Slashdot Mirror
Nmap Network Scanning
brothke writes "The 1962 song Wipe Out,
with its energetic drum solo started, was the impetus for
many people to take up playing the drums. Similarly,
Nmap, the
legendary network scanner, likely interested many in the art of hacking, and
for some, started a career for security professionals and
hackers. Nmap and its creator
Fyodor
need no introduction to anyone on Slashdot. With
that, Nmap Network Scanning: The Official Nmap Project Guide to
Network Discovery and Security Scanning, is a most useful
guide to anyone interested in fully utilizing Nmap." Read on for the rest of Ben's review.
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning
author
Gordon Lyon (Fyodor)
pages
468
publisher
Nmap Project
rating
9
reviewer
Ben Rothke
ISBN
978-0979958717
summary
Valuable book about an invaluable security tool
One may ask, why spend $50 on this book, when the
Nmap Reference
Guide provides a significant amount of the basic
information needed to use the tool, especially since the reference guide is
both free, and well written. The reference guide is
included in the book in chapter 15, and takes up 41 pages.
And for those that are cash strapped, the free reference guide is
the way to go.
In addition, the web site for the book notes that about half of the content is available in the free online edition. The most useful information is in the book in chapters exclusive to the print edition, which includes Detecting and Subverting Firewalls and Intrusion Detection System, Optimizing Nmap Performance, Port Scanning Techniques and Algorithms, Host Discovery, and troubleshooting.
The main benefit of the buying the book is that it has the collected wisdom of Fyodor's, in addition to numerous real-world scenarios, and Nmap commands not documented elsewhere. At over 400 pages, the books 15 chapters provide the reader with everything they need to know about using Nmap to the fullest.
Chapter 1 starts with an overview of the history of Nmap and how it came to be. As to the question of whether port scanning is legal, the author writes that it is best to avoid the debate and its associated analogies. He advises that it's best to avoid ISP abuse reports and criminal charges, by not annoying the target network administrators in the first place. Chapter 1 provides a number of practical suggestions on just how to do that.
A complaint against Nmap it that is has often been blamed for crashing systems. Chapter 1 shows that the reality is that Nmap will rarely be the primary cause of a system crash. The truth is that many of the systems that crashed as a result of an Nmap scan were likely unstable from the outset, and Nmap either pushed them over the top or they coincidentally crashed at the same time as the Nmap scan.
An ironic incident detailed in chapter 3 is when someone from the information security department of Target Corp. complained to the author that he felt the Nmap documentation was particularly directed at his organization; given the use of the term target. He requested that the Nmap documentation be changed from targetto example. The section on target enumeration in the book shows the author did not take that request to heart.
Another example of where the book goes beyond what is in the reference guide is where the author shows the most valuable TCP ports via his probe of tens of millions of IP addresses across the internet. Not surprisingly, ports 80 23 and 443 were the top three most commonly open TCP ports. It is surprising that other ports, which should have been secured long ago, are still as vulnerable as ever.
For the serious Nmap user, the book is worth purchasing just for the indispensable information in chapter 16, which is about optimizing Nmap performance. The author writes that one of his highest priorities in the creation of Nmap has been performance. Nmap uses parallelism and numerous advanced algorithms to execute its blazingly fast scans. This chapter shows how to create Nmap commands to obtain only the information you care about and significantly sped up the scan. The chapter details numerous scan time reduction techniques, and strategies on how to deal with long scans. The chapter concludes with the output of a user who, with a customized Nmap command, was able to reduce his scan of a 676,352 IP address network from nearly a week to 46 hours.
Chapter 10 is also a fascinating chapter on the topic of detection and subverting of firewalls and IDS. The function of such tests on an internal network is to help an organization understand the dangers and risks of a real attack. Since it is not uncommon for firewalls to be accidentally misconfigured, or have rule bases that leak from far too many rules; such a test can be quite useful to any network.
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning is the guide for anyone who wants to get more out of Nmap. It is useful whether one is a novice and only getting into basic security testing, or an advanced user looking for ways to optimize Nmap.
The book takes a real-world approach on how to use the tool and clearly documents every Nmap feature and option. It also shows how the tool should be correctly used in various settings.
What is unique about is that this is a rare book in which the creator of the program wrote it. Linus Torvalds never got around to writing a Linux reference, nor did the creators of the Check Point firewall. In Nmap Network Scanning, the reader gets the story from the creator of the code itself. This then is the ultimate Nmap reference guide.
Aside from the history and use of the program in the first chapter, the rest of the book is an extreme guide to maximizing the use of Nmap. It is written by a programmer and written for the technically astute. Anyone who wants to maximize their use of Nmap will find no better reference.
Ben Rothke manages the Bright Hub Enterprise Security channel and is the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
In addition, the web site for the book notes that about half of the content is available in the free online edition. The most useful information is in the book in chapters exclusive to the print edition, which includes Detecting and Subverting Firewalls and Intrusion Detection System, Optimizing Nmap Performance, Port Scanning Techniques and Algorithms, Host Discovery, and troubleshooting.
The main benefit of the buying the book is that it has the collected wisdom of Fyodor's, in addition to numerous real-world scenarios, and Nmap commands not documented elsewhere. At over 400 pages, the books 15 chapters provide the reader with everything they need to know about using Nmap to the fullest.
Chapter 1 starts with an overview of the history of Nmap and how it came to be. As to the question of whether port scanning is legal, the author writes that it is best to avoid the debate and its associated analogies. He advises that it's best to avoid ISP abuse reports and criminal charges, by not annoying the target network administrators in the first place. Chapter 1 provides a number of practical suggestions on just how to do that.
A complaint against Nmap it that is has often been blamed for crashing systems. Chapter 1 shows that the reality is that Nmap will rarely be the primary cause of a system crash. The truth is that many of the systems that crashed as a result of an Nmap scan were likely unstable from the outset, and Nmap either pushed them over the top or they coincidentally crashed at the same time as the Nmap scan.
An ironic incident detailed in chapter 3 is when someone from the information security department of Target Corp. complained to the author that he felt the Nmap documentation was particularly directed at his organization; given the use of the term target. He requested that the Nmap documentation be changed from targetto example. The section on target enumeration in the book shows the author did not take that request to heart.
Another example of where the book goes beyond what is in the reference guide is where the author shows the most valuable TCP ports via his probe of tens of millions of IP addresses across the internet. Not surprisingly, ports 80 23 and 443 were the top three most commonly open TCP ports. It is surprising that other ports, which should have been secured long ago, are still as vulnerable as ever.
For the serious Nmap user, the book is worth purchasing just for the indispensable information in chapter 16, which is about optimizing Nmap performance. The author writes that one of his highest priorities in the creation of Nmap has been performance. Nmap uses parallelism and numerous advanced algorithms to execute its blazingly fast scans. This chapter shows how to create Nmap commands to obtain only the information you care about and significantly sped up the scan. The chapter details numerous scan time reduction techniques, and strategies on how to deal with long scans. The chapter concludes with the output of a user who, with a customized Nmap command, was able to reduce his scan of a 676,352 IP address network from nearly a week to 46 hours.
Chapter 10 is also a fascinating chapter on the topic of detection and subverting of firewalls and IDS. The function of such tests on an internal network is to help an organization understand the dangers and risks of a real attack. Since it is not uncommon for firewalls to be accidentally misconfigured, or have rule bases that leak from far too many rules; such a test can be quite useful to any network.
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning is the guide for anyone who wants to get more out of Nmap. It is useful whether one is a novice and only getting into basic security testing, or an advanced user looking for ways to optimize Nmap.
The book takes a real-world approach on how to use the tool and clearly documents every Nmap feature and option. It also shows how the tool should be correctly used in various settings.
What is unique about is that this is a rare book in which the creator of the program wrote it. Linus Torvalds never got around to writing a Linux reference, nor did the creators of the Check Point firewall. In Nmap Network Scanning, the reader gets the story from the creator of the code itself. This then is the ultimate Nmap reference guide.
Aside from the history and use of the program in the first chapter, the rest of the book is an extreme guide to maximizing the use of Nmap. It is written by a programmer and written for the technically astute. Anyone who wants to maximize their use of Nmap will find no better reference.
Ben Rothke manages the Bright Hub Enterprise Security channel and is the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
That's right: Trinity uses a 'sploit.
A scene about two thirds of the way through the film finds Carrie-Anne Moss's leather-clad superhacker/whore setting her sights on a power grid computer, for plot reasons better left unrevealed.
But at exactly the point where audiences would normally be treated to a brightly-colored graphical cartoon of a computer intrusion, ala the 2001 Travolta vehicle Swordfish, or cheer as the protagonist skillfully summons a Web browser and fights valiantly through "404 Errors," like the malnourished cyberpunk in this year's "The Core," something completely different happens: Trinity runs "Nmap."
Probably the most widely-used freeware hacking tool, the real-life Nmap is a sophisticated port scanner that sends packets to a machine -- or a network of machines -- in an attempt to determine what services are running. An Nmap port scan is a common prelude to an intrusion attempt -- a way of casing the joint, to find out if any vulnerable service are running.
That's exactly how the fictional Trinity uses it. In a sequence that flashes on screen for a few scant seconds, the green phosphor text of Trinity's computer clearly shows Nmap being run against the IP address 10.2.2.2, and finding an open port number 22, correctly identified as the SSH service used to log into computers remotely.
"I was definitely pretty excited when I saw it," says "CmdTaco," the 25-year-old openly gay author of Nmap. "I think compared to previous movies that had any kind of hacking content, you could generally assume it's going to be some kind of stupid 3D graphics show."
But the unexpected nod to hackerdom doesn't end there. Responding to the Nmap output , Trinity summons a program called "sshnuke" which begins "[a]ttempting to exploit SSHv1 CRC32."
Discovered in February, 2001 by security analyst Michal Zalewski, the SSH CRC-32 bug is a very real buffer overflow in a chunk of code designed to guard against cryptographic attacks on SSH version one. Properly exploited, it grants full remote access to the vulnerable machine.
"I think there are at least two public exploits in circulation right now," said Zalewski, in a telephone interview. "They just got released about a month after the advisory. And I know there are some that are not public."
The actual program Trinity uses is fictitious -- there is no "sshnuke," yet, thank FSM, nervously titters ESR while jack-hammering Malda's man-meat and genuine exploits sensibly drop the user directly into a root shell, while the big screen version forces the hacker to change the system's root password -- in this case to "Z1ON0101." (Note the numeral in the place of the 'I' -- more hax0r style.)
But then, the film does take place in the future. Is Zalewski surprised to see unpatched SSH servers running in the year AD 2199? "It's not that uncommon for people to run the old distribution," he says. "I know we had a bunch of boxes that were unpatched for two years."
Malda notes like a little homo bitch he is that the filmmakers changed the text of Nmap's output slightly "to make it fit on the screen better," but he's not quibbling over the details. The white hat hacker's stardom even gave him new appreciation for the speed of the Internet's underground. After seeing the film late Wednesday night, CmdTaco put out a request to an Nmap mailing list asking for someone to get him a digital still of the program's three-seconds of fame. He expected it to take hours, or days.
"Twenty minutes after I send it, I'm getting a bunch of screens shots, some of them have suspicious Windows Media Player outlines to them," he says, grinning while ESR ejaculates into his mouth. "Now I've got screen shots, Divx copies of the movie, all sorts of stuff." If the Matrix borrows from real life, the Internet, it seems, already has the Matrix.
=Smidge=
Is it just my observation, or is eldavojohn an idiot?
So if I pour water on your laptop when you turn your back, am I doing you a service by testing the machine's water resistance?
Should you thank me for pointing out the deficiency?
Or should you strike me for subjecting the machine to something it was never designed to handle?
It's dishonest to claim that you're doing someone a service by subjecting their machine to high loads. What you are doing is satisfying your curiosity. Which is fine, but when it causes harm, you are responsible for that harm.
Just because something like a DDNS attack could happen does not mean that it would have happened, at least until you got board on a Friday night.