> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/network-discovery/service-discovery.md). # Service Discovery ## Service Discovery with nmap ### TCP Scanning Standard scanning on the top 1000 ports with service/version info (`-sV`) and default scripts (`-sC`) ```bash sudo nmap -sV -sC $TARGET_IP ``` With the `-F` parameter (Fast scan) only the top 100 ports are scanned ```bash sudo nmap -F -sV -sC $TARGET_IP ``` With `--top-ports n` you can specify an arbitrary number of ports n that will be scanned. Full scan of all 65535 ports (`-p-`) with verbose mode (`-v`), service/version info (`-sV`) and default scripts (`-sC`) ```bash sudo nmap -v -sV -sC -p- $TARGET_IP ``` ### UDP Scanning Additional UDP-scanning on the top 100 UDP-ports ```bash sudo nmap -sU --top-ports 100 -sV -sC $TARGET_IP ``` ### Version script category NSE's [version category](https://nmap.org/nsedoc/categories/version.html) contains scripts that enhance standard version detection. Scripts in this category **are run whenever you request version detection** with `-sV`; you don't need to use `-sC` to run these. This cuts the other way too: if you use `-sC`, you won't get `version` scripts unless you also use `-sV`. ### Service version detection configuration Do a service scan with the highest intensity ```bash sudo nmap -v -sV --version-all -sC $TARGET_IP ``` #### Version intensity `--version-intensity`` `*``* (Set version scan intensity) When performing a version scan (`-sV`), Nmap sends a series of probes, each of which is assigned a rarity value between one and nine. The lower-numbered probes are effective against a wide variety of common services, while the higher-numbered ones are rarely useful. The intensity level specifies which probes should be applied. The higher the number, the more likely it is the service will be correctly identified. However, high intensity scans take longer. The intensity must be between 0 and 9. **The default is 7**. When a probe is registered to the target port via the `nmap-service-probes` `ports` directive, that probe is tried regardless of intensity level. This ensures that the DNS probes will always be attempted against any open port 53, the SSL probe will be done against 443, etc. `--version-light` (Enable light mode) This is a convenience alias for `--version-intensity 2`. This light mode makes version scanning much faster, but it is slightly less likely to identify services. `--version-all` (Try every single probe) An alias for `--version-intensity 9`, ensuring that every single probe is attempted against each port. `--allports` (Don't exclude any ports from version detection) By default, Nmap version detection **skips TCP port 9100** because some printers simply print anything sent to that port, leading to dozens of pages of HTTP GET requests, binary SSL session requests, etc. This behavior can be changed by modifying or removing the `Exclude` directive in `nmap-service-probes`, or you can specify `--allports` to scan all ports regardless of any `Exclude` directive. ## Usage information
nmap --help ```bash ┌──(kali㉿kali)-[~/OffSec_Cources] └─$ nmap --help Nmap 7.94SVN ( https://nmap.org ) Usage: nmap [Scan Type(s)] [Options] {target specification} TARGET SPECIFICATION: Can pass hostnames, IP addresses, networks, etc. Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254 -iL : Input from list of hosts/networks -iR : Choose random targets --exclude : Exclude hosts/networks --excludefile : Exclude list from file HOST DISCOVERY: -sL: List Scan - simply list targets to scan -sn: Ping Scan - disable port scan -Pn: Treat all hosts as online -- skip host discovery -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes -PO[protocol list]: IP Protocol Ping -n/-R: Never do DNS resolution/Always resolve [default: sometimes] --dns-servers : Specify custom DNS servers --system-dns: Use OS's DNS resolver --traceroute: Trace hop path to each host SCAN TECHNIQUES: -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans -sU: UDP Scan -sN/sF/sX: TCP Null, FIN, and Xmas scans --scanflags : Customize TCP scan flags -sI : Idle scan -sY/sZ: SCTP INIT/COOKIE-ECHO scans -sO: IP protocol scan -b : FTP bounce scan PORT SPECIFICATION AND SCAN ORDER: -p : Only scan specified ports Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9 --exclude-ports : Exclude the specified ports from scanning -F: Fast mode - Scan fewer ports than the default scan -r: Scan ports sequentially - don't randomize --top-ports : Scan most common ports --port-ratio : Scan ports more common than SERVICE/VERSION DETECTION: -sV: Probe open ports to determine service/version info --version-intensity : Set from 0 (light) to 9 (try all probes) --version-light: Limit to most likely probes (intensity 2) --version-all: Try every single probe (intensity 9) --version-trace: Show detailed version scan activity (for debugging) SCRIPT SCAN: -sC: equivalent to --script=default --script=: is a comma separated list of directories, script-files or script-categories --script-args=: provide arguments to scripts --script-args-file=filename: provide NSE script args in a file --script-trace: Show all data sent and received --script-updatedb: Update the script database. --script-help=: Show help about scripts. is a comma-separated list of script-files or script-categories. OS DETECTION: -O: Enable OS detection --osscan-limit: Limit OS detection to promising targets --osscan-guess: Guess OS more aggressively TIMING AND PERFORMANCE: Options which take
## Resources nc - Linux manual page: ncat - Linux manual page: nmap - Linux manual page: Port Scanning Techniques - nmap Reference Guide: Service and Version Detection - nmap Reference Guide: Version Detection Using NSE - nmap Reference Guide: