Nmap, the popular port scanning tool, is more than that. Besides port scanning it can do much more:
It can scan for vulnerabilities:
# nmap -Pn --script vuln latebits.com
Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-12 12:43 GTB Daylight Time
Nmap scan report for latebits.com (35.198.120.103)
Host is up (0.064s latency).
rDNS record for 35.198.120.103: 103.120.198.35.bc.googleusercontent.com
Not shown: 997 filtered ports
PORT STATE SERVICE
80/tcp open http
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
443/tcp open https
| http-aspnet-debug:
|_ status: DEBUG is enabled
| http-csrf:
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=latebits.com
| Found the following possible CSRF vulnerabilities:
|
| Path: https://latebits.com:443/
| Form id:
|_ Form action: https://latebits.com/
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
Here is a link with more info on vulnerability scanning:
https://securitytrails.com/blog/nmap-vulnerability-scan
It can do whois and ASN lookups:
# nmap --script=whois-ip latebits.com
Host script results:
| whois-ip: Record found at whois.arin.net
| netrange: 35.192.0.0 - 35.207.255.255
| netname: GOOGLE-CLOUD
| orgname: Google LLC
| orgid: GOOGL-2
| country: US stateprov: CA
| orgtechname: Google LLC
|_orgtechemail: arin-contact@google.com
# nmap --script=asn-query latebits.com
Host script results:
| asn-query:
| BGP: 35.198.0.0/16 | Country: US
| Origin AS: 15169 - GOOGLE, US
|_ Peer AS: 209 6453
It can check the SSL/TLS ciphers and the certificate :
# nmap -sV -p 443 --script ssl-enum-ciphers latebits.com
Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-12 12:22 GTB Daylight Time
Nmap scan report for latebits.com (35.198.120.103)
Host is up (0.046s latency).
rDNS record for 35.198.120.103: 103.120.198.35.bc.googleusercontent.com
PORT STATE SERVICE VERSION
443/tcp open ssl/http nginx
|_http-trane-info: Problem with XML parsing of /evox/about
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
| TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
| TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
| compressors:
| NULL
| cipher preference: server
|_ least strength: A
# nmap -sV -p 443 --script ssl-cert latebits.com
Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-12 13:08 GTB Daylight Time
Nmap scan report for latebits.com (35.198.120.103)
Host is up (0.046s latency).
rDNS record for 35.198.120.103: 103.120.198.35.bc.googleusercontent.com
PORT STATE SERVICE VERSION
443/tcp open ssl/http nginx
|_http-trane-info: Problem with XML parsing of /evox/about
| ssl-cert: Subject: commonName=latebits.com
| Subject Alternative Name: DNS:latebits.com
| Issuer: commonName=Let's Encrypt Authority X3/organizationName=Let's Encrypt/countryName=US
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2020-08-07T17:24:28
| Not valid after: 2020-11-05T17:24:28
| MD5: d96f ba51 7079 7b41 f816 1c40 5cd8 ea79
|_SHA-1: b5c1 35cc 372f 4692 cf7c 4ef5 419b 53e2 9c54 e28b
It can check SSH algorithms:
# nmap --script ssh2-enum-algos -sV -p 22 latebits.com
Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-12 12:23 GTB Daylight Time
Nmap scan report for latebits.com (35.198.120.103)
Host is up (0.045s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh2-enum-algos:
| kex_algorithms: (4)
| ecdh-sha2-nistp256
| ecdh-sha2-nistp384
| ecdh-sha2-nistp521
| diffie-hellman-group-exchange-sha256
| server_host_key_algorithms: (4)
| ssh-rsa
| rsa-sha2-512
| rsa-sha2-256
| ecdsa-sha2-nistp256
| aes128-ctr
| aes192-ctr
| aes256-ctr
| mac_algorithms: (2)
| hmac-sha2-256
| hmac-sha2-512
| compression_algorithms: (2)
| none
|_ zlib@openssh.com
It can do IP geolocation also:
# nmap --traceroute --script traceroute-geolocation cisco.com
Starting Nmap 7.60 ( https://nmap.org ) at 2020-08-12 10:34 UTC
Nmap scan report for cisco.com (72.163.4.185)
Host is up (0.12s latency).
Other addresses for cisco.com (not scanned): 2001:420:1101:1::185
rDNS record for 72.163.4.185: redirect-ns.cisco.com
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
Host script results:
| traceroute-geolocation:
| HOP RTT ADDRESS GEOLOCATION
| 1 109.08 209.85.246.211 37.751,-97.822 United States ()
| 2 116.90 209.85.250.54 37.751,-97.822 United States ()
| 3 128.81 108.170.228.87 37.751,-97.822 United States ()
| 4 116.97 108.170.252.139 37.751,-97.822 United States ()
| 5 116.95 eqix-da1.cisco2.com (206.223.118.167) 37.751,-97.822 United States ()
| 6 119.35 72.163.0.98 32.947,-96.703 United States (Texas)
| 7 117.75 72.163.0.98 32.947,-96.703 United States (Texas)
| 8 118.25 rcdn9-cd2-dmzdcc-gw2-por1.cisco.com (72.163.0.182) 32.947,-96.703 United States (Texas)
| 9 117.86 rcdn9-16b-dcz05n-gw2-por1.cisco.com (72.163.2.102) 32.947,-96.703 United States (Texas)
|_ 10 117.86 redirect-ns.cisco.com (72.163.4.185) 32.947,-96.703 United States (Texas)
# nmap --traceroute --script traceroute-geolocation 1.1.1.1
Starting Nmap 7.60 ( https://nmap.org ) at 2020-08-12 10:34 UTC
Nmap scan report for one.one.one.one (1.1.1.1)
Host is up (0.0014s latency).
Not shown: 997 filtered ports
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
443/tcp open https
Host script results:
| traceroute-geolocation:
| HOP RTT ADDRESS GEOLOCATION
| 1 1.45 209.85.242.0 37.751,-97.822 United States ()
| 2 1.70 162.158.84.65 50.119,8.684 Germany (Hesse)
|_ 3 1.23 one.one.one.one (1.1.1.1) -33.494,143.210 Australia ()
It has many other scripts, but these are the ones that I’ve used more frequently.
And to make things easier, I’ve automated the process. Here is an example to scan a server (ssh,HTTP,HTTPS) :
- name: Advanced NMAP Scan using NSE
hosts: localhost
vars:
ports:
- 22
- 443
scan_host: latebits.com
tasks:
- name: Running Nmap NSE scan
shell: "nmap -Pn -p {{ ports|join(',') }} --script {{ item }} -oA nmap-{{ item }}-results-%Y-%m-%d {{ scan_host }}"
with_items:
- ssl-enum-ciphers
- ssl-cert
- ssh2-enum-algos
