SamuraiWTF Course Slides v14 - BruCON 2012.pdf - ftp

Nmap Optimization
– Finding the right balance between speed and false negatives
– Tune your options on a subset of IPs (first /24 of 127.42.0.0/16)
sudo nmap -p 80,443 127.42.0.0/24
sudo nmap -n -PN -p 80,443 -T5 127.42.0.0/24
sudo nmap -n -PN -p 80,443 -T5 --max-retries 0 127.42.0.0/24
sudo nmap -n -PN -p 80,443 --max-rtt-timeout 100 --min-rtt-timeout
25 --initial-rtt-timeout 50 --max-retries 0 127.42.0.0/24
sudo nmap -n -PN -p 80,443 --min-rate 10000 --min-hostgroup 4096
--max-retries 0 127.42.0.0/24
– Now we have a finely tuned scan, lets run on the full /16 subnet
sudo nmap -n -PN -p 80,443 --min-rate 10000 --min-hostgroup 4096
--max-retries 0 --reason -oN /tmp/AllIPs-ports80_443 127.42.0.0/16
sudo nmap -n -PN -sS -sU -p 80,443 -A --max-retries 1 --reason
-oN /tmp/LiveWebServers-Top1000TcpUdpPorts-All 127.42.84.1-5
– Understanding Nmap Scripting Engine (NSE)
ls /usr/share/nmap/scripts | grep -iE “http|html”
Copyright 2009-2012 Justin Searle / Raul Siles - This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 License
26