What is Nmap?

Nmap (Network Mapper) is a powerful network scanner that lets you discover the hosts and services on a network. It sends specific packets to remote hosts and analyses the responses to map the network. These packets can be standard ICMP/TCP/UDP packets as well as deliberately malformed packets to observe the hosts’ behaviour.

I believe it is very important to keep an eye on what’s going on in your network. As Nmap is one of the basic tools for this kind of job, I decided to spend some time to cover it and harness it in my own projects.

Specifying Target

First you need to specify your targets. Nmap is very flexible and accepts different notations for specifying targets:

• Single IP: i.e. 192.168.1.15
• Name: i.e: www.google.com
• List: For example, 192.168.1,2.1,10 will scan 192.168.1.1, 192.168.1.10, 192.168.2.1 and 192.168.2.10. Note that the comma separated values are not ranges but single values
• Range: i.e: 192.168.1.1-10 For ranges hyphen is used as the separator. The start and end values are inclusive. Also one octet can be omitted such as 192.168.-.1. In this case Nmap will scan all IPs from 192.168.0.1 to 192.168.255.1
• CIDR (Classless Inter-Domain Routing): For example 192.168.1.240/29 will scan 8 IPs from 192.168.1.240 to 192.168.1.247

You can use any combinations of these values as a list separated with spaces such as: 192.168.1.42 www.google.com will scan the single LAN IP and Google. You can use -sL parameter to view the target list without scanning them.

In complex scenarios you can use an input file to load the target list by using the -iL flag and providing the file name.

To exclude specific IP addresses –exclude flag is used with the same notations.

Port Scanning

Ports can be specified in 2 ways:

• Using -p flag: Single value, comma-separated list, or hyphen-separated values as a range. If just hyphen is specified it scans all ports from 1 to 65535. Also protocol can be specified such as T:80 U:53
• Using nmap-services file: You can refer to a service by name and this file is used to look it up.

Both methods can be used in combinations such as:

nmap -p http*,25,U:53 192.168.1.15

Output

While a scan is running you can an updated status by hitting enter. Also you can save the output results to a file in different formats with the values below following the -o flag:

* N: Normal
* X: XML
* G: Grepable

such as

nmap -v 172.16.1.0/24 -oG output.gnmap

Also a helpful flag is -v for verbose output

An added bonus about using output files is that you can resume a scan by using the –resume flag and specifying the output file name such as

nmap --resume output.gnmap

Basic scanning options

• TCP SYN scan (-sS): This is the default option Nmap uses. It’s very fast and can scan thousands of ports per second. It sends a SYN packet to target and if the port is open target sends back a SYN/ACK packet. Thus far it’s just like a normal 3-way TCP handshake but in the final step instead of sending an ACK Nmap sends RST (Reset) packet and cancels the process. Since it has already acquired the information it’s looking for it doesn’t need to establish an actual connection. If the port is closed the target sends a RST packet. SYN scan is very powerful because it’s fast and quiet as it doesn’t create a session. on Linux, it requires root privileges to run it.

• TCP connect() Scan (-sT): This one uses a full handshake and opens a session. Then sends a RST packet to close the session. The advantage of this method over SYN scan is that it doesn’t require root privileges. As it opens sessions they are logged so it’s noisies than SYN scan.

• Ping scan (-sn formerly known as -sP): This is the quickest scan method.For local subnets it uses ARP (Address Resolution Protocol) to identify active hosts. ARP only works on local subnets so for remote subnets, it uses ICMP echo requests. It also sends a TCP ACK packet to port 80 which is completely unexpected for the host as it’s just sent out of the blue. So the host sends a RST packet to end connection (as it’s the right thing to do!) but that helps Nmap to identify there is a host up with that address. This scan is only helpful to identify hosts rather than ports and services.

• UDP scan (-sU): This is the only scan that can identify open UDP ports. Since there’s no handshake the overhead is lower compared to TCP scan. When a port is closed the target returns ICMP port unreachable packet so this may increase the number of packets. Like SYN scan it requires privileged access.

In total there are lots of scanning options. You can find the full list here

OS and Service Version Detection

To detect version -sV flag is used. An intensity level between 0-9 can be specified. Default is 7

	nmap -sV --version-intensity 9 172.16.1.10

Versioning can be useful in some cases but also significantly increases the scan time.

For operating system detection -O flag can be used

	nmap -O -v 172.16.1.10

Timing Categories

If you are concerned about being detected when scanning the network

1. You might be doing something nasty!
2. You might consider using timing categories so add some delay between each packets to evade IDSs

There are 6 categories that can be specified by T flag followed by a number from 0 to 5. Alternatively you can use the templates’ names:

• paranoid (0)
• sneaky (1)
• polite (2)
• normal (3)
• aggressive (4)
• insane (5)

With “Paranoid” template Nmap will wait 5 minutes between each probe making the total scan time very very long. “Insane” will speed up the process to a point that the delay is down to 5ms. So be careful which option you use. There are many more flags for tailoring the scans to your performance requirements: http://nmap.org/book/man-performance.html

Scripting engine

Nmap comes with an embedded Lua interpreter which is the core of its scripting engine.

By using -sC flag all scripts in the default category can be executed such as

nmap -sC -p www.google.com

There are lots of scripts which can be found at NSE(Nmap Scripting Engine) documentation page

For example there is a script to scan OpenSSL Heartbleed vulnerability. It can be executed as follows:

nmap -p 443 --script ssl-heartbleed <target>

On my machine this script was blocked by Norton!

So be careful which script to run. Your intentions may be misinterpreted if you are running them against systems that you are not authorized.

Conclusion

Nmap is one of the core tools that hackers (white or black hat) use. So it has many more options geared towards attacking and being stealthy. You can spoof your IP address, use idle stations to avoid detection etc. I left out many of those options as my intention for studying Nmap is discovering devices on my network so that I can take action if any unknown devices appear. Based on these notes I will develop a simple script/applicaton to find out if anything fishy is going on in my network. I’ll blog about it when it’s ready. Stay tuned!

Resources

• Nmap documentation
• Scripting engine documentation
• DEFCON 16: Nmap: Scanning the Internet by Fyodor

Here’s the scenario:

• You use AWS
• You don’t have a static IP
• You connect to your EC2 instances via SSH and/or RDP only from your IP
• You are too lazy to update the security groups manually when your IP changes!

You’ve come to the right place: I’ve got the solution.

Let’s have a look how it’s built step-by-step:

Step 1: Create an IAM account to access security groups

As a general rule of thumb always grant the minimum privileges possible to the accounts you use. Create a new user and go to the user’s details. Select Attach User Policy and then Policy Generator. Select AWS EC2 from the services list. For our script to run we need 3 privileges: List security groups (DescribeSecurityGroups), delete old IP permissions (RevokeSecurityGroupIngress) and add new IP permissions (AuthorizeSecurityGroupIngress).

Alternatively you can just attach the following policy to your user:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1418339796000",
      "Effect": "Allow",
      "Action": [
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:DescribeSecurityGroups",
        "ec2:RevokeSecurityGroupIngress"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

IAM has a very nice simulation feature. Before you proceed I recommend you run it and verify only 3 actions are allowed.

Step 2: Modify the PowerShell script

The script I created is on Gist as seen below. Before you can use it you have to update it with the access and secret keys of the user created above.

Also since fiddling with security groups can become messy very quickly I’d strongly recommend you perform a dry run first. By default $dryRun is set to true. Unless you set it to $false it will only display what it is going to do but will not take any action. So make sure you know what you’re doing before you give it a go. I don’t think this script will be a ready-made script for anyone. Probably would need some tweaking here and there to tailor to your needs. But this version works for me so here it is:

First it gets a list of security groups that have SSH and RDP permissions in them. Then loops through these permissions and compares the IP address with the current one. I used my own external IP checker service that I’ve recently developed as I blogged here. You can use other services as well. Just make sure you change the URL in the script. My service returns a JSON object so if the method you use returns a different format you need to modify the parsing code as well.

If the IP addresses are different, it revokes the old permission and creates a new one with your current IP. Protocol and ports remain intact.

This is the output of the script:

If the IP addresses for port 22 an 3389 are up-to-date it just displays “Security group is up-to-date” so it can be run consecutively. So you can schedule it to run as often as you want.

Resources

• AWS PowerShell Tools documentation

I know there are very cheap security cameras that you can setup in a few minutes. They may provide security but they cannot provide the satisfaction you get after a DIY project! So let’s dig in just for the fun of it.

Ingredients

Once all put together this is what you are going to end up with:

Bring it to life

1. Download a standard distro for Raspberry Pi. I used Rasbian.
2. Write the image to the SD card. I use Win32 Disk Imager on Windows.

Main course: Motion

There is a great tutorial here for converting your Pi into a security camera which I mostly followed. Basically you enable WiFi, install Motion software and tweak the configuration a bit (image size, framerate etc) and it’s (hopefully) good to go.

The video didn’t work for me unfortunately. It was recording something but only the first frame was visible so it wasn’t any better than a still image. So I decided to ignore videos completely.

Instead of using a network share I decided to upload footage to AWS S3 directly using Amazon S3 Tools. Also don’t forget to clear old footage. Otherwise you can run out of space very quickly. I added a few cron jobs to carry out these tasks for me:

* * * * * s3cmd sync /var/surv/*.jpg s3://{BUCKET NAME}/
* */2 * * * sudo rm /var/surv/*.avi
* */6 * * *  find /var/surv/* -mtime +1 -exec rm {} \;

It syncs the local folder with S3 bucket, deletes all local video files and files older than a day. I delete the video files more frequently as they take up a lot of space.

Monitoring and Notifications

No system is complete without proper monitoring and notifications. It’s especially important for systems like this that’s supposed to run quietly in the background.

Unfortunately in my case it stopped working a few times which made monitoring even more important. I don’t know what’s causing the issue. Maybe it’s because I’m using an older version of Raspberry Pi and it’s not capable of handling all the motion software and S3 uploads etc.

To keep an eye on it, I decided to create a small PowerShell script to check S3 for incoming files and send me a notification if it seems to have stopped uploading.

PowerShell as the glue

Built on .NET framework PowerShell is a very powerful (no pun intended) tool to write quick and dirty solutions. So first here’s the Send-Mail function:

I created a separate function for it as it’s a general-purpose feature which can be used in many places. To make it even more generic you can take out the from and to email addresses and add them as parameters to the function.

And here’s the actual notification logic:

It finds the latest image by sorting them by LastModified field and compares this date with the current date. If it’s been more than 1 day it sends an email. Depending on how often you expect images to be uploaded you can change the alert condition.

To use these scripts you’ll AWS accounts with S3 and SES privileges. Also you have to change the path of the send-mail.ps1 in the line it’s included.

Resources

• Tutorial on Instructables.com
• PowerShell script to send email
• Raspberry Pi downloads
• Amazon S3 Tools