Using Nmap to fingerprint host details
Now that we’re familiar with how to view nmap switches and run a basic scan, let’s perform host enumeration by discovering running services, ports, and even the OSes of discovered hosts, which may be useful artifacts within our DFIR investigation.
As shown in the previous section, nmap is fairly simple to use once you are aware of the various switches that can be used. Feel free to again run the sudo nmap –h command to view the available switches and options.
For our purposes, an –A option in nmap can perform the following tasks when enumerating a host or an entire network:
- OS detection
- Service version detection
- Script scanning
- Traceroute
The –A option can take a while to run on an entire network, so I’ll run it against a single host, which was shown as alive when I previously ran the ping scan on my network.
To run this service scan as it is called, I’ll run...
