Intro to Scanning for the National Cyber League Games

Discovering Hidden Secrets with Nmap

Hello all and welcome to my next installment to the Players Committee training series! This time, our topic is Nmap scanning: what it does and how to tailor your scans to your competition needs. For some who already have a solid understanding of this topic, skip down to Commands for the juicy details. If you’re not using Kali or don’t have nmap installed yet, go to nmap’s official site for the official download and install guide.

Background

When trying to find vulnerabilities on a target server, port scanning the box would be your second step. Step one would be open-source intelligence gathering against your target of course.  Applications or software running on a server will sometimes be listening for traffic from the open internet on different ports. For example: If you’re trying to connect to a web client, your computer will be listening for a connection on either port 80 (HTTP, insecure) or port 443 (HTTPS, secure). If you need to transfer files from a machine you have credentials for, you can connect to port 21 (File Transfer Protocol). Need to remotely execute commands or access files? Try port 22 for authorized SSH (Secure Shell). The above are standard with most computers, but even games you download or software you install might be listening for data at specific ports on your machine. For more info on standard ports, you can review this list.

Why is this important? If an application has any open ports that are unsecured, you might be able to remotely access data with default credentials, or even none at all. Certain business software can be hopelessly outdated as well, and vulnerable to a host of compromising attacks.

Summary

Pressing control + x while running a command will give you details on approximately how much time the scan has left to complete.

Commands

The general format for Nmap commands is:

nmap [scan type] [options] {target}

There are 3 main ways you can specify targets:

There are ways to specify a range of target hosts, but the NCL will generally have you focus on one target host at a time.

Using just the nmap command with an IP address or hostname will scan through the first 1,000 TCP ports on the target. Though this is a good starting point, the competition is looking for a little more than that. The -p flag allows you to specify a range of ports to scan. There are a couple different ways to format it, but your best friend will be -p- which does a scan of all available ports (1-65535).

There are two different types of port connections you will most likely be asked about: TCP and UDP. (If you want to learn about the difference between the two, look here). Nmap will scan for TCP ports by default, but there are two other ways to specify it. -sS will do a TCP SYN scan, which means that it will initiate TCP communication but it will never complete the connection.

The other way is the -sT flag, which runs a full connect TCP scan. Targets are more likely to log the connection, but it can be used when the TCP SYN scan isn’t an option. It will, however, give you essentially the same information.

We aren’t worried about our target logging the connection in the NCL CTF. If you were to go out into the hacking world on a red-team engagement, scans like these need to be done stealthily— that’s where these options come in handy.

UDP ports are less commonly used in the world, but it’s always possible that they’ll be asked about in competition. If they are, all you have to do is substitute in the -sU flag and you’ll be good to go. Just a note: they will take longer than TCP scans, so try finishing the TCP scan questions first or run TCP and UDP in the same scan to save time.

More often than not, there are questions that ask you to identify the program running on a certain port. Thankfully, the -sV flag makes it easy to fingerprint these services.

These four flags will get you through a majority of the scanning challenges. If you want to find ways to spice up your scans, there’s always the SANS nmap cheat sheet  and this blog post I found myself returning to for reference time and time again. However, it’s good to remember that sometimes simpler is better and adding on features might just make your scan take longer for ultimately the same result.

Pro Tips

• There are sometimes where you try and scan a target and your computer swears up and down that it isn’t active. Some ways to troubleshoot are:
• Is your computer connecting to the internet properly? Try pinging google (ping 8.8.8.8). If you can’t connect, then you should probably troubleshoot your internet connection.
• Connected to the internet? Try adding the Pn flag to your scan. This will make nmap pretend like the host is up even if it is skeptical and send the packets anyway.
• Is it still not giving you a response? Ask the NCL slack channel. Sometimes the boxes do go down because of how much traffic they are receiving at once. Maybe move on to a different question and come back to try that one later.
• As always, read the question carefully. I can’t tell you how many times I entered the wrong answer because a question was looking for the software on the highest filtered port and I was answering with the highest open port. Slow and steady will get you to your destination with higher accuracy.

© 2019-2020 WebWitch | Security Consultant | Assistant Chief Player Ambassador, National Cyber League