nmap est un outil d'exploration réseau permettant de découvir
les machines présentes ainsi que les services qu'elles utilisent.
On va donc voir quelles sont les commandes dont on peut avoir besoin au quotidien en la matière.
1. Lister les machines à explorer
Cette commande va se contenter de lister les machines que nmap
explorerait sur le réseau en question. La valeur 24 indique que les trois
premières valeurs sont fixes et que seule la dernière va varier.
nmap -sL 192.168.0.1/24
La fin de cette commande affiche donc:
Nmap scan report for 192.168.0.249 Nmap scan report for 192.168.0.250 Nmap scan report for 192.168.0.251 Nmap scan report for 192.168.0.252 Nmap scan report for 192.168.0.253 Nmap scan report for 192.168.0.254 Nmap scan report for 192.168.0.255 Nmap done: 256 IP addresses (0 hosts up) scanned in 0.10 seconds
2. Scanner les machines du réseau
On va maintenant passer la même commande en faisant un ping sur
chaque machine.
nmap -sP 192.168.0.1/24
Et le résultat est le suivant:
Starting Nmap 6.47 ( http://nmap.org ) at 2018-02-25 09:56 CET Nmap scan report for 192.168.0.72 Host is up (0.00036s latency). Nmap scan report for 192.168.0.27 Host is up (0.00049s latency). Nmap scan report for 192.168.0.254 Host is up (0.0058s latency). Nmap done: 256 IP addresses (3 hosts up) scanned in 3.25 seconds
Il y a deux machines sur le réseau, ou une machine connectée à la fois en filaire et en Wi-Fi, en plus de la Box Internet.
3. Scanner une machine
nmap 192.168.0.72 Starting Nmap 6.47 ( http://nmap.org ) at 2018-02-25 10:14 CET Nmap scan report for 192.168.0.72 Host is up (0.00016s latency). Not shown: 997 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 0.44 seconds
La commande nmap nous affiche les ports à l'écoute ainsi que
les services correspondants.
4. Scanner une machine plus en détail
On peut en plus activer la détection du système d'exploitation et des
versions dans la commande précédente an ajoutant le flag -A:
nmap -A 192.168.0.72 Starting Nmap 6.47 ( http://nmap.org ) at 2018-02-25 10:24 CET Nmap scan report for 192.168.0.72 Host is up (0.00016s latency). Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0) |_ssh-hostkey: ERROR: Script execution failed (use -d to debug) 80/tcp open http Apache httpd 2.4.10 ((Debian)) |_http-title: Index of / Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.21 seconds
Ici on a "scanné" la machine sur laquelle on est. Les versions des services
ssh et http nous disent que l'OS est Debian.
Si maintenant on scanne la Box Internet:
nmap -A 192.168.0.254 Starting Nmap 6.47 ( http://nmap.org ) at 2018-02-25 10:25 CET Nmap scan report for 192.168.0.254 Host is up (0.0059s latency). Not shown: 990 closed ports PORT STATE SERVICE VERSION 21/tcp open ftp Freebox ftpd | ssl-cert: Subject: commonName=542vabcn.fbxos.fr/countryName=FR | Not valid before: 2018-01-04T18:42:00+00:00 |_Not valid after: 2018-04-04T17:47:00+00:00 |_ssl-date: 2089-01-02T17:11:25+00:00; +70y312d7h28m31s from local time. 80/tcp open http nginx |_http-methods: No Allow or Public header in OPTIONS response (status code 200) | http-robots.txt: 1 disallowed entry |_/ |_http-title: Freebox OS 139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP) 443/tcp open http nginx |_http-methods: No Allow or Public header in OPTIONS response (status code 400) |_http-title: 400 The plain HTTP request was sent to HTTPS port | ssl-cert: Subject: commonName=542vabcn.fbxos.fr/countryName=FR | Not valid before: 2018-01-04T18:42:00+00:00 |_Not valid after: 2018-04-04T17:47:00+00:00 |_ssl-date: 2054-09-05T18:09:35+00:00; +36y192d8h26m40s from local time. | tls-nextprotoneg: | spdy/3.1 |_ http/1.1 445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP) 554/tcp open rtsp Freebox rtspd 1.2 | rtsp-methods: |_ DESCRIBE, OPTIONS, SETUP, TEARDOWN, PLAY, PAUSE 2020/tcp open tcpwrapped 5000/tcp open upnp? 8090/tcp open http nginx |_http-methods: No Allow or Public header in OPTIONS response (status code 405) |_http-title: Freebox :: Probl\xC3\xA8me de connexion Internet 9091/tcp open http nginx |_http-methods: No Allow or Public header in OPTIONS response (status code 405) |_http-title: 404 Not Found 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi : SF-Port5000-TCP:V=6.47%I=7%D=2/25%Time=5A9284F5%P=x86_64-pc-linux-gnu%r(Ge SF:nericLines,25,"\0\0\0P/1\.0\x20400\x20Bad\x20Request\r\nCSeq:\x200\r\n\ SF:r\n")%r(GetRequest,25,"\0\0\0P/1\.0\x20400\x20Bad\x20Request\r\nCSeq:\x SF:200\r\n\r\n")%r(RTSPRequest,77,"RTSP/1\.0\x20200\x20OK\r\nPublic:\x20OP SF:TIONS,\x20ANNOUNCE,\x20SETUP,\x20RECORD,\x20SET_PARAMETER,\x20GET_PARAM SF:ETER,\x20FLUSH,\x20TEARDOWN,\x20POST,\x20GET\r\n\r\n")%r(HTTPOptions,25 SF:,"\0\0\0P/1\.0\x20400\x20Bad\x20Request\r\nCSeq:\x200\r\n\r\n")%r(Help, SF:25,"RTSP/1\.0\x20400\x20Bad\x20Request\r\nCSeq:\x200\r\n\r\n")%r(FourOh SF:FourRequest,25,"\0\0\0P/1\.0\x20400\x20Bad\x20Request\r\nCSeq:\x200\r\n SF:\r\n")%r(LPDString,25,"RTSP/1\.0\x20400\x20Bad\x20Request\r\nCSeq:\x200 SF:\r\n\r\n")%r(SIPOptions,25,"\0\0\0ept:\x20application/sdp\0\0\0\0\0\0o\ SF:0\0\0\r\n\r\n"); Service Info: Device: media device Host script results: |_nbstat: NetBIOS name: FREEBOX, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown) | smb-os-discovery: | OS: Unix (Samba 3.0.37) | NetBIOS computer name: | Workgroup: WORKGROUP |_ System time: 2018-02-25T09:41:53+00:00 | smb-security-mode: | Account that was used for smb scripts: guest | User-level authentication | SMB Security: Challenge/response passwords supported |_ Message signing disabled (dangerous, but default) |_smbv2-enabled: Server doesn't support SMBv2 protocol Service detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 1041.61 seconds
On obtiens le même genre d'informations, la Box Internet ayant elle beaucoup plus de ports ouverts.
5. Accélérer le scan de la machine
Le précédent scan ayant duré 17mn, on va essayer d'obtenir un résultat plus
rapidement en changeant la politique de temporisation de nmap:
nmap -A -T5 192.168.0.254
Le scan ne nous prends maintenant que 90 secondes en donnant quasiment les même résultats.
On verra dans un prochain billet, 5 autres commandes nmap pour
scanner votre réseau.
