Getting Started with Recon (Nmap)

Network Recon Summary
Nmap is a fundamental tool that most people with use to conduct network reconnaissance against targets. In addition to the networking capabilities, Nmap has a large library of scripts for attacks, enumeration, password attacks and more.

Breaking down the default scan (no options)

$ nmap 192.168.1.1

Note: We will break down the nmap scan one option at a time. After describing the option we will add it to the command and move on. This process is in the endeavor that you better understand your tools.
An nmap scan with no options defaults to a TCP SYN scan aka half-open scan aka -sS option (nmap -sS <ip> ). The scan is said to be a stealthier scan as a completed three-way handshake never occurs ( https://www.techopedia.com/definition/10339/three-way-handshake ). This is what the command would look like:

$ nmap -sS 192.168.1.1

In addition, according to the man page, “If no host discovery options are given, Nmap sends an ICMP echo request, a TCP SYN packet to port 443, a TCP ACK packet to port 80, and an ICMP timestamp request… These defaults are equivalent to the -PE -PS443 -PA80 -PP options.” The interpreted command without options thus far would look like:

$ nmap -sS -PE -PS 443 -PA 80 -PP 192.168.1.1

As far as port scanning goes nmap will default to the top 1,000 ports. Making the command now as follows:

$ nmap -sS -PE -PS 443 -PA 80 -PP –top-ports 1000 192.168.1.1

Scanning portsNetworking can be summed up with two types of traffic TCP (stateful) and UDP (stateless). To read about the differences check out the following link http://www.diffen.com/difference/TCP_vs_UDP . One thing to remember when running UDP scans is that they take much longer to run than TCP scans, therefore, we don’t want to scan all UDP ports. However, feel free to scan all 65,535 TCP ports. Both can be scanned at the same time using the following syntax where “T:” is for TCP ports and “U:” is for UDP ports:

$ nmap -p T:1-65535,U:161,162 192.168.1.1

Service and OS DetectionTwo additional options that are needed for good initial reconnaissance is Service, Service Version, and Operating System. These bits of information will guide what other attacks and recon methods you choose to use. One thing to note is that OS will not always be accurate but the information is great if you can get it.
$ nmap -sV -O 192.168.1.1
Starter SyntaxBelow is a good start for your Nmap network scan command:
Nmap -O -sV -p T:1-65535,U:161,162 192.168.1.1
ConclusionHopefully, this has helped you better understand Nmap and how powerful the tool is. Please visit https://nmap.org to learn more and really dig into the great documentation that Fyodor Vaskovich and his team has put together. After you have conquered the basics don’t forget to check out the NSE scripts.