Apache httpd 2.2.14 ((Ubuntu))|_http-title: Go ahead and ScanMe!9929/tcp open nping-echo Nping echoWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed portDevice type: general purpose|phone|storage-misc|WAPRunning (JUST GUESSING): Linux 2.6.X|3.X|2.4.X (94%), Netgear RAIDiator 4.X (86%)OS CPE: cpe:/o:linux:linux_kernel:2.6.38 cpe:/o:linux:linux_kernel:3 cpe:/o:netgear:raidiator:4 cpe:/o:linux:linux_kernel:2.4Aggressive OS guesses: Linux 2.6.38 (94%), Linux 3.0 (92%), Linux 2.6.32 - 3.0 (91%), Linux 2.6.18 (91%), Linux 2.6.39 (90%), Linux 2.6.32 - 2.6.39 (90%), Linux 2.6.38 - 3.0 (90%), Linux 2.6.38 - 2.6.39 (89%), Linux 2.6.35 (88%), Linux 2.6.37 (88%)No exact OS matches for host (test conditions non-ideal).Network Distance: 13 hopsService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

    TRACEROUTE (using port 80/tcp)HOP RTT ADDRESS1 14.21 ms 151.217.192.12 5.27 ms ae10-0.mx240-iphh.shitty.network (94.45.224.129)3 13.16 ms hmb-s2-rou-1102.DE.eurorings.net (134.222.120.121)4 6.83 ms blnb-s1-rou-1041.DE.eurorings.net (134.222.229.78)5 8.30 ms blnb-s3-rou-1041.DE.eurorings.net (134.222.229.82)6 9.42 ms as6939.bcix.de (193.178.185.34)7 24.56 ms 10ge10-6.core1.ams1.he.net (184.105.213.229)8 30.60 ms 100ge9-1.core1.lon2.he.net (72.52.92.213)9 93.54 ms 100ge1-1.core1.nyc4.he.net (72.52.92.166)10 181.14 ms 10ge9-6.core1.sjc2.he.net (184.105.213.173)11 169.54 ms 10ge3-2.core3.fmt2.he.net (184.105.222.13)12 164.58 ms router4-fmt.linode.com (64.71.132.138)13 164.32 ms scanme.nmap.org (74.207.244.221)

    OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 28.98 seconds

    Bibliography

    Notes and References

    1. Web site: Nmap Public Source License. 2021-12-15.
    2. Web site: Nmap license. 2019-01-21. 2018-07-20. https://web.archive.org/web/20180720051328/https://svn.nmap.org/nmap/COPYING. dead.
    3. News: Matrix mixes life and hacking . . 2018-10-28 . 2003-05-19.
    4. Web site: Joshi. Sagar. 2021-02-25. What is Nmap And Why You Should Use It?. 2021-03-01. The Hack Report. en-US.
    5. Web site: Nmap Scripting Engine: Introduction . Nmap.org . 2018-10-28.
    6. Web site: The History and Future of Nmap . Nmap.org . 2018-10-28.
    7. Web site: Other Platforms . Nmap.org . 2018-10-28.
    8. Web site: Nmap Installation for Windows . Nmap.org . 2018-10-28.
    9. Web site: Service and Application Version Detection . Nmap.org . 2018-10-28.
    10. Web site: Nmap Scripting Engine . Nmap.org . 2018-10-28.
    11. Web site: Nmap Reference Guide . Nmap.org . 2018-10-28.
    12. https://nmap.org/book/nmap-overview-and-demos.html Nmap Overview and Demonstration
    13. https://nmap.org/press/computerworld_when_good_scanners_go_bad.txt When Good Scanners Go Bad
    14. Web site: Linux.lat . 2024-07-01 . Google News . en-US.
    15. Web site: nmap-audit – Network auditing with Nmap . https://web.archive.org/web/20090401141545/http://heavyk.org/nmap-audit/nmap-audit-pod.html . heavyk.org . dead . 2009-04-01 . 2018-10-28.
    16. Web site: Nping - Network packet generation tool / ping utility . Nmap.org . 2018-10-28.
    17. Web site: Leyden . John . Revealed ... GCHQ's incredible hacking tool to sweep net for vulnerabilities: Nmap . 2014-08-15 . TheRegister.co.uk. 2018-10-28.
    18. Web site: IVRE homepage . 2018-10-28.
    19. Web site: Nmap Reference Guide: Output . Nmap.org . 2018-10-29.
    20. The Art of Port Scanning . Phrack Magazine. 7 . 51 . 1997-09-01 . 2018-10-29.
    21. Web site: SCTP Support for Nmap . Roe.ch . 2011-05-10 . 2018-10-29.
    22. Web site: The History and Future of Nmap . Nmap.org . 2018-10-29.
    23. Web site: Nmap Changelog . Nmap.org . 2018-10-29.
    24. Web site: Nmap 3.70 Released—Core Scan Engine Rewrite! . Seclists.org . 2004-08-31 . 2018-10-29.
    25. Web site: Google sponsors Nmap summer student developers . Seclists.org . 2005-06-02 . 2018-10-29.
    26. Web site: Nmap 4.50 Press Release . Insecure.org . 2007-12-13 . 2018-10-29.
    27. Web site: Nmap 4.85BETA5: Now with Conficker detection! . Seclists.org . 2009-03-30 . 2018-10-29.
    28. Web site: Nmap 5.00 Released . Nmap.org . 2009-07-16 . 2018-10-29.
    29. Web site: nmap/nping/docs/nping.1 at master · nmap/nmap. GitHub.
    30. Web site: Nmap 5.50: Now with Gopher protocol support! . Seclists.org . 2011-01-28 . 2018-10-29.
    31. Web site: Nmap 7 Released . Nmap.org . 2015-11-19 . 2018-10-29.
    32. Web site: Nmap 7.70 . Nmap.org . 2018-03-20 . 2018-10-29.
    33. Web site: Nmap 7.80 . Nmap.org . 2019-08-10 . 2019-08-10.
    34. Web site: Nmap 7.90 . Nmap.org . 2019-10-03 . 2020-10-03.
    35. News: Hacking tool reportedly draws FBI subpoenas . SecurityFocus.com . 2004-11-24 . 2018-10-29 . Kevin . Poulsen.
    36. How To Conduct A Security Audit . PC Network Advisor . July 2000 . 120 . 2018-10-29 . 2021-04-27 . https://web.archive.org/web/20210427043529/https://www.techsupportalert.com/pdf/t04123.pdf . dead .
    37. Web site: First ruling by the Supreme Court of Finland on attempted break-in . 2003 . . dead . https://web.archive.org/web/20050505213444/http://www.osborneclarke.com/publications/text/ITM0903f.htm . 2005-05-05 . 2018-10-29.
    38. Web site: Important Nmap License Terms . Nmap.org . 2018-10-29 . 2018-07-20 . https://web.archive.org/web/20180720051328/https://svn.nmap.org/nmap/COPYING . dead .
    39. Web site: Nmap 3.50 Press Release . 2004-02-20 . 2018-10-29.
    40. Web site: Nmap Public Source License . Nmap.org . 2021-12-15.
    41. Web site: Nmap Public Source License (NPSL) Version 0.92 . Fedora Mailing-Lists . 2021-12-15.
    42. Web site: Add NPSL (nmap license) to MISC_FREE . Gentoo's Bugzilla . 2021-12-15.
    43. Web site: Nmap In The Movies . 2018-10-29.
    44. Web site: Matrix Sequel Has Hacker Cred . Kevin . Poulsen. 2003-05-16 . . 2018-10-29.
    45. Validation of sensor alert correlators . 2003-02-19 . 10.1109/MSECP.2003.1176995 . . 99 . 1. 46–56 . Haines . J. . Ryder . D.K. . Tinnel . L. . Taylor . S. .
    46. Book: João Paulo S. . Computational Intelligence in Security for Information Systems. 63. 1–8. Medeiros . Agostinho M. . Brito Jr. . Paulo S. Motta . Pires . A Data Mining Based Analysis of Nmap Operating System Fingerprint Database . 10.1007/978-3-642-04091-7_1 . Advances in Intelligent and Soft Computing. 2009. 978-3-642-04090-0.