In those Nmap lectures, we have seen. No port scan, also known
as ping scan, Different ways of scanning ports, SYN scan, also known as half-­open scanning,
TCP scan, also known as TCP connect scan, and UDP scan.
Now let’s see some more details to be able to use Nmap more effectively.
We have found the host and open ports of them.
Now is it time to find out the services which are listening to those port and the version of those services.
In addition let's detect the operating systems running on those systems . Suppose that you ran Nmap
Nmap query and it told you that ports 25/tcp, 80/tcp, and 53/udp are open. Using its nmap-­services database
of about 2,200 well-­known services, Nmap would report that those ports probably correspond to a
mail server.
(SMTP), web server (HTTP), and name server (DNS) respectively.
This look up is usually accurate.
The vast majority of daemons listening on TCP port 25 are, in fact, mail servers.
However you should not bet your security on this.
People can and do run services on strange ports. Even if Nmap is right, and the hypothetical server a
above is running SMTP, HTTP, and DNS servers.
That is not a lot of information when doing vulnerability assessments or even simple network inventories
of your companies or clients.
You really want to know which mail and DNS servers and versions are running having an accurate version
number helps dramatically in determining which exploits a server is vulnerable to version detection
helps you obtain this information.
After TCP and/or UDP ports are discovered using one of the other scan methods version detection interrogates
those ports to determine more about what is actually running the the nmap-service-­probes database contains
probes for querying various services and match expressions to recognize and parse responses. Nmap
Nmap tries to determine the service protocol.
FTP, SSH, Telnet, HTTP. The application name could be ISC BIND, Apache httpd, Solaris telnetd
telnetd.
The version number, hostname, device type something like a printer or a router and the OS family you know
what that is Windows Linux etc..
Let’s see how to use service and version detection in Nmap and why it is important: OK, go to Kali and
and open a new terminal window.
Let’s create the Nmap scan command: nmap is the command itself,
-­n is to avoid the DNS resolution. -Pn
-­Pn is to avoid the host discovery.
I’m using the SYN scan for this time.
All right the destination IP which is the IP address of my Medders voidable VM and the destination port.
The top 10 ports.
Let's run this command first to see the results of a command without version detection.
Now, I open a new terminal window to create a new Nmap command:
I prepare the command with the same configuration: SYN scan, Metasploitable, and top 10 ports.
I add -­sV parameter for version detection. And hit enter. As you see the query takes longer
this time.
The SYN scan without the version detection took less than a second, and the SYN scan with version detection
took about 12 seconds. In the first query, service names are estimated by Nmap according to the default
services running on those ports.
In the second query, on the other and, Nmap probed the ports to determine more about what is actually
running.
Now, I want to show you the most important reason of using version detection in Nmap queries.
In Kali, I’m going to run SSH on port 443 and then scan the port with Nmap. Let’s perform the demo together:
First, look at the listening services if SSH is running: netstat -­tnlp SSH is running on the port 22
at the moment. Type “service ssh stop” to stop SSH service and hit enter.
Now, to change the port of SSH, we’re going to change the configuration. Open the sshd-
_config file with a text editor change.
I use “nano” text editor for this purpose. Type “nano /etc/ssh/sshd_config”
and hit enter.
Find the port line delete the sharp to make it a valid configuration line.
Sharp was used to make it a comment line.
Change the port number to 443. Ctrl + x to exit the nano,
“y” to save the changes, and hit enter to save over the existing file.
Start SSH again, using “service ssh start” command. Look at the listening ports to double check:
“netstat -­tnlp” SSH service is running on the port 443 now. Let’s scan the port 443 of Kali with Nmap:
Prepare the Nmap SYN scan command. No version detection for this query.
Nmap detects that the port is open.
Look at the service: Nmap says the service is HTTPS! Using its nmap-­services database, Nmap reported that
this port probably correspond to a web server for HTTPS.
Yes and we know that's not true.
Let’s prepare the Nmap SYN scan again, but this time, use -­sV parameter to run version
detection mechanism.
Now as you see, the port 443 is running and the service is SSH, not HTTPS. Version detection
interrogated the port to determine more about what is actually running. Nmap queried the port using
the probes of the nmap-­service-­probes database and matched expressions to recognize and parse responses.
And the version of SSH is OpenSSH version
7.6p1
So if you are not 100 percent sure about the type of the running service on a board run version detection.
Got it.
Good.