How to Scan for Open Ports and Vulnerabilities with Nmap
Nmap (Network Mapper) is an open-source network discovery tool that identifies hosts, services, and potential security issues. It is an essential tool for system administrators and developers to map their server’s network. It lets you see which ports are open, what services are running, and what operating system is used on the target system.
In this article, you will learn key security tasks with Nmap, including scanning a host for open ports, identifying services running on those ports, and detecting vulnerabilities using the Nmap Scripting Engine (NSE). You will also learn how to interpret the output and take basic security measures.
Prerequisites
Before you begin:
- Have access to a Linux-based server as a non-root user with sudo privileges.
nmap Command
This section explains the nmap command's syntax and its options.
Command Syntax
Where,
[SCAN TYPES...]: Defines how Nmap scans. This group controls if and how Nmap probes the target for open ports.[OPTIONS]: One or more optional flags and parameters that modify Nmap's behavior. They control the output's scope, speed, and verbosity.TARGET: The hosts or networks to be scanned. You can provide a single IP, an IP range, a hostname, or a subnet.
Scan Types
Below are the most commonly used scan types. Some require you to run Nmap with root privileges.
Command Options
Below are some of the options that you can use with Nmap.
Perform a Basic Port Scan
In this section, you’ll run an Nmap scan to identify all open TCP ports, which are potential entry points to the server. This article uses localhost as the target. You can replace this with an IP address or a hostname you have explicit permission to scan.
A basic scan checks the 1,000 most common ports. Perform a basic scan using the command below.
CONSOLE
Sample Output:
Understanding the Output:
- Not shown: 997 closed tcp ports: These ports are closed or filtered.
- PORT: Port number and protocol.
- STATE: Whether the port is open, closed, or filtered.
- SERVICE: The service Nmap detected running on the port (when identifiable).
In this example, open ports include:
- 22 (SSH)
- 3001 (reported as nessus)
- 5432 (PostgreSQL)
Scan for Service Versions and Operating Systems
Nmap can also reveal detailed service information on open ports, including version numbers. This helps detect outdated or vulnerable services.
Use the -sV flag to probe open ports for running services:
CONSOLE
Sample Output:
This scan shows specific versions for detected services, such as OpenSSH 9.6p1 and PostgreSQL 9.6.0 or later. The question mark after Nessus indicates that Nmap is unsure, and the service identification may require further verification.
Scan for Vulnerabilities Using the Nmap Scripting Engine (NSE)
The Nmap Scripting Engine (NSE) allows Nmap to use scripts to automate various networking tasks, including vulnerability scanning. The vuln script category tests services for known vulnerabilities. This section covers installing vsftpd, an FTP server, intentionally creating a vulnerability, and then detecting and mitigating it using Nmap’s scripting engine.
Install vsftpd.
On Ubuntu/Debian-based systems.
CONSOLEOn Rocky Linux/RHEL-based systems.
CONSOLE
Enable anonymous login for vsftpd to create a vulnerability.
Edit the vsftpd configuration file.
CONSOLEFind the line
anonymous_enable=NOand change the value fromNOtoYES.Save and close the file.
Restart vsftpd.
CONSOLE
Now that you've intentionally created this issue, you can use a specific Nmap script to detect it. The
ftp-anonscript is part of the NSE and automatically tests whether an FTP server allows anonymous login.Run a vulnerability scan using
ftp-anonon port21, the port used by vsftpd.CONSOLESample output:
The scan detected an issue:
Anonymous FTP login allowed (FTP code 230).
Steps to Mitigate
You should take action on the detected issues. In this case, you need to turn off the anonymous login.
Edit the configuration file.
CONSOLEFind the line
anonymous_enable=YESand change the value fromYEStoNO.Save and exit the file.
Restart the service to apply the changes.
CONSOLERun a Nmap scan on port
21again.CONSOLEOutput:
Conclusion
This article explained how to use the Nmap command to scan for open ports and vulnerabilities. You performed an Nmap scan, identified vulnerabilities, and fixed them. For more information, refer to the Nmap official documentation.
Tags:Development
0 Comments
Be the first to comment and share your perspective with the community.