Search icon Close icon
Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases now! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.

Change country

Modal Close icon
Country selected Country selected
country flag United States
Country selected
country flag United Kingdom
Country selected
country flag India
Country selected
country flag Germany
Country selected
country flag France
Country selected
country flag Canada
Country selected
country flag Russia
Country selected
country flag Spain
Country selected
country flag Brazil
Country selected
country flag Australia
Country selected
country flag Argentina
Country selected
country flag Austria
Country selected
country flag Belgium
Country selected
country flag Bulgaria
Country selected
country flag Chile
Country selected
country flag Colombia
Country selected
country flag Cyprus
Country selected
country flag Czechia
Country selected
country flag Denmark
Country selected
country flag Ecuador
Country selected
country flag Egypt
Country selected
country flag Estonia
Country selected
country flag Finland
Country selected
country flag Greece
Country selected
country flag Hungary
Country selected
country flag Indonesia
Country selected
country flag Ireland
Country selected
country flag Italy
Country selected
country flag Japan
Country selected
country flag Latvia
Country selected
country flag Lithuania
Country selected
country flag Luxembourg
Country selected
country flag Malaysia
Country selected
country flag Malta
Country selected
country flag Mexico
Country selected
country flag Netherlands
Country selected
country flag New Zealand
Country selected
country flag Norway
Country selected
country flag Philippines
Country selected
country flag Poland
Country selected
country flag Portugal
Country selected
country flag Romania
Country selected
country flag Singapore
Country selected
country flag Slovakia
Country selected
country flag Slovenia
Country selected
country flag South Africa
Country selected
country flag South Korea
Country selected
country flag Sweden
Country selected
country flag Switzerland
Country selected
country flag Taiwan
Country selected
country flag Thailand
Country selected
country flag Turkey
Country selected
country flag Ukraine
Country selected
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Home > Security > Penetration Testing > Nmap: Network Exploration and Security Auditing Cookbook
Nmap: Network Exploration and Security Auditing Cookbook
Nmap: Network Exploration and Security Auditing Cookbook

Nmap: Network Exploration and Security Auditing Cookbook: Network discovery and security scanning at your fingertips , Second Edition

Arrow left icon
Profile Icon Paulino Calderon
Arrow right icon
$54.99
Full star icon Full star icon Full star icon Full star icon Half star icon 4.7 (3 Ratings)
Paperback May 2017 416 pages 2nd Edition
eBook
$29.99 $43.99
Paperback
$54.99
Subscription
Free Trial
Renews at $19.99p/m
Arrow left icon
Profile Icon Paulino Calderon
Arrow right icon
$54.99
Full star icon Full star icon Full star icon Full star icon Half star icon 4.7 (3 Ratings)
Paperback May 2017 416 pages 2nd Edition
eBook
$29.99 $43.99
Paperback
$54.99
Subscription
Free Trial
Renews at $19.99p/m
eBook
$29.99 $43.99
Paperback
$54.99
Subscription
Free Trial
Renews at $19.99p/m

What do you get with Print?

Product feature icon Instant access to your digital eBook copy whilst your Print order is Shipped
Product feature icon Paperback book shipped to your preferred address
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Table of content icon View table of contents Preview book icon Preview Book

Nmap: Network Exploration and Security Auditing Cookbook

Network Exploration

This chapter covers the following recipes:

  • Discovering hosts with TCP SYN ping scans
  • Discovering hosts with TCP ACK ping scans
  • Discovering hosts with UDP ping scans
  • Discovering hosts with ICMP ping scans
  • Discovering hosts with SCTP INIT ping scans
  • Discovering hosts with IP protocol ping scans
  • Discovering hosts with ARP ping scans
  • Performing advanced ping scans
  • Discovering hosts with broadcast pings
  • Scanning IPv6 addresses
  • Gathering network information with broadcast NSE scripts
  • Scanning through proxies
  • Spoofing the origin IP of a scan

Introduction

In the information security industry, Nmap is the de facto tool for network exploration, leaving all other scanners far behind with its cutting-edge features, such as IPv6 scanning and advanced optimization options. It supports several different ping and port scanning techniques for host and service discovery correspondingly.

Hosts protected by packet filtering systems, such as firewalls or intrusion prevention systems, may return incorrect results when scanned because of the rules used to block certain types of network packets. In these situations, Nmap really shines as users can easily try different scanning techniques (or a combination of them) to bypass these network restrictions. In addition, it supports some options useful to make our scan traffic less suspicious. Learning about these different scanning techniques and how to combine them is necessary if we want to perform very comprehensive scans...

Discovering hosts with TCP SYN ping scans

Ping scans are used for detecting live hosts in networks. Nmap's default ping scan (-sP) sends TCP SYN, TCP ACK, and ICMP packets to determine if a host is responding, but if a firewall is blocking these requests, it will be treated as offline. Fortunately, Nmap supports a scanning technique named the TCP SYN ping scan that is very handy to probe different ports in an attempt to determine if a host is online or at least has more permissive filtering rules.

This recipe will talk about the TCP SYN ping scan and its related options.

How to do it...

Open your terminal and enter the following command:

# nmap -sn -PS <target>

You should see the list of hosts found in the target range using TCP SYN ping scanning:

...

Discovering hosts with TCP ACK ping scans

Similar to the TCP SYN ping scan, the TCP ACK ping scan is used to determine if a host is responding. It can be used to detect hosts that block SYN packets or ICMP echo requests, but it will most likely be blocked by modern firewalls that track connection states because it sends bogus TCP ACK packets associated with non-existing connections.

The following recipe shows how to perform a TCP ACK ping scan and its related options.

How to do it...

Open your terminal and enter the following command:

# nmap -sn -PA <target>

The result is a list of hosts that responded to the TCP ACK packets sent, therefore, online:

# nmap -sn -PA 192.168.0.1/24 
   Nmap scan report for 192.168.0.1 
   Host is up (0.060s latency). 
   Nmap...

Discovering hosts with UDP ping scans

Ping scans are used to determine if a host is responding and can be considered online. UDP ping scans have the advantage of being capable of detecting systems behind firewalls with strict TCP filtering but that left UDP exposed.

This next recipe describes how to perform a UDP ping scan with Nmap and its related options.

How to do it...

Open your terminal and enter the following command:

# nmap -sn -PU <target>

Nmap will determine if the target is reachable using a UDP ping scan:

# nmap -sn -PU scanme.nmap.org 
   Nmap scan report for scanme.nmap.org (45.33.32.156) 
   Host is up (0.13s latency). 
   Other addresses for scanme.nmap.org (not scanned):     
   2600:3c01::f03c:91ff:fe18:bb2f 
   Nmap done: 1 IP address (1 host...

Discovering hosts with ICMP ping scans

Ping scans are used to determine if a host is online. ICMP echo request messages were designed specifically for this task, and naturally, ping scans use these packets to reliably detect the status of a host.

The following recipe describes how to perform an ICMP ping scan with Nmap and the flags for the different types of supported ICMP messages.

How to do it...

To make an ICMP echo request, open your terminal and enter the following command:

# nmap -sn -PE <target>

If the host responded, you should see something similar to this:

# nmap -sn -PE scanme.nmap.org 
   Nmap scan report for scanme.nmap.org (74.207.244.221)  
   Host is up (0.089s latency).  
   Nmap done: 1 IP address (1 host up) scanned in 13.25 seconds
...

Discovering hosts with SCTP INIT ping scans

SCTP packets can be used to determine if a host is online by sending SCTP INIT packets and looking for ABORT or INIT ACK responses. Nmap implements this effective technique named SCTP INIT ping scan.

The following recipe describes how to launch SCTP INIT ping scans from Nmap.

How to do it...

Open your terminal and use the -PY option:

# nmap -sn -PY <target>

The output follows the same format as the other types of ping scans:

# nmap -sn -PY scanme.nmap.org 
   Nmap scan report for scanme.nmap.org (45.33.32.156) 
   Host is up (0.15s latency). 
   Other addresses for scanme.nmap.org (not scanned):    
   2600:3c01::f03c:91ff:fe18:bb2f 
   Nmap done: 1 IP address (1 host up) scanned in 4.31 seconds
...

Introduction

In the information security industry, Nmap is the de facto tool for network exploration, leaving all other scanners far behind with its cutting-edge features, such as IPv6 scanning and advanced optimization options. It supports several different ping and port scanning techniques for host and service discovery correspondingly.

Hosts protected by packet filtering systems, such as firewalls or intrusion prevention systems, may return incorrect results when scanned because of the rules used to block certain types of network packets. In these situations, Nmap really shines as users can easily try different scanning techniques (or a combination of them) to bypass these network restrictions. In addition, it supports some options useful to make our scan traffic less suspicious. Learning about these different scanning techniques and how to combine them is necessary if we want to perform very comprehensive scans.

System administrators will gain an understanding of the inner workings of...

Discovering hosts with TCP SYN ping scans

Ping scans are used for detecting live hosts in networks. Nmap's default ping scan (-sP) sends TCP SYN, TCP ACK, and ICMP packets to determine if a host is responding, but if a firewall is blocking these requests, it will be treated as offline. Fortunately, Nmap supports a scanning technique named the TCP SYN ping scan that is very handy to probe different ports in an attempt to determine if a host is online or at least has more permissive filtering rules.

This recipe will talk about the TCP SYN ping scan and its related options.

How to do it...

Open your terminal and enter the following command:

# nmap -sn -PS <target>

 

You should see the list of hosts found in the target range using TCP SYN ping scanning:

# nmap -sn -PS 192.1.1/24
   Nmap scan report for 192.168.0.1 
   Host is up (0.060s latency). 
   Nmap scan report for 192.168.0.2 
   Host is up (0.0059s latency). 
   Nmap scan report for 192.168.0.3 
   Host is up (0.063s latency). 
   Nmap...

Discovering hosts with TCP ACK ping scans

Similar to the TCP SYN ping scan, the TCP ACK ping scan is used to determine if a host is responding. It can be used to detect hosts that block SYN packets or ICMP echo requests, but it will most likely be blocked by modern firewalls that track connection states because it sends bogus TCP ACK packets associated with non-existing connections.

The following recipe shows how to perform a TCP ACK ping scan and its related options.

How to do it...

Open your terminal and enter the following command:

# nmap -sn -PA <target>

The result is a list of hosts that responded to the TCP ACK packets sent, therefore, online:

# nmap -sn -PA 192.168.0.1/24
   Nmap scan report for 192.168.0.1 
   Host is up (0.060s latency). 
   Nmap scan report for 192.168.0.60 
   Host is up (0.00014s latency). 
   Nmap done: 256 IP addresses (2 hosts up) scanned in 6.11 seconds

How it works...

The -sn option tells Nmap to skip the port scan phase and only perform host discovery. And...

Discovering hosts with UDP ping scans

Ping scans are used to determine if a host is responding and can be considered online. UDP ping scans have the advantage of being capable of detecting systems behind firewalls with strict TCP filtering but that left UDP exposed.

This next recipe describes how to perform a UDP ping scan with Nmap and its related options.

How to do it...

Open your terminal and enter the following command:

# nmap -sn -PU <target>

 

Nmap will determine if the target is reachable using a UDP ping scan:

# nmap -sn -PU scanme.nmap.org
   Nmap scan report for scanme.nmap.org (45.33.32.156) 
   Host is up (0.13s latency). 
   Other addresses for scanme.nmap.org (not scanned):     
   2600:3c01::f03c:91ff:fe18:bb2f 
   Nmap done: 1 IP address (1 host up) scanned in 7.92 seconds

How it works...

The -sn option tells Nmap to skip the port scan phase but perform host discovery. In combination with the -PU flag, Nmap uses UDP ping scanning. The technique used by a UDP ping scan works...

Discovering hosts with ICMP ping scans

Ping scans are used to determine if a host is online. ICMP echo request messages were designed specifically for this task, and naturally, ping scans use these packets to reliably detect the status of a host.

The following recipe describes how to perform an ICMP ping scan with Nmap and the flags for the different types of supported ICMP messages.

How to do it...

To make an ICMP echo request, open your terminal and enter the following command:

# nmap -sn -PE <target>

If the host responded, you should see something similar to this:

# nmap -sn -PE scanme.nmap.org
   Nmap scan report for scanme.nmap.org (74.207.244.221)  
   Host is up (0.089s latency).  
   Nmap done: 1 IP address (1 host up) scanned in 13.25 seconds

How it works...

The arguments -sn -PE scanme.nmap.org tell Nmap to send an ICMP echo request packet to the host scanme.nmap.org. We can determine that a host is online if we receive an ICMP echo reply to this probe. By setting the --packet...

Discovering hosts with SCTP INIT ping scans

SCTP packets can be used to determine if a host is online by sending SCTP INIT packets and looking for ABORT or INIT ACK responses. Nmap implements this effective technique named SCTP INIT ping scan.

The following recipe describes how to launch SCTP INIT ping scans from Nmap.

How to do it...

Open your terminal and use the -PY option:

# nmap -sn -PY <target>

The output follows the same format as the other types of ping scans:

# nmap -sn -PY scanme.nmap.org
   Nmap scan report for scanme.nmap.org (45.33.32.156) 
   Host is up (0.15s latency). 
   Other addresses for scanme.nmap.org (not scanned):    
   2600:3c01::f03c:91ff:fe18:bb2f 
   Nmap done: 1 IP address (1 host up) scanned in 4.31 seconds

How it works...

The arguments -sn -PY scanme.nmap.org tell Nmap to send an SCTP INIT ping scan against the host scanme.nmap.org to determine if it's online. Nmap attempts to initiate a connection to a service by sending a SCTP INIT packet and looks for an...

Discovering hosts with IP protocol ping scans

Nmap supports an interesting scanning technique named IP protocol ping scan. It attempts to determine if a host is online by sending packets using IP packets with different protocols.

The following recipe describes how to perform IP protocol ping scans.

How to do it...

Open your terminal and enter the following command:

# nmap -sn -PO <target>

 

If the host responded to any of the requests, you should see something like the following:

# nmap -sn -PO scanme.nmap.org 
   Nmap scan report for scanme.nmap.org (45.33.32.156) 
   Host is up (0.18s latency). 
   Other addresses for scanme.nmap.org (not scanned):    
   2600:3c01::f03c:91ff:fe18:bb2f 
   Nmap done: 1 IP address (1 host up) scanned in 0.40 seconds

How it works...

The arguments  -sn -PO scanme.nmap.org tell Nmap to perform an IP protocol ping scan of the host scanme.nmap.org.

By default, this ping scan will use the protocols IGMP, IP-in-IP, and ICMP to try to determine if the host is online...

Discovering hosts with ARP ping scans

ARP ping scans are the most effective way of detecting hosts in LAN networks. This makes them the preferred technique when scanning local Ethernet networks, and Nmap will use it even if other ping options were specified. Nmap uses its own algorithm to optimize this scanning technique. The following recipe goes through the process of launching an ARP ping scan and its available options.

How to do it...

Open your favorite terminal and enter the following command:

# nmap -sn -PR <target>

You should see the list of hosts that responded to the ARP requests:

# nmap -sn -PR 192.168.0.1/24 
   Nmap scan report for 192.168.0.1 
   Host is up (0.0039s latency). 
   MAC Address: F4:B7:E2:0A:DA:18 (Hon Hai Precision Ind.) 
   Nmap scan report for 192.168.0.2 
   Host is up (0.0037s latency). 
   MAC Address: 00:18:F5:0F:AD:01 (Shenzhen Streaming Video Technology    
   Company Limited) 
   Nmap scan report for 192.168.0.3 
   Host is up (0.00010s latency). 
  ...
Left arrow icon

Page 1 of 15

Right arrow icon

Key benefits

  • •Learn through practical recipes how to use Nmap for a wide range of tasks for system administrators and penetration testers.
  • •Learn the latest and most useful features of Nmap and the Nmap Scripting Engine.
  • •Learn to audit the security of networks, web applications, databases, mail servers, Microsoft Windows servers/workstations and even ICS systems.
  • •Learn to develop your own modules for the Nmap Scripting Engine.
  • •Become familiar with Lua programming.
  • •100% practical tasks, relevant and explained step-by-step with exact commands and optional arguments description

Description

This is the second edition of ‘Nmap 6: Network Exploration and Security Auditing Cookbook’. A book aimed for anyone who wants to master Nmap and its scripting engine through practical tasks for system administrators and penetration testers. Besides introducing the most powerful features of Nmap and related tools, common security auditing tasks for local and remote networks, web applications, databases, mail servers, Microsoft Windows machines and even ICS SCADA systems are explained step by step with exact commands and argument explanations. The book starts with the basic usage of Nmap and related tools like Ncat, Ncrack, Ndiff and Zenmap. The Nmap Scripting Engine is thoroughly covered through security checks used commonly in real-life scenarios applied for different types of systems. New chapters for Microsoft Windows and ICS SCADA systems were added and every recipe was revised. This edition reflects the latest updates and hottest additions to the Nmap project to date. The book will also introduce you to Lua programming and NSE script development allowing you to extend further the power of Nmap.

Who is this book for?

The book is for anyone who wants to master Nmap and its scripting engine to perform real life security auditing checks for system administrators and penetration testers. This book is also recommended to anyone looking to learn about network security auditing. Finally, novice Nmap users will also learn a lot from this book as it covers several advanced internal aspects of Nmap and related tools.

What you will learn

  • •Learn about Nmap and related tools, such as Ncat, Ncrack, Ndiff, Zenmap and the Nmap Scripting Engine
  • •Master basic and advanced techniques to perform port scanning and host discovery
  • •Detect insecure configurations and vulnerabilities in web servers, databases, and mail servers
  • •Learn how to detect insecure Microsoft Windows workstations and scan networks using the Active Directory technology
  • •Learn how to safely identify and scan critical ICS/SCADA systems
  • •Learn how to optimize the performance and behavior of your scans
  • •Learn about advanced reporting
  • •Learn the fundamentals of Lua programming
  • •Become familiar with the development libraries shipped with the NSE
  • •Write your own Nmap Scripting Engine scripts
Estimated delivery fee Deliver to South Korea

Standard delivery 10 - 13 business days

$12.95

Premium delivery 5 - 8 business days

$45.95
(Includes tracking information)

Product Details

Country selected
Publication date, Length, Edition, Language, ISBN-13
Publication date : May 26, 2017
Length: 416 pages
Edition : 2nd
Language : English
ISBN-13 : 9781786467454
Category :
Security
Languages :
Lua
Concepts :
Penetration Testing
Tools :
Nmap

What do you get with Print?

Product feature icon Instant access to your digital eBook copy whilst your Print order is Shipped
Product feature icon Paperback book shipped to your preferred address
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Estimated delivery fee Deliver to South Korea

Standard delivery 10 - 13 business days

$12.95

Premium delivery 5 - 8 business days

$45.95
(Includes tracking information)

Product Details

Publication date : May 26, 2017
Length: 416 pages
Edition : 2nd
Language : English
ISBN-13 : 9781786467454
Category :
Security
Languages :
Lua
Concepts :
Penetration Testing
Tools :
Nmap

Packt Subscriptions

See our plans and pricing
Modal Close icon
$19.99 billed monthly
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Simple pricing, no contract
START FREE TRIAL
BUY NOW
$199.99 billed annually
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just $5 each
Feature tick icon Exclusive print discounts
START FREE TRIAL
BUY NOW
$279.99 billed in 18 months
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just $5 each
Feature tick icon Exclusive print discounts
START FREE TRIAL
BUY NOW

Frequently bought together

Kali Linux Network Scanning Cookbook
Kali Linux Network Scanning Cookbook
Read more
May 2017 634 pages
Full star icon 5 (2)
eBook
eBook
  • eBook eBook $29.99
  • Paperback Paperback $54.99
$29.99 $43.99
$54.99
Nmap: Network Exploration and Security Auditing Cookbook
Nmap: Network Exploration and Security Auditing Cookbook
Read more
May 2017 416 pages
Full star icon 4.7 (3)
eBook
eBook
  • eBook eBook $29.99
  • Paperback Paperback $54.99
$29.99 $43.99
$54.99
Applied Network Security
Applied Network Security
Read more
Apr 2017 350 pages
eBook
eBook
  • eBook eBook $27.98
  • Paperback Paperback $48.99
$27.98 $39.99
$48.99
Stars icon
Total $ 158.97
Kali Linux Network Scanning Cookbook
$54.99
Nmap: Network Exploration and Security Auditing Cookbook
$54.99
Applied Network Security
$48.99
Total $ 158.97 Stars icon

Table of Contents

17 Chapters
Nmap Fundamentals Chevron down icon Chevron up icon
Nmap Fundamentals
Introduction
Building Nmap's source code
Finding live hosts in your network
Listing open ports on a target host
Fingerprinting OS and services running on a target host
Using NSE scripts against a target host
Reading targets from a file
Scanning an IP address ranges
Scanning random targets on the Internet
Collecting signatures of web servers
Monitoring servers remotely with Nmap and Ndiff
Crafting ICMP echo replies with Nping
Managing multiple scanning profiles with Zenmap
Running Lua scripts against a network connection with Ncat
Discovering systems with weak passwords with Ncrack
Launching Nmap scans remotely from a web browser using Rainmap Lite
Network Exploration Chevron down icon Chevron up icon
Network Exploration
Introduction
Discovering hosts with TCP SYN ping scans
Discovering hosts with TCP ACK ping scans
Discovering hosts with UDP ping scans
Discovering hosts with ICMP ping scans
Discovering hosts with SCTP INIT ping scans
Discovering hosts with IP protocol ping scans
Discovering hosts with ARP ping scans
Performing advanced ping scans
Discovering hosts with broadcast ping scans
Scanning IPv6 addresses
Gathering network information with broadcast scripts
Scanning through proxies
Spoofing the origin IP of a scan
Reconnaissance Tasks Chevron down icon Chevron up icon
Reconnaissance Tasks
Introduction
Performing IP address geolocation
Getting information from WHOIS records
Obtaining traceroute geolocation information
Querying Shodan to obtain target information
Checking whether a host is flagged by Google Safe Browsing for malicious activities
Collecting valid e-mail accounts and IP addresses from web servers
Discovering hostnames pointing to the same IP address
Discovering hostnames by brute forcing DNS records
Obtaining profile information from Google's People API
Matching services with public vulnerability advisories
Scanning Web Servers Chevron down icon Chevron up icon
Scanning Web Servers
Introduction
Listing supported HTTP methods
Checking whethera web server is an open proxy
Discovering interesting files and folders in web servers
Abusing mod_userdir to enumerate user accounts
Brute forcing HTTP authentication
Brute forcing web applications
Detecting web application firewalls
Detecting possible XST vulnerabilities
Detecting XSS vulnerabilities
Finding SQL injection vulnerabilities
Detecting web servers vulnerable to slowloris denial of service attacks
Finding web applications with default credentials
Detecting web applications vulnerable to Shellshock
Detecting insecure cross-domain policies
Detecting exposed source code control systems
Auditing the strength of cipher suites in SSL servers
Scrapping e-mail accounts from web servers
Scanning Databases Chevron down icon Chevron up icon
Scanning Databases
Introduction
Listing MySQL databases
Listing MySQL users
Listing MySQL variables
Brute forcing MySQL passwords
Finding root accounts with an empty password in MySQL servers
Detecting insecure configurations in MySQL servers
Brute forcing Oracle passwords
Brute forcing Oracle SID names
Retrieving information from MS SQL servers
Brute forcing MS SQL passwords
Dumping password hashes of MS SQL servers
Running commands through xp_cmdshell in MS SQL servers
Finding system administrator accounts with empty passwords in MS SQL servers
Obtaining information from MS SQL servers with NTLM enabled
Retrieving MongoDB server information
Detecting MongoDB instances with no authentication enabled
Listing MongoDB databases
Listing CouchDB databases
Retrieving CouchDB database statistics
Detecting Cassandra databases with no authentication enabled
Brute forcing Redis passwords
Scanning Mail Servers Chevron down icon Chevron up icon
Scanning Mail Servers
Introduction
Detecting SMTP open relays
Brute forcing SMTP passwords
Detecting suspicious SMTP servers
Enumerating SMTP usernames
Brute forcing IMAP passwords
Retrieving the capabilities of an IMAP server
Brute forcing POP3 passwords
Retrieving the capabilities of a POP3 server
Retrieving information from SMTP servers with NTLM authentication
Scanning Windows Systems Chevron down icon Chevron up icon
Scanning Windows Systems
Introduction
Obtaining system information from SMB
Detecting Windows clients with SMB signing disabled
Detecting IIS web servers that disclose Windows 8.3 names
Detecting Windows hosts vulnerable to MS08-067
Retrieving the NetBIOS name and MAC address of a host
Enumerating user accounts of Windows hosts
Enumerating shared folders
Enumerating SMB sessions
Finding domain controllers
Detecting Shadow Brokers' DOUBLEPULSAR SMB implants
Scanning ICS SCADA Systems Chevron down icon Chevron up icon
Scanning ICS SCADA Systems
Introduction
Finding common ports used in ICS SCADA systems
Finding HMI systems
Enumerating Siemens SIMATIC S7 PLCs
Enumerating Modbus devices
Enumerating BACnet devices
Enumerating Ethernet/IP devices
Enumerating Niagara Fox devices
Enumerating ProConOS devices
Enumerating Omrom PLC devices
Enumerating PCWorx devices
Optimizing Scans Chevron down icon Chevron up icon
Optimizing Scans
Introduction
Skipping phases to speed up scans
Selecting the correct timing template
Adjusting timing parameters
Adjusting performance parameters
Distributing a scan among several clients using Dnmap
Generating Scan Reports Chevron down icon Chevron up icon
Generating Scan Reports
Introduction
Saving scan results in a normal format
Saving scan results in an XML format
Saving scan results to a SQLite database
Saving scan results in a grepable format
Generating a network topology graph with Zenmap
Generating HTML scan reports
Reporting vulnerability checks
Generating PDF reports with fop
Saving NSE reports in ElasticSearch
Writing Your Own NSE Scripts Chevron down icon Chevron up icon
Writing Your Own NSE Scripts
Introduction
Making HTTP requests to identify vulnerable supermicro IPMI/BMC controllers
Sending UDP payloads using NSE sockets
Generating vulnerability reports in NSE scripts
Exploiting a path traversal vulnerability with NSE
Writing brute force password auditing scripts
Crawling web servers to detect vulnerabilities
Working with NSE threads, condition variables, and mutexes in NSE
Writing a new NSE library in Lua
Writing a new NSE library in C/C++
Getting your scripts ready for submission
HTTP, HTTP Pipelining, and Web Crawling Configuration Options Chevron down icon Chevron up icon
HTTP, HTTP Pipelining, and Web Crawling Configuration Options
HTTP user agent
HTTP pipelining
Configuring the NSE library httpspider
Brute Force Password Auditing Options Chevron down icon Chevron up icon
Brute Force Password Auditing Options
Brute modes
NSE Debugging Chevron down icon Chevron up icon
NSE Debugging
Debugging NSE scripts
Exception handling
Additional Output Options Chevron down icon Chevron up icon
Additional Output Options
Saving output in all formats
Appending Nmap output logs
Including debugging information in output logs
Including the reason for a port or host state
OS detection in verbose mode
Introduction to Lua Chevron down icon Chevron up icon
Introduction to Lua
Flow control structures
Data types
String handling
Concatenation
Common data structures
I/O operations
Coroutines
Metatables
Things to remember when working with Lua
References and Additional Reading Chevron down icon Chevron up icon
References and Additional Reading

Recommendations for you

Left arrow icon
Mastering Microsoft Defender for Office 365
Mastering Microsoft Defender for Office 365
Read more
Sep 2024 426 pages
Full star icon 5 (3)
eBook
eBook
  • eBook eBook $24.99
  • Paperback Paperback $44.99
$24.99 $35.99
$44.99
IT Audit Field Manual
IT Audit Field Manual
Read more
Sep 2024 336 pages
Full star icon 5 (2)
eBook
eBook
  • eBook eBook $21.99
  • Paperback Paperback $39.99
$21.99 $31.99
$39.99
The Ultimate Kali Linux Book
The Ultimate Kali Linux Book
Read more
Apr 2024 828 pages
Full star icon 4.8 (27)
eBook
eBook
  • eBook eBook $29.99
  • Paperback Paperback $37.99
$29.99 $43.99
$37.99 $54.99
Resilient Cybersecurity
Resilient Cybersecurity
Read more
Sep 2024 752 pages
Full star icon 5 (6)
eBook
eBook
  • eBook eBook $27.98
  • Paperback Paperback $34.98
$27.98 $39.99
$34.98 $49.99
Pentesting APIs
Pentesting APIs
Read more
Sep 2024 290 pages
Full star icon 5 (6)
eBook
eBook
  • eBook eBook $24.99
  • Paperback Paperback $30.99
$24.99 $35.99
$30.99 $44.99
Offensive Security Using Python
Offensive Security Using Python
Read more
Sep 2024 248 pages
Full star icon 5 (4)
eBook
eBook
  • eBook eBook $21.99
  • Paperback Paperback $27.98
$21.99 $31.99
$27.98 $39.99
Practical Cyber Hacking Skills for Beginners
Practical Cyber Hacking Skills for Beginners
Read more
Jul 2023 8hrs 23mins
Video
Video
  • Video Video $109.99
$109.99
Risk Management Excellence - NIST 800-37 Framework Training
Risk Management Excellence - NIST 800-37 Framework Training
Read more
Feb 2024 1hr 58mins
Video
Video
  • Video Video $64.99
$64.99
Cybersecurity Architecture Fundamentals
Cybersecurity Architecture Fundamentals
Read more
Jul 2023 3hrs 3mins
Video
Video
  • Video Video $109.99
$109.99
CompTIA Security+ SY0-701 Certification Guide
CompTIA Security+ SY0-701 Certification Guide
Read more
Jan 2024 634 pages
Full star icon 4.9 (226)
Paperback
Paperback
  • Paperback Paperback $44.99
$44.99
Right arrow icon

Customer reviews

Rating distribution
Full star icon Full star icon Full star icon Full star icon Half star icon 4.7
(3 Ratings)
5 star 66.7%
4 star 33.3%
3 star 0%
2 star 0%
1 star 0%
Keith Stephens Jul 06, 2019
Full star icon Full star icon Full star icon Full star icon Empty star icon 4
Helps me learn the ins and outs of nmap
Amazon Verified review Amazon
Brice Feb 04, 2019
Full star icon Full star icon Full star icon Full star icon Full star icon 5
I keep this on my desk at work. I have used NMAP for years but never to its full potential. That changes now. The book is jammed full of all the features of NMAP. It will show you how to automate and scan networks to the fullest potential.
Amazon Verified review Amazon
Jane Doe Dec 08, 2017
Full star icon Full star icon Full star icon Full star icon Full star icon 5
Bought this for my customer and it arrived as described. Thanks!
Amazon Verified review Amazon

People who bought this also bought

Left arrow icon
Learn Computer Forensics – 2nd edition
Learn Computer Forensics – 2nd edition
Read more
Jul 2022 434 pages
Full star icon 4.8 (63)
eBook
eBook
  • eBook eBook $27.98
  • Paperback Paperback $36.99
  • Audiobook Audiobook $46.99
$27.98 $39.99
$36.99 $49.99
$46.99
Digital Forensics and Incident Response
Digital Forensics and Incident Response
Read more
Dec 2022 532 pages
Full star icon 4.9 (15)
eBook
eBook
  • eBook eBook $29.99
  • Paperback Paperback $54.99
  • Audiobook Audiobook $57.99
$29.99 $43.99
$54.99
$57.99
Mastering Windows Security and Hardening
Mastering Windows Security and Hardening
Read more
Aug 2022 816 pages
Full star icon 4.8 (20)
eBook
eBook
  • eBook eBook $29.99
  • Paperback Paperback $54.99
$29.99 $43.99
$54.99
Cybersecurity – Attack and Defense Strategies, 3rd edition
Cybersecurity – Attack and Defense Strategies, 3rd edition
Read more
Sep 2022 570 pages
Full star icon 4.9 (42)
eBook
eBook
  • eBook eBook $22.99
  • Paperback Paperback $41.99
$22.99 $33.99
$41.99
Mastering Linux Security and Hardening
Mastering Linux Security and Hardening
Read more
Feb 2023 618 pages
Full star icon 4.6 (34)
eBook
eBook
  • eBook eBook $27.98
  • Paperback Paperback $49.99
$27.98 $39.99
$49.99
Right arrow icon

About the author

Profile icon Paulino Calderon
Paulino Calderon
Paulino Calderon (@calderpwn on Twitter) is the cofounder of Websec, a company offering information security consulting services based in Mexico and Canada. When he is not traveling to a security conference or conducting on-site consulting for Fortune 500 companies, he spends peaceful days in Cozumel, a beautiful small island in the Caribbean, learning new technologies, conducting big data experiments, developing new tools, and finding bugs in software. Paulino is active in the open source community, and his contributions are used by millions of people in the information security industry. In 2011, Paulino joined the Nmap team during the Google Summer of Code to work on the project as an NSE developer. He focused on improving the web scanning capabilities of Nmap, and he has kept contributing to the project since then. In addition, he has been a mentor for students who focused on vulnerability detection during the Google Summer of Code 2015 and 2017. He has published Nmap 6: Network Exploration and Security Auditing Cookbook and Mastering the Nmap Scripting Engine, which cover practical tasks with Nmap and NSE development in depth. He loves attending information security conferences, and he has given talks and participated in workshops in dozens of events in Canada, the United States, Mexico, Colombia, Peru, Bolivia, and Curacao.
Read more
See other products by Paulino Calderon
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial

FAQs

What is the delivery time and cost of print book? Chevron down icon Chevron up icon

Shipping Details

USA:

'

Economy: Delivery to most addresses in the US within 10-15 business days

Premium: Trackable Delivery to most addresses in the US within 3-8 business days

UK:

Economy: Delivery to most addresses in the U.K. within 7-9 business days.
Shipments are not trackable

Premium: Trackable delivery to most addresses in the U.K. within 3-4 business days!
Add one extra business day for deliveries to Northern Ireland and Scottish Highlands and islands

EU:

Premium: Trackable delivery to most EU destinations within 4-9 business days.

Australia:

Economy: Can deliver to P. O. Boxes and private residences.
Trackable service with delivery to addresses in Australia only.
Delivery time ranges from 7-9 business days for VIC and 8-10 business days for Interstate metro
Delivery time is up to 15 business days for remote areas of WA, NT & QLD.

Premium: Delivery to addresses in Australia only
Trackable delivery to most P. O. Boxes and private residences in Australia within 4-5 days based on the distance to a destination following dispatch.

India:

Premium: Delivery to most Indian addresses within 5-6 business days

Rest of the World:

Premium: Countries in the American continent: Trackable delivery to most countries within 4-7 business days

Asia:

Premium: Delivery to most Asian addresses within 5-9 business days

Disclaimer:
All orders received before 5 PM U.K time would start printing from the next business day. So the estimated delivery times start from the next day as well. Orders received after 5 PM U.K time (in our internal systems) on a business day or anytime on the weekend will begin printing the second to next business day. For example, an order placed at 11 AM today will begin printing tomorrow, whereas an order placed at 9 PM tonight will begin printing the day after tomorrow.


Unfortunately, due to several restrictions, we are unable to ship to the following countries:

  1. Afghanistan
  2. American Samoa
  3. Belarus
  4. Brunei Darussalam
  5. Central African Republic
  6. The Democratic Republic of Congo
  7. Eritrea
  8. Guinea-bissau
  9. Iran
  10. Lebanon
  11. Libiya Arab Jamahriya
  12. Somalia
  13. Sudan
  14. Russian Federation
  15. Syrian Arab Republic
  16. Ukraine
  17. Venezuela
What is custom duty/charge? Chevron down icon Chevron up icon

Customs duty are charges levied on goods when they cross international borders. It is a tax that is imposed on imported goods. These duties are charged by special authorities and bodies created by local governments and are meant to protect local industries, economies, and businesses.

Do I have to pay customs charges for the print book order? Chevron down icon Chevron up icon

The orders shipped to the countries that are listed under EU27 will not bear custom charges. They are paid by Packt as part of the order.

List of EU27 countries: www.gov.uk/eu-eea:

A custom duty or localized taxes may be applicable on the shipment and would be charged by the recipient country outside of the EU27 which should be paid by the customer and these duties are not included in the shipping charges been charged on the order.

How do I know my custom duty charges? Chevron down icon Chevron up icon

The amount of duty payable varies greatly depending on the imported goods, the country of origin and several other factors like the total invoice amount or dimensions like weight, and other such criteria applicable in your country.

For example:

  • If you live in Mexico, and the declared value of your ordered items is over $ 50, for you to receive a package, you will have to pay additional import tax of 19% which will be $ 9.50 to the courier service.
  • Whereas if you live in Turkey, and the declared value of your ordered items is over € 22, for you to receive a package, you will have to pay additional import tax of 18% which will be € 3.96 to the courier service.
How can I cancel my order? Chevron down icon Chevron up icon

Cancellation Policy for Published Printed Books:

You can cancel any order within 1 hour of placing the order. Simply contact customercare@packt.com with your order details or payment transaction id. If your order has already started the shipment process, we will do our best to stop it. However, if it is already on the way to you then when you receive it, you can contact us at customercare@packt.com using the returns and refund process.

Please understand that Packt Publishing cannot provide refunds or cancel any order except for the cases described in our Return Policy (i.e. Packt Publishing agrees to replace your printed book because it arrives damaged or material defect in book), Packt Publishing will not accept returns.

What is your returns and refunds policy? Chevron down icon Chevron up icon

Return Policy:

We want you to be happy with your purchase from Packtpub.com. We will not hassle you with returning print books to us. If the print book you receive from us is incorrect, damaged, doesn't work or is unacceptably late, please contact Customer Relations Team on customercare@packt.com with the order number and issue details as explained below:

  1. If you ordered (eBook, Video or Print Book) incorrectly or accidentally, please contact Customer Relations Team on customercare@packt.com within one hour of placing the order and we will replace/refund you the item cost.
  2. Sadly, if your eBook or Video file is faulty or a fault occurs during the eBook or Video being made available to you, i.e. during download then you should contact Customer Relations Team within 14 days of purchase on customercare@packt.com who will be able to resolve this issue for you.
  3. You will have a choice of replacement or refund of the problem items.(damaged, defective or incorrect)
  4. Once Customer Care Team confirms that you will be refunded, you should receive the refund within 10 to 12 working days.
  5. If you are only requesting a refund of one book from a multiple order, then we will refund you the appropriate single item.
  6. Where the items were shipped under a free shipping offer, there will be no shipping costs to refund.

On the off chance your printed book arrives damaged, with book material defect, contact our Customer Relation Team on customercare@packt.com within 14 days of receipt of the book with appropriate evidence of damage and we will work with you to secure a replacement copy, if necessary. Please note that each printed book you order from us is individually made by Packt's professional book-printing partner which is on a print-on-demand basis.

What tax is charged? Chevron down icon Chevron up icon

Currently, no tax is charged on the purchase of any print book (subject to change based on the laws and regulations). A localized VAT fee is charged only to our European and UK customers on eBooks, Video and subscriptions that they buy. GST is charged to Indian customers for eBooks and video purchases.

What payment methods can I use? Chevron down icon Chevron up icon

You can pay with the following card types:

  1. Visa Debit
  2. Visa Credit
  3. MasterCard
  4. PayPal
What is the delivery time and cost of print books? Chevron down icon Chevron up icon

Shipping Details

USA:

'

Economy: Delivery to most addresses in the US within 10-15 business days

Premium: Trackable Delivery to most addresses in the US within 3-8 business days

UK:

Economy: Delivery to most addresses in the U.K. within 7-9 business days.
Shipments are not trackable

Premium: Trackable delivery to most addresses in the U.K. within 3-4 business days!
Add one extra business day for deliveries to Northern Ireland and Scottish Highlands and islands

EU:

Premium: Trackable delivery to most EU destinations within 4-9 business days.

Australia:

Economy: Can deliver to P. O. Boxes and private residences.
Trackable service with delivery to addresses in Australia only.
Delivery time ranges from 7-9 business days for VIC and 8-10 business days for Interstate metro
Delivery time is up to 15 business days for remote areas of WA, NT & QLD.

Premium: Delivery to addresses in Australia only
Trackable delivery to most P. O. Boxes and private residences in Australia within 4-5 days based on the distance to a destination following dispatch.

India:

Premium: Delivery to most Indian addresses within 5-6 business days

Rest of the World:

Premium: Countries in the American continent: Trackable delivery to most countries within 4-7 business days

Asia:

Premium: Delivery to most Asian addresses within 5-9 business days

Disclaimer:
All orders received before 5 PM U.K time would start printing from the next business day. So the estimated delivery times start from the next day as well. Orders received after 5 PM U.K time (in our internal systems) on a business day or anytime on the weekend will begin printing the second to next business day. For example, an order placed at 11 AM today will begin printing tomorrow, whereas an order placed at 9 PM tonight will begin printing the day after tomorrow.


Unfortunately, due to several restrictions, we are unable to ship to the following countries:

  1. Afghanistan
  2. American Samoa
  3. Belarus
  4. Brunei Darussalam
  5. Central African Republic
  6. The Democratic Republic of Congo
  7. Eritrea
  8. Guinea-bissau
  9. Iran
  10. Lebanon
  11. Libiya Arab Jamahriya
  12. Somalia
  13. Sudan
  14. Russian Federation
  15. Syrian Arab Republic
  16. Ukraine
  17. Venezuela