Maybe you've wondered how real hackers, not stealer scrapers, are getting access to webservers or databases.
Simple explanation, you've got to be talented in using various tools.
In this tutorial, we'll be focusing on using nmap for server/port scanning, finding vulnerabilities and exploiting them.
Nmap also known as Network Mapper, is a quite popular open-source based network discovery and security auditing tool.
It's used in cybersecurity and hacking, to scan networks, in order to find open ports and the services running on those open ports.
With the service information you can find exploitable vulnerabilities. In this tutorial i will not only cover the basics, I will go through everything.
Part 1: What do I need to do before I scan with nmap?
Scanning with nmap without authorization from the network owner is of course illegal.
So you will not use your own ip address.
Follow these steps:
Get Kali Linux, put it on a bootable usb-stick
Create an encrypted persistence on that stick
Download Mullvad VPN
Enable every security feature of mullvad and you're ready to go!
Part 2: Nmap
Nmap comes directly with Kali, there are also alot of other nice tools included by default
You can simply open a terminal window and type "nmap -h"
If it works without an error that's perfect
Part 3: Preparation
To scan a target domain, you will need to figure out the server ip
You can easily to that by typing "ping domain.com" in your terminal
Copy the ip out of the response and save it
Part 4: Basic Scan
Nmap allows you to use alot of scan methods and tweaks
We will begin with the basic scan you can perform
Simply type "nmap ip" in your terminal, use "nmap scanme.nmap.org" as a test
This scan will identify open ports and services running on those ports and is used for single hosts
Now you should see the port number, the state and service running on those ports
We will use this information later, now we come to more scan types
Part 5: Intense scan
For this scan, type "nmap -T4 -A ip" to perform it
This will perform a target OS scan, version detection of the services running on ports, script scanning and traceroute.
You will perform this scan if you need a detailed analysis of your target
Part 6: SYN scan
For this scan, type "nmap -sS ip"
If you wanna be stealthy, use this scan
It basically performs as I mentioned a stealthy scan, identifying open ports
Part 7: UDP scan
For this scan, type "nmap -sU ip"
This scan method will identify open UDP ports
I will come back to this later.
Part 8: Service Version Detection
For this scan, type "nmap -sV ip"
This method, has the same output as in the intense scan but only for the service versions
Through this, you can gather information on a possible vulnerability
Part 9: Stand-alone OS detection
For this scan, type "nmap -O ip"
Same as in the intense scan, but will as before only determine info about the target server os based on TCP/IP fingerprints
Part 10: Aggressive scan
For this scan, type "nmap -T4 -A -v ip"
This scan method comes with increased timing, detailed service detection and also script scanning.
This scan leaves traces, so be sure to have a vpn on.
Part 11: Stand-alone script scanning
For this scan, type "nmap -script scriptname ip"
For a list of all 604 scripts provided by nmap, visit this site
Part 12: Firewall evasion
For this scan, type "nmap -f -D RND:10 ip"
Use this if nmap scans are getting blocked by the target
This method is the most common firewall evasion
It basically uses fragmentation and decoys IP addresses to bypass firewalls and improves success rates
Part 13: Vulnerability scanning
For this scan, type "nmap --script vuln ip"
This scan will list all interesting information about possible vulnerabilities
Part 14: Some other scan types u can test out
nmap -sT: TCP connect scan
nmap -sF: TCP FIN scan
nmap -sX: TCP Xmas scan
nmap -sN: TCP Null scan
nmap -sA: TCP ACK scan
nmap -sP: Ping scan
nmap -sP: ICMP ping scan
nmap -sO: IP protocol scan
nmap -sL: List scan
nmap -sI: Idle scan
nmap -sR: RPC scan
nmap -sT -sU: TCP and UDP scan
nmap -n: Disable DNS resolution
nmap -p: Specify ports to scan
nmap --top-ports: Scan most common ports
nmap --scanflags: Set TCP scan flags
[*]
Now to the next stage of this tutorial, I will show you how to exploit vulnerabilities.
Important: Port states
Open: An application is listening on this port
Closed: The requests have been received, but there is no application listening here
Filtered: Requests were not received, some filtering or firewall is used to absord your requests
Unfiltered: Requests were received but no state was successfully established
Open/Filtered: Port is filtered or nmap couldn't establish the state
Closed/Filtered: Port is filtered or closed
Exploit scripts:
Basically you can use the "--script name" option with an exploit script to automatically try to exploit a vulnerability
Again, here are NSE scripts under the category "exploit" that u can use for this purpose: link
Manual exploiting:
Of course if you are not a script kiddo you can exploit vulnerabilities yourself
You can search up the Service and version to find vulnerabilities on the web
Second option is to go on Exploit-DB and find your vulnerability over there
The trick is to actually perform the exploit, this can be quite hard for noobs when no tutorial exists
Most vulnerabilities come with example code on Exploit-DB
If there is no example, you gotta do your own research
I hope this tutorial is quite useful for everyone that wants to get started with webserver hacking.
I am looking forward to creating more tutorials including different tools and techniques.
If you wanna support me, reply to this thread