This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →
The Backtrack 101 series aims to introduce beginners to several tools distributed with Backtrack Linux. By following these articles, a beginner can take part in the Hackfest games and start learning penetration testing techniques.
In this first article, we will talk about a well-known tool called nmap. We will also cover some of nmap's more advanced and lesser-known features, namely NSE.
Official project site: http://nmap.org/
Synopsis:
nmap is what is called a port scanner. A tool like this lets you learn a lot of information about a potential target. Needless to say, nmap is generally used before an attack to perform reconnaissance on the potential target. It is worth noting, however, that this tool has several lesser-known yet very useful features!
How does it work?
The general idea behind a scanner is to try to communicate with a port on a target. Depending on the response it gets from the target, the scanner can detect the state of the ports on the remote computer. The person who launched the scan can therefore obtain information about the services running on the target.
The basics
An nmap scan can be very simple... but also very complicated. Let's start with the default scan, using the command:
root@bt/# nmap 192.168.1.1
Here is the result of running this command in my test environment:
Once the scan has run, we learn that ports 22, 53, 80 and 111 are open on this machine. However, it is important to know that the service identified in that section may not be the right one. Indeed, the service is identified using well-known port numbers. To get more information about the services, you could use the command:
root@bt/# nmap -sV 192.168.1.1
This command runs a bit slower but, as the following image shows, the information it returns is very interesting!
When scanning with the -sV option, nmap connects to the various services and compares their responses with the information in the application's database. This lets the tool determine, sometimes with shocking accuracy, which services and versions are running on a given port. Among other things, the -sV option reveals the true nature of a service running on a non-standard port, a common setup for ssh, as shown in the figure below where an ssh service is discovered on port 443:
Looking at the result, you can also get a good idea of the operating system running on the target. However, you can use the -A option, which enables operating system detection along with service information detection. Here is what a scan with the -A option looks like in my test environment:
We learn that the operating system should be Linux with a kernel between 2.6.32 and 2.6.35, which definitely matches the information returned by the uname -a command on the test server, as shown in the following figure:
The only downside to these scanning methods is the presence of IDSs and IPSs on a network, which will very easily detect that a scan is under way. So if a competent analyst actually reviews the information provided by the intrusion detection sensors, a would-be attacker using these options could get caught.
IDS and IPS evasion
A lot of bad information circulates on the Internet about evading IDSs and IPSs during a network scan. First, I want to put two urban legends to rest:
1- A slow scan will not be detected (-T0 option)
This is false; detection will simply happen over a longer period of time. Relying on this method to avoid detection is like crossing the street without watching for cars. In short, you are betting on the experience of the analyst whose job is to review the intrusion detection data.
2- It is possible to achieve 100% effective evasion
This is also false. If you pull it off, either your IDS/IPS systems are misconfigured, or the person sitting at the console is not experienced enough or is not monitoring closely enough.
I have not tried every IDS/IPS evasion option available in nmap. However, my personal observations lead me to believe that, generally speaking, the best way to hide from such a system is to use nmap's -f option. The option could be used with a normal scan, for example:
root@bt/# nmap -f 192.168.1.1
The option could also be used in a scan that includes the service detection options. The -f option turns on fragmentation of the packets sent to the target. This fragmentation makes it much more difficult for an intrusion detection sensor to analyze those packets. In my own experiments, it is the nmap option that raises the fewest alerts on an intrusion detection console, and above all the fewest alerts that would mean anything to an inexperienced analyst. Still, a competent person will always be able to detect that a scan took place on the network.
Using scripts with NSE
A much lesser-known feature of nmap is the ability to use the Nmap Script Engine. NSE gives users access to nmap's "core" features so they can build custom tests. The advantage is that these tests can be fully customized. Several ready-made scripts ship with the Backtrack distribution. They are located in:
/usr/local/share/nmap/scripts
A quick look in this directory shows just how many scripts are available with Backtrack. For this demo, we will use the http-methods.nse script. To find out exactly what a script does and how to use it, just open it and read its documentation. In this case, we learn that the script finds out which HTTP methods a server supports, as shown in the figure:
So, to run this script, you would simply launch the command:
root@bt/# nmap --script=http-methods.nse --script-args http-methods.retest=1 192.168.1.1
Here is the result of running the script in our test environment:
We can see that the HTTP GET, HEAD, POST and OPTIONS methods are enabled on the target system. This is just one script; you should take the time to look through the various scripts in the scripts folder to get to know what the scripts already available on Backtrack can do
Final word
So, as we have seen, nmap can become an important tool for anyone doing penetration testing, once you master it. However, mastering it takes some learning, without which its usefulness is limited. It is also worth noting that users can write their own scripts for NSE. Writing NSE scripts will be the subject of another article.
Did you like this article?
Would you like to read an article about a tool you are not familiar with? Just leave the tool's name in a comment; if it is available in Backtrack, an article will be written about it.