Python3-nmap converts Nmap commands into python3 methods¶

Home page¶

https://www.nmmapper.com

Rationale¶

There is python-nmap projects out there hosted on bitbucket, which is the basic of our online port scanner at Nmmapper But we wanted to extend our online port scanner with nmap features like running nmap scripts online. The existing projects does it very well, in fact we used the existing python-nmap project to run nmap’s dns-brute script on our subdomain finder tool .

But we wanted something that defines each nmap command and each nmap script as a python3 function that we can call like calling python3 function. for example

 import nmap3
 nmap = nmap3.Nmap()

 result = nmap.nmap_version_detection("nmmapper.com")

 # This is equivalent to nmap's
 # nmap  nmmapper.com  -sV
 # Except we add 'oX' to be /usr/bin/nmap  -oX  -  nmmapper.com  -sV
 #
 # result Output
 [
 {
     "cpe": [
         {
             "cpe": "cpe:/o:linux:linux_kernel"
         }
     ],
     "port": "80",
     "protocol": "tcp",
     "service": {
         "conf": "10",
         "extrainfo": "Ubuntu",
         "method": "probed",
         "name": "http",
         "ostype": "Linux",
         "product": "nginx",
         "version": "1.14.0"
     }
 },
 {
     "cpe": [
         {
             "cpe": "cpe:/o:linux:linux_kernel"
         }
     ],
     "port": "443",
     "protocol": "tcp",
     "service": {
         "conf": "10",
         "extrainfo": "Ubuntu",
         "method": "probed",
         "name": "http",
         "ostype": "Linux",
         "product": "nginx",
         "tunnel": "ssl",
         "version": "1.14.0"
     }
 },
 {
     "cpe": [
         {
             "cpe": "cpe:/o:linux:linux_kernel"
         }
     ],
     "port": "2000",
     "protocol": "tcp",
     "service": {
         "conf": "10",
         "extrainfo": "Ubuntu Linux; protocol 2.0",
         "method": "probed",
         "name": "ssh",
         "ostype": "Linux",
         "product": "OpenSSH",
         "version": "7.6p1 Ubuntu 4ubuntu0.3"
     }
 }
 ]

This python3 program defines each Nmap command: as a python3 method that can be called independently, this makes using nmap in python very easy. Right now the script is not yet complete, because we are still adding more nmap args and commands inside this script, but we are already using this script at Nmmapper’s online port scanner

The following are some of the added commands from nmap and how to use them. In this script.

Nmap top port scan

Nmap dns-brute-script( to find subdomains and more )

Nmap List scan

Nmap os detection

Nmap Subnet scan

Nmap version detection

Contents¶

Overview¶

Installation¶

Howto¶

Nmap¶

Nmap or Network Mapper is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping). Nmap’s power can be summarized as follows;

Flexible

Powerful

Portable

Easy

Free

Well Documented

Supported

Acclaimed

Popular

Sample nmap command

1	$ nmap -A -T4 scanme.nmap.org

Nmap option summary¶

If you want to get a summary of nmap’s command just run nmap without any command like this;

$ nmap

What come after that command is run is the option summary

Nmap Host discovery¶

One of the very first steps in any network reconnaissance mission is to reduce a (sometimes huge) set of IP ranges into a list of active or interesting hosts. Scanning every port of every single IP address is slow and usually unnecessary. Of course what makes a host interesting depends greatly on the scan purposes. Network administrators may only be interested in hosts running a certain service, while security auditors may care about every single device with an IP address. An administrator may be comfortable using just an ICMP ping to locate hosts on his internal network, while an external penetration tester may use a diverse set of dozens of probes in an attempt to evade firewall restrictions

$ nmap  -sL # (List Scan)

$ nmap  -sn # (No port scan)

$ nmap  -Pn # (No ping)

$ nmap  -PS <port list> # (TCP SYN Ping)

$ nmap -PA <port list> # (TCP ACK Ping)

$ nmap  -PU <port list> # (UDP Ping)

$ nmap  -PY <port list> # (SCTP INIT Ping)

$ nmap  -PE; -PP; -PM # (ICMP Ping Types)

$ nmap  -PO <protocol list> # (IP Protocol Ping)

$ nmap  --disable-arp-ping # (No ARP or ND Ping)

$ nmap  --traceroute # (Trace path to host)

$ nmap  -n # (No DNS resolution)

$ nmap  -R # (DNS resolution for all targets)

$ nmap  --resolve-all # (Scan each resolved address)

$ nmap  --system-dns # (Use system DNS resolver)

$ nmap  --dns-servers <server1>[,<server2>[,...]] # (Servers to use for reverse DNS queries)

Nmap Port Scanning Basics¶

While Nmap has grown in functionality over the years, it began as an efficient port scanner, and that remains its core function. The simple command nmap <target> scans 1,000 TCP ports on the host <target>. While many port scanners have traditionally lumped all ports into the open or closed states, Nmap is much more granular. It divides ports into six states: open, closed, filtered, unfiltered, open|filtered, or closed|filtered.

These states are not intrinsic properties of the port itself, but describe how Nmap sees them. For example, an Nmap scan from the same network as the target may show port 135/tcp as open, while a scan at the same time with the same options from across the Internet might show that port as filtered

Six port states recognized by Nmap

open

An application is actively accepting TCP connections, UDP datagrams or SCTP associations on this port. Finding these is often the primary goal of port scanning. Security-minded people know that each open port is an avenue for attack. Attackers and pen-testers want to exploit the open ports, while administrators try to close or protect them with firewalls without thwarting legitimate users. Open ports are also interesting for non-security scans because they show services available for use on the network.
closed

A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it. They can be helpful in showing that a host is up on an IP address (host discovery, or ping scanning), and as part of OS detection. Because closed ports are reachable, it may be worth scanning later in case some open up. Administrators may want to consider blocking such ports with a firewall. Then they would appear in the filtered state, discussed next.
filtered

Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host-based firewall software. These ports frustrate attackers because they provide so little information. Sometimes they respond with ICMP error messages such as type 3 code 13 (destination unreachable: communication administratively prohibited), but filters that simply drop probes without responding are far more common. This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This slows down the scan dramatically.
unfiltered

The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed. Only the ACK scan, which is used to map firewall rulesets, classifies ports into this state. Scanning unfiltered ports with other scan types such as Window scan, SYN scan, or FIN scan, may help resolve whether the port is open
open|filtered

Nmap places ports in this state when it is unable to determine whether a port is open or filtered. This occurs for scan types in which open ports give no response. The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered. The UDP, IP protocol, FIN, NULL, and Xmas scans classify ports this way.
closed|filtered

This state is used when Nmap is unable to determine whether a port is closed or filtered. It is only used for the IP ID idle scan.

Not shown: 995 filtered ports
PORT     STATE  SERVICE
80/tcp   open   http
113/tcp  closed ident
443/tcp  open   https
8080/tcp open   http-proxy
8443/tcp open   https-alt

Nmap done: 1 IP address (1 host up) scanned in 18.57 seconds
# Notice the STATE

Advanced¶

Nmap Scanning Techniques¶

TCP SYN Scan (-sS)

 import nmap3
 nmap = nmap3.NmapScanTechniques()

 results = nmap.nmap_syn_scan()

 [
 {
     "port": "53",
     "protocol": "tcp",
     "reason": "syn-ack",
     "reason_ttl": "64",
     "service": {
         "conf": "3",
         "method": "table",
         "name": "domain"
     },
     "state": "open"
 },
 {
     "port": "80",
     "protocol": "tcp",
     "reason": "syn-ack",
     "reason_ttl": "64",
     "service": {
         "conf": "3",
         "method": "table",
         "name": "http"
     },
     "state": "open"
 }
]

TCP connect() scan (-sT)

 import nmap3
 nmap = nmap3.NmapScanTechniques()
 results = nmap.nmap_tcp_scan()

FIN Scan (-sF)

 import nmap3
 nmap = nmap3.NmapScanTechniques()
 results = nmap.nmap_fin_scan()

Ping Scan (-sP)

 import nmap3
 nmap = nmap3.NmapScanTechniques()
 results = nmap.nmap_ping_scan()

Idle Scan (-sI))

 import nmap3
 nmap = nmap3.NmapScanTechniques()
 results = nmap.nmap_idle_scan()

Nmap is a large tool, as you can see python3-nmap provides only things what you could say commonly used nmap features.

NmapHostDiscovery

*def nmap_portscan_only(self, host, args=None)*

def nmap_no_portscan(self, host, args=None):

import nmap3
nmap = nmapp.NmapHostDiscovery()
results = nmap.nmap_no_portscan("your-host")

def nmap_arp_discovery(self, host, args=None):

import nmap3
nmap = nmapp.NmapHostDiscovery()
results = nmap.nmap_arp_discovery("your-host")

def nmap_disable_dns(self, host, args=None):

import nmap3
nmap = nmapp.NmapHostDiscovery()
results = nmap.nmap_disable_dns("your-host")

Using custom nmap command line arguments.

As we said, the script defines each set of nmap command as python function/methods. You can also pass arguments to those methods/function thus extending your capabilities for example.Let’s say we want to scan top ports but also perform version detection .

 import nmap3
 nmap = nmap3.Namp()
 results = nmap3.scan_top_ports("host", args="-sV")

Cross Reading