Host Discovery:

(Internal penetration test): - The most effective host discovery method is to use ICMP echo requests:

Moyinthehacker@htb[/htb]$ sudo nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5

Scanning Options Description
10.129.2.0/24 Target network range.
-sn Disables port scanning.
-oA tnet Stores the results in all formats starting with the name 'tnet'.

This scanning method works only if the firewalls of the hosts allow it.

  1. Scan IP List:

Moyinthehacker@htb[/htb]$ sudo nmap -sn -oA tnet -iL hosts.lst | grep for | cut -d" " -f5

Scanning Options Description
-sn Ping Scan- Disables port scanning.
-oA tnet Stores the results in all formats starting with the name 'tnet'.
-iL Performs defined scans against targets in provided 'hosts.lst' list.

Ways to see how Nmap decided our target was Alive:

  1. --packet-trace
  2. --reason

More details on Host discovery: https://nmap.org/book/host-discovery-strategies.html

Using the TTL to Detect OS for OS fingerprinting:

OS / Device Common initial TTL
Linux / Unix 64
Windows 128
Cisco / networking devices 255
Some BSD systems 64

Host and Port Scanning:

There are a total of 6 different states for a scanned port we can obtain:

State Description
open This indicates that the connection to the scanned port has been established. These connections can be TCP connections, UDP datagrams as well as SCTP associations.
closed When the port is shown as closed, the TCP protocol indicates that the packet we received back contains an RST flag. This scanning method can also be used to determine if our target is alive or not.
filtered Nmap cannot correctly identify whether the scanned port is open or closed because either no response is returned from the target for the port or we get an error code from the target.
unfiltered This state of a port only occurs during the TCP-ACK scan and means that the port is accessible, but it cannot be determined whether it is open or closed.
`open filtered`
`closed filtered`