- Apr 25, 2015
- 1,845
- 2
- 2,199
- 327
Firstly, we need to know the internal IP addresses being used.
There is no such thing as Nmap fast port scanning in my opinion, so here is ZMap. Why? Because other tools are faster or they would not exist and be used for whole Internet scans in place of Nmap.
We can reference https://en.wikipedia.org/wiki/Private_network#RFC_documents bring us to RFC1918.
So, let's get into our blacklist for ZMap!
Comment out local addresses:
Save your config, simply save the nano edits!
Now we will scan all private IPv4 addresses for common service(s). An alternative to the editing is to use
Want a final overall view?
Now we should have a quick ZMap analysis of what open ports we are dealing with. We can pass this information off from the ZMap results, and now head over to NMap for the "real scans", these were just to break the ice and find where the network is perhaps listening to us (or a honeypot listened and blocked us). From here, we can further dive into parts of a network and automatically find parts of the living network!
Keep in mind Nmap can trigger crashes (when performing service scans), Unicornscan can be useful in some cases.
The above ZMap scans completed in less than an hour, I guarantee Nmap would take forever in comparison. Is ZMap perfect? No. It may miss some things, but when you are simply trying to pick apart a network, ZMap can at least offer you other subnets to focus on. Think of it like NMap is a pistol great at close range when you know the up close host, whereas ZMap is more like hitting birds with a shotgun. Different tools for different jobs. Know all your tools and when to use them - when not.
Let's say an output from our above sort contains 192.168.1.1, now we might look at 192.168.1.* with Nmap.
Example:
We could write this out into an IP list much like in a prior tutorial I had put together on Nmap vs ZMap.
Keep in mind, this is all focusing solely on hosts listening on port 80 (-p80), change this to 443 (HTTPS) and other service ports as needed. The main goal is to quickly find common ports to scope out the network via ZMap, then hand the smaller network pieces to Nmap for a more accurate result of listening hosts on our network. Keep in mind that tools like Wireshark allow you to find network traffic, which will show ports being actually used whereas port scanning is more about host discovery by using specialized packets (sometimes) or just checking for open ports.
MASSCAN is another option similar to ZMap, they scan quickly due to their asynchronous nature,
I am not hating on Nmap too much here, simply even reducing scans per their recommendation does not save much time for the scans including too many hosts. Nmap is a great tool, just not for scans with for example 1,000,000 targets.
Now in Nmap's defense, the developer(s) keep the project maintained well, with modern features like:
There is no such thing as Nmap fast port scanning in my opinion, so here is ZMap. Why? Because other tools are faster or they would not exist and be used for whole Internet scans in place of Nmap.
We can reference https://en.wikipedia.org/wiki/Private_network#RFC_documents bring us to RFC1918.
Code:
10.0.0.0 - 10.255.255.255 (10/8 prefix)
172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
192.168.0.0 - 192.168.255.255 (192.168/16 prefix)So, let's get into our blacklist for ZMap!
nano `find /etc | grep -E 'zmap.*blacklist' | tr -d '\n'`Comment out local addresses:
Save your config, simply save the nano edits!
Now we will scan all private IPv4 addresses for common service(s). An alternative to the editing is to use
--ignore-blacklist-errors or --ignore-invalid-hosts.
Code:
cd ~
mkdir scanHosts
cd scanHosts
mkdir 10 172 192
zmap -p21 172.16.0.0/12 -o 172/21.list
zmap -p22 172.16.0.0/12 -o 172/22.list
zmap -p23 172.16.0.0/12 -o 172/23.list
zmap -p80 172.16.0.0/12 -o 172/80.list
zmap -p443 172.16.0.0/12 -o 172/443.list
zmap -p3389 172.16.0.0/12 -o 172/3389.list
cat 172/*
zmap -p21 192.168.0.0/16 -o 192/21.list
zmap -p22 192.168.0.0/16 -o 192/22.list
zmap -p23 192.168.0.0/16 -o 192/23.list
zmap -p80 192.168.0.0/16 -o 192/80.list
zmap -p443 192.168.0.0/16 -o 192/443.list
zmap -p3389 192.168.0.0/16 -o 192/3389.list
cat 192/*
zmap -p21 10.0.0.0/8 -o 10/21.list
zmap -p22 10.0.0.0/8 -o 10/22.list
zmap -p23 10.0.0.0/8 -o 10/23.list
zmap -p80 10.0.0.0/8 -o 10/80.list
zmap -p443 10.0.0.0/8 -o 10/443.list
zmap -p3389 10.0.0.0/8 -o 10/3389.list
cat 10/*Want a final overall view?
Code:
cat */* | sortNow we should have a quick ZMap analysis of what open ports we are dealing with. We can pass this information off from the ZMap results, and now head over to NMap for the "real scans", these were just to break the ice and find where the network is perhaps listening to us (or a honeypot listened and blocked us). From here, we can further dive into parts of a network and automatically find parts of the living network!
Keep in mind Nmap can trigger crashes (when performing service scans), Unicornscan can be useful in some cases.
The above ZMap scans completed in less than an hour, I guarantee Nmap would take forever in comparison. Is ZMap perfect? No. It may miss some things, but when you are simply trying to pick apart a network, ZMap can at least offer you other subnets to focus on. Think of it like NMap is a pistol great at close range when you know the up close host, whereas ZMap is more like hitting birds with a shotgun. Different tools for different jobs. Know all your tools and when to use them - when not.
Let's say an output from our above sort contains 192.168.1.1, now we might look at 192.168.1.* with Nmap.
Example:
Code:
nmap -p80 --unprivileged 192.168.1.*We could write this out into an IP list much like in a prior tutorial I had put together on Nmap vs ZMap.
Code:
nmap -p80 --unprivileged 192.168.1.* -oG - | grep "/open" | awk '{ print $2 }' > wicked.listKeep in mind, this is all focusing solely on hosts listening on port 80 (-p80), change this to 443 (HTTPS) and other service ports as needed. The main goal is to quickly find common ports to scope out the network via ZMap, then hand the smaller network pieces to Nmap for a more accurate result of listening hosts on our network. Keep in mind that tools like Wireshark allow you to find network traffic, which will show ports being actually used whereas port scanning is more about host discovery by using specialized packets (sometimes) or just checking for open ports.
MASSCAN is another option similar to ZMap, they scan quickly due to their asynchronous nature,
I am not hating on Nmap too much here, simply even reducing scans per their recommendation does not save much time for the scans including too many hosts. Nmap is a great tool, just not for scans with for example 1,000,000 targets.
Now in Nmap's defense, the developer(s) keep the project maintained well, with modern features like:
Last edited: