Nmap bestpractice

basics

https://nmap.org/man/de/man-port-scanning-basics.html

ping scan

Im gleichen Netz wird ARP genutzt, ansonsten ICMP.

• nmap -sn 10.88.215.0/24

nur anzeigen der Rechner die online sind

• nmap -sn 10.88.215.0/24 -oG - | grep Up | awk '{ print $2 }' > secure.local.list

vollständiger connect

SYN - SYN/ACK - ACK - RST

• nmap -sT 10.88.215.61

einfacher scan

SYN - SYN/ACK - RST (ohne Root-Rechte nicht möglich)

• nmap -sS 10.88.215.61

udp scan

Ports von 50 bis 70 werden gescannt (zeigte keine gewünschten Ergebnisse)

• nmap -sU 10.88.215.61 -p 50-70

tcp und udp scan

TCP und UDP gleichzeitig prüfen

• nmap -sTU 10.88.215.61

bestimmte Ports scannen

Scant gezielt bestimmte Ports

• nmap -sS 10.88.215.61 -p 21,22,139

alle Ports scannen

Scan aller 65535 Ports

• nmap -sS 10.88.215.61 -p-

Angabe von Source Address und Interface

Eigene IP + Interface definieren

• nmap -e enp0s9 -S 172.26.213.X -P0 -sS 10.88.215.61

kompletter Scan in numerischer Reihenfolge

-r = Reihenfolge, -p- = alle Ports, -v = verbose

• nmap -v -r -p- -sS 10.88.215.61

Zeigt nur Rechner mit offenem Port 22

Erkennt offene SSH-Zugänge

• nmap -sS 10.88.215.0/24 -p 22 --open

Webserver detection

Versionserkennung für HTTP

• nmap -sV 10.88.215.61 -p 80

Nameserver detection

BIND erkennen auf DNS-Port

• nmap -sV 10.88.215.1 -p 53

SSH Server detection

OpenSSH identifizieren

• nmap -sV 10.88.215.61 -p 22

os detection

Linux

Ermittelt Linux-Kernel-Version

• nmap -O -v 10.88.215.61 --osscan-guess

Windows

Windows-Systeme durch TCP/IP-Stack erkennen

• nmap -O -v 10.88.215.5 --osscan-guess

ssl-enum-ciphers

Zeigt unterstützte Ciphers auf HTTPS-Port

• nmap -sV --script ssl-enum-ciphers -p 443 xinux.de

Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-09 10:44 CET
Nmap scan report for www.xinux.de (94.130.248.212)
Host is up (0.027s latency).
Other addresses for www.xinux.de (not scanned): 2a01:4f8:13b:1e15:8000:0:212:1
rDNS record for 94.130.248.212: thor.tuxmen.de

PORT    STATE SERVICE VERSION
443/tcp open  ssl/ssl Apache httpd (SSL-only mode)
|_http-server-header: Apache/2.4.29 (Ubuntu)
| ssl-enum-ciphers: 
|   TLSv1.0: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|     compressors: 
|       NULL
|     cipher preference: server
|   TLSv1.1: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|     compressors: 
|       NULL
|     cipher preference: server
|   TLSv1.2: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|     compressors: 
|       NULL
|     cipher preference: server
|_  least strength: A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.85 seconds

Lese das TLS-Zertifikat

• nmap -sV --script ssl-cert -p 443 xinux.de

Starting Nmap 7.93 ( https://nmap.org ) at 2026-05-06 19:35 CEST
Nmap scan report for xinux.de (194.59.156.162)
Host is up (0.011s latency).

PORT    STATE SERVICE  VERSION
443/tcp open  ssl/http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
|_http-server-header: Apache/2.4.56 (Debian)
| ssl-cert: Subject: commonName=xinux.de
| Subject Alternative Name: DNS:*.xinux.de, DNS:xinux.de
| Issuer: commonName=R13/organizationName=Let's Encrypt/countryName=US
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-03-16T05:24:22
| Not valid after:  2026-06-14T05:24:21
| MD5:   28144e705895a1e9b43e304e22021818
|_SHA-1: e11e158230336ce050c7d070e50c1f77039fb04

Alle Schwachstellen

Nutzt CVE-Datenbank über vulners NSE-Script

• nmap -sV --script vulners 10.88.215.61

schneller Scan mit weniger Ports

Fast Scan (-F) nutzt Nmaps Standard-Portliste

• nmap -F 10.88.215.0/24

Ziele aus einer Datei lesen

Zielsysteme aus Datei nutzen

• vi secure.local.list

10.88.215.1
10.88.215.5
10.88.215.29
10.88.215.34
10.88.215.35
10.88.215.60
10.88.215.61
10.88.215.101
10.88.215.103
10.88.215.170

Anwenden

Scan der IP-Liste ohne Ping

• nmap -sP -iL secure.local.list

Export im XML Format

• nmap -sP -iL secure.local.list -oX secure.local.xml

ICMP Timestamp Request Remote Date Disclosure

ICMP-Zeitprüfung zur Systemuhr-Abfrage

• nmap -sP -PE --script=icmp-timestamp 10.88.215.61

Links

http://wiki.ubuntuusers.de/nmap https://nmap.org/man/de/