Finding Open Ports with Nmap

When traffic is sent to a computer, it is sent to a certain port. This port depends on the software sending/receiving the traffic. This ensures that the data is sent to the software that needs it, for example websites normally operate on port 80 or 443 (depending on if the site uses HTTP or HTTPS respectively), whereas SSH uses port 22. You can read more on ports here.

Nmap is a tool which allows hackers or network administrators to tell which ports are open on a device. This information can be used to find vulnerable services to exploit, or to find services which shouldn’t be running and which a hacker or malware may have added.

The official site for nmap is here, and it can be downloaded from there, however it comes packaged with Kali. I will be scanning a VM running metasploitable, which is an OS created by the creators of metasploit (a hacking tool, but more on that another day) and is intentionally vulnerable. I will be using this machine in many of my tutorials to demonstrate techniques/attacks. Creating a Metasploitable VM is identical to creating a Kali box, but using a Metasploitable image instead.

After booting up the Metasploitable machine, we see something like this:

We can then run the command ‘ip route’ to find our local IP address.

Quite a lot is shown, but what we are looking for is the address after ‘src’. This tells me that my local IP address is 192.168.0.90. Without closing Metasploitable, we open our Kali VM as well and log in. to check that we can connect to Metasploitable, we will ping the address we just found.

‘64 bytes from 192.168.0.90′ tells me that I am getting a response from Metasploitable. Let’s start an nmap scan. We are going to start with just a simple scan. I will type ‘nmap 192.168.0.90′ without any other flags.

Here we can see that there are 21 ports running. Knowing what ports are open is useful, but we can find more information. Let’s find the OS with the -O flag (bear in mind that this requires sudo)

Along with the same information from before, we now have more information. We now know the MAC address, the OS it is running (Linux 2.6), and some more information about the OS. Nmap can also tell us (a guess) about the software running on each port with the -sV argument.

We can use this software version to search for exploits, and I will write another guide on that soon but here is a quick example of just some of the exploits.

Using the -h flag with nmap will output all of the available options:

As you can see, there are a lot of options. I recommend using a site like [HackTheBox]("https://www.hackthebox.eu/") or [TryHackMe]("https://tryhackme.com/") to give you a place to practice (I have found TryHackMe is better for beginners), or you can practice with a Metasploitable box. Nmap is a very useful tool and enables you to find so much information. It is worth learning well and I haven’t begun to scratch the surface of all the functionality.