In this section, we will look at scanning subnets, and performing recon of a network using Nmap. Nmap is the Swiss army knife of recon, discovery, and identification of hosts and services in a network. Before we go in and run scans, let's take a look at how Nmap works.
Ping sweeps are very handy when it comes to discovering live hosts in a network. This type of scan involves sending an ICMP ECHO Request to each host in the network and then identifying which ones are alive based on the responses:
From the diagram, we can see that some hosts responded with an ICMP ECHO Reply, whereas some did not. Based on which hosts replied, we can identify which hosts are alive.
In a ping sweep scan, we provide Nmap with a network range, typically, a network address and its subnet in CIDR form. Our AWS machines are hosted in the default subnet of AWS...
