Network mapping

Following a successful attack, attackers will try to map out the hosts in a network in order to discover the ones that contain valuable information. There are a number of tools that can be used here to identify the hosts connected in a network. One of the most commonly used is Nmap and this section will explain the mapping capabilities that this tool has. The tool, like many others, will list all the hosts that it detects on the network through a host discovery process. This is initiated using a command to scan an entire network subnet as shown in the following:

#nmap 10.168.3.1/24

Figure 8.1: Nmap enumerating ports and discovering hosts

A scan can also be done for a certain range of IP addresses as follows:

#nmap 10.250.3.1-200

The following is a command that can be used to scan specific ports on a target:

#nmap -p80,23,21 192.190.3.25

Figure 8.2: Scanning for open ports via Nmap

With this information, the attacker can...