ACTIVITY: Nmap Scan

Discuss and list the following scan in Nmap, then perform it:

Scan 1:

In the current LAN environment, scan and find out how many host is up.
Do not perform port scan.
Output the result into a XML file.

What command would you use?

...........................................................................................................................................................
...........................................................................................................................................................
...........................................................................................................................................................

Scan 2:

Scan and find out how many host is up in the 172.16.68.0/24 network, using TCP SYN scan.
Do not perform port scan.
Output the result into a XML file.

What command would you use?

...........................................................................................................................................................
...........................................................................................................................................................
...........................................................................................................................................................

Scan 3:

Scan whether port 22, port 80 and port 443 of the host 173.230.129.16 is open or not, using TCP
SYN (Half-open scan).
Do not perform ping scan.
Output the result into a XML file.

What command would you use?

...........................................................................................................................................................
...........................................................................................................................................................
...........................................................................................................................................................

Scan 4:

Detect the software running on port 80 of the host online.saigonctt.com.vn.

Do not perform ping scan.
Output the result into a XML file.

What command would you use?

...........................................................................................................................................................
...........................................................................................................................................................
...........................................................................................................................................................

Scan 5:

Given the following subnet: 202.43.108.0/24

Detect all running hosts.
Scan only the most common port range. (Option -F)
Detect the Operating System of these hosts.
Output the result into a XML file.

What command would you use?

...........................................................................................................................................................
...........................................................................................................................................................
...........................................................................................................................................................

Scan 6:

Detect the Operating System running on 202.43.108.1

Scan with timing template -T3
Show the IP ID Generation of the host.
Output the result into a XML file.

What command would you use?

...........................................................................................................................................................
...........................................................................................................................................................
...........................................................................................................................................................

Scan 7:

Perform an ACK scan on the host forum.saigonctt.com.vn.

Perform a second XMAS/NULL/FIN scan on the unfiltered port discovered.
Perform a third SYN Scan on the open/unfiltered port.
Do not perform ping scan for each of the above scan, do host discovery by DNS.
Output the result into a XML file.

What command would you use?

...........................................................................................................................................................
...........................................................................................................................................................
...........................................................................................................................................................
Perform all of the above scan, open the XML file on Zenmap to view the result.

On scans that was done on a single host, use Wireshark to view the traffic sent, using the following filter:
ip addr <host-ip>. Example: ip addr 172.16.68.145

ACTIVITY: hping3, Packet Generator

Perform the following action using hping3:

Manual Port Scan:

For each of the port scan, determine the command and interpret the output. Which reponse indicates
which port status?

NULL Scan on port 22, 23 of 173.230.129.16

FIN Scan on port 80, 81 of 172.230.129.16
ACK Scan on port 3000, 3001 of forum.saigonctt.com.vn
Use shodanhq.com to find hosts that open port 161 (SNMP), then confirm by performing an
UDP Scan.

What command would you use?

...........................................................................................................................................................
...........................................................................................................................................................
...........................................................................................................................................................
Perform the above scans, and use Wireshark to capture the traffic sent.

IDLE Scan:

Use shodanhq.com (may require login) to find hosts with the following keyword: jetdirect
On the result page, find the host that is up (Using nmap or ping)
Check with hping3 to see the IP ID Generation of the host. You need to send a SYN/ACK packet
to an open port.
Perform an IDLE scan to check the following port on forum.saigonctt.com.vn: 80, 443, 3000.

What command would you use?

...........................................................................................................................................................
...........................................................................................................................................................
...........................................................................................................................................................
Perform the above scans, and use Wireshark to capture the traffic sent.