Advanced network scanning with Nmap 6 Henri Doreau - - PowerPoint PPT Presentation

▶
advanced network scanning with nmap 6
SMART_READER_LITE
LIVE PREVIEW

Advanced network scanning with Nmap 6 Henri Doreau - - PowerPoint PPT Presentation

Mar 17, 2024 483 likes •850 views

Advanced network scanning with Nmap 6 Henri Doreau henri.doreau@gmail.com 13 th LSM - Geneva 2012 Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion Outline Project presentation 1 Introduction

slide-1
SLIDE 1

Advanced network scanning with Nmap 6

Henri Doreau henri.doreau@gmail.com 13th LSM - Geneva 2012

slide-2
SLIDE 2

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Outline

1

Project presentation Introduction

2

Nmap Scripting Engine Presentation Internals Usage

3

Nmap 6 new features IPv6 support Performance improvements Companion tools NSE

4

Ongoing developments Upcoming features Project

2/33

slide-3
SLIDE 3

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Outline

1

Project presentation Introduction

2

Nmap Scripting Engine Presentation Internals Usage

3

Nmap 6 new features IPv6 support Performance improvements Companion tools NSE

4

Ongoing developments Upcoming features Project

3/33

slide-4
SLIDE 4

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Nmap Security Scanner

Full-featured Network scanner Port scanner Version and OS fingerprinting Lua scripting engine Companion tools (zenmap, ncat, nping, ndiff...)

4/33

slide-5
SLIDE 5

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Nmap Security Scanner

Vibrant community Fingerprint DBs CPEs Scripts and NSE libraries

5/33

slide-6
SLIDE 6

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Nmap Security Scanner

Hollywood movie star

6/33

slide-7
SLIDE 7

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Outline

1

Project presentation Introduction

2

Nmap Scripting Engine Presentation Internals Usage

3

Nmap 6 new features IPv6 support Performance improvements Companion tools NSE

4

Ongoing developments Upcoming features Project

7/33

slide-8
SLIDE 8

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Introduction

Built-in lua scripting engine Network exploration Sophisticated version detection Vulnerability detection Scan results post-processing

8/33

slide-9
SLIDE 9

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

NSE development

Script collection growth

9/33

slide-10
SLIDE 10

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Script phases

Four execution modes Prerules Service Host Postrules NSE Pre-scan

1

Host enumeration

2

Host discovery

3

Reverse DNS resolution

4

Port scan

5

Version detection / RPC grind

6

OS fingerprinting

7

Traceroute

8

Script scan

9

Output

NSE Post-scan

10/33

slide-11
SLIDE 11

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Script structure

When to run?

h o s t r u l e = f u n c t i o n ( host ) r e t u r n host . d i r e c t l y c o n n e c t e d end p o r t u l e = s h o r t p o r t . http

⇒ script can have several rule and action functions

11/33

slide-12
SLIDE 12

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Sample output

Nmap scan r e p o r t f o r scanme . nmap . org ( 7 4. 20 7. 244 .2 21 ) PORT STATE SERVICE VERSION 22/ tcp

  • pen

ssh OpenSSH 5.3 p1 Debian 3ubuntu7 80/ tcp

  • pen

http Apache httpd 2 . 2 . 1 4 (( Ubuntu )) | http −t i t l e : Go ahead and ScanMe ! S e r v i c e I n f o : OS: Linux ; CPE: cpe :/ o : l i n u x : k e r n e l Host s c r i p t r e s u l t s : | f i r e w a l k : | HOP HOST PROTOCOL BLOCKED PORTS | 192.168.0.15 tcp 139 | 10 6 4 . 6 2 . 2 5 0 . 6 tcp 135 ,445

12/33

slide-13
SLIDE 13

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Design

NSE parallelism Single nmap thread lua coroutines ⇒ Lightweight and efficient non-blocking mechanism ⇒ Script writers get parallelism for free ⇒ No concurrent memory access concerns ever

13/33

slide-14
SLIDE 14

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Adaptive workflow

Two ways to invoke scripts Point and shoot

nmap −−s c r i p t samba−vuln−cve −2012−1182 <target > nmap −−s c r i p t +mongodb−i n f o −p80 <target >

⇒ No silent dependencies Aim oriented

nmap −−s c r i p t ” http −∗ and not brute ” <target >

14/33

slide-15
SLIDE 15

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Script categories

Grouped by categories default intrusive external ... see http://nmap.org/nsedoc

15/33

slide-16
SLIDE 16

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Outline

1

Project presentation Introduction

2

Nmap Scripting Engine Presentation Internals Usage

3

Nmap 6 new features IPv6 support Performance improvements Companion tools NSE

4

Ongoing developments Upcoming features Project

16/33

slide-17
SLIDE 17

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Full IPv6 support

Long standing wish All features (provided it makes any sense) All supported platforms

17/33

slide-18
SLIDE 18

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Full IPv6 support

Long standing wish All features (provided it makes any sense) All supported platforms

YEAH!!!

17/33

slide-19
SLIDE 19

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Brand new OS fingerprinting engine

Innovative approach: machine learning techniques Reduced dataset Increased adaptiveness Very accurate ⇒ See http://nmap.org/book/osdetect

18/33

slide-20
SLIDE 20

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

IPv6 support

Honestly, who cares?

19/33

slide-21
SLIDE 21

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

IPv6 support

Honestly, who cares?

The future is already there!

19/33

slide-22
SLIDE 22

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Enhanced performances

Three main axis of improvement Memory footprint High performance and scalable I/O notification facities Application-specific optimizations (NSE)

  • cf. Scanning the Internet, by Fyodor

20/33

slide-23
SLIDE 23

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Nping

Reimplementation of the venerable hping2 Modern, high performance tool Leverages nmap libraries Provides new packet crafting classes to nmap

21/33

slide-24
SLIDE 24

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Nping Echo mode

Replacement for ping+tcpdump

1 nping in server mode on target 2 client probes the target 3 server returns captured probes to the client(s) as encrypted

payloads

22/33

slide-25
SLIDE 25

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Zenmap tologoy tab

Finally: actual network maps from the network mapper!

23/33

slide-26
SLIDE 26

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Better web scanning

Big focus on web technologies Pipelining Built-in web crawler Caching Web-specific security checks

24/33

slide-27
SLIDE 27

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

NSE frameworks

Implemented as NSE libraries brute Parallel network authentication cracking module. credentials Leverage and report discovered credentials. vulns Consistent vulnerability reports and efficient post-processing.

25/33

slide-28
SLIDE 28

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Outline

1

Project presentation Introduction

2

Nmap Scripting Engine Presentation Internals Usage

3

Nmap 6 new features IPv6 support Performance improvements Companion tools NSE

4

Ongoing developments Upcoming features Project

26/33

slide-29
SLIDE 29

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Upcoming: web scanning

Continued effort on HTTP Implement latest performance-related protocols and paradigms WebSocket mode to ncat

27/33

slide-30
SLIDE 30

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Upcoming: extend NSE

Expand the role and features of NSE Leveraging native libraries from lua NSE-based port scanning Re-implementing older code within NSE Adapting NSE to the companion tools

28/33

slide-31
SLIDE 31

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Upcoming: misc

but also... Combining IP v4/v6 scans Improving scalability Scanning through proxies Remote checks through authenticated SSH connections Updater

29/33

slide-32
SLIDE 32

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Get involved!

Your own awesome idea!

...and code? ;)

30/33

slide-33
SLIDE 33

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Development

Increasing development pace 2011 was the most active year ever in the project history! (ohloh.net). 8th consecutive Google Summer of Code

31/33

slide-34
SLIDE 34

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Happy birthday nmap!

15th birthday this year (Sept. 1st)

32/33

slide-35
SLIDE 35

Project presentation Nmap Scripting Engine Nmap 6 new features Ongoing developments Conclusion

Questions?

http://nmap.org nmap-dev@insecure.org (it’s cool, join!)

33/33