10/09/26 HTB: Network Enumeration with Nmap

Nmap = Network Map Gives us a better picture of what devices are on a network.

Host Discovery

When conducting a pentest then we should first get an overview of which systems are online that we can work with. Nmap has many options for this, the most effective is ICMP echo requests.

TTL (Time to live) indicates the host operating system.

-p- all ports --stats-every - provides a status report every so many seconds

-Pn - skips pinging the target, no ping, this speeds up the process if you know that a host is alive on the network.

-T - timing, how long to wait on each port for an answer

-sV - version scan, scans services and versions, this is important because sometimes there are vulnerabilities that are specific to certain versions of a service.

Exporting Output

With XML output we can create HTML reports that are easy to read.

xsltproc target.xml -o target.html -o is for output