Zenmap Archives - Hackercool Magazine

Nmap is a popular port scanner. Today we are going to see target specification in nmap. In Nmap target can be specified in six different ways. We are going to look at each one of them. For this, I am using Kali Linux connected internally with IP address 10.10.10.2.

1. nmap -iL <input filename>

This option reads targets from a specific file. Let’s create a file named alpha with a few newline separated or tab-limited or space separated IP addresses using vi on Desktop.

Then, move to Desktop directory and type the command “nmap -iL alpha” as shown below. It scans the four IP addresses listed in our file.

2. nmap -iR <number of hosts>

This option is used to specify random hosts to scan. Nmap generates its own targets to scan. The <number of hosts> argument tells nmap the number of IP’s to generate. Let’s type command “nmap -iR 5″. We can see that nmap generated five random targets to scan. The scan failed to determine route to the generated IP addresses because my system is not connected to Internet. Why didn’t it generate any internal IP addresses? Because in this scan private, multicast and unallocated address ranges are automatically skipped.

3. nmap <IP address/dir>

This option is used to scan the entire subnet. Assuming you know CIDR let’s type the command nmap 10.10.10.1/29 to scan eight IP addresses from 10.10.10.1 to 10.10.10.8 and see the result below.

4. nmap [targets] -exclude[targets]

This option specifies a comma separated list of targets to be excluded from the scan even if they are part of overall network range we specify. For example, in our previous scan we saw that one host 10.10.10.2( which is the system I am working on) is alive. Now I decided to exclude that host and another host from the scan. So I type the command “nmap 10.10.10.0/29 -exclude 10.10.10.2,10.10.10.7″ and press “Enter”. We can see that nmap has only scanned six IP addresses.

5. nmap [targets] -excludefile[file name]

Now what if the subnet was very big and there are more number of hosts to be excluded from the scan. The above option helps us to achieve this. Remember the file “alpha”( with four IP addresses) we created. Now let’s specify nmap to quit scanning the hosts listed in the file. Type command “nmap 10.10.10.0/29 -excludefile alpha”. We can see that nmap scanned only four hosts in the subnet.

6. nmap [target1 target2 target3]

This option specifies nmap to scan multiple targets separated by space. Type the command “nmap 10.10.10.1 10.10.10.2″. We can see the result below.

Hope this was helpful.

Hi everybody, today I’m gonna show you remote password cracking with Brutus. For the newbies, script kiddie is a person with little knowledge of hacking or any programming languages and instead searches for automatic tools to hack the computers. In this scenario, script kiddie is using a Windows XP machine and two tools Zenmap and Brutus available for free to download. As you will see, Zenmap is used for scanning for any open ports of live machines and Brutus is a password cracker.

Imagine I am the script kiddie, I first find out my own computer’s ip address by typing the command “ipconfig” in the command line.

The ip address of my system happens to be 10.10.10.1. I decide to scan the following range of ip addresses to look for any live hosts. In the target option, I specify IP address as 10.10.10.2-10 and I choose profile as intense scan to get maximum information about the target. After performing the scan, the results show that only one system 10.10.10.3 is alive.

The scan also shows that the victim machine which is LIVE is running a ftp server and its operating system is Windows XP.

I decide to use Brutus to crack the remote FTP password. Brutus has both dictionary and brute force attack options. I decide to choose dictionary attack since it is faster than brute forcing. Brutus comes with a built in username(users.txt) and password list(pass.txt).As the victim machine is running Windows XP which comes with a default administrator account, I decide to add “administrator” to the users.txt file.

I choose type as FTP since I am about to crack a FTP server.

Then I select the file pass.txt containing some common passwords and just hope to crack the password.

Then after starting the cracker, Brutus runs and gives one positive authentication result.

Username : administrator

Password: 123456

Then I try to log into the FTP server of the remote machine using CMD with the authentication result achieved above.

I successfully logged into the FTP server. Once I am into the remote machine I try some FTP commands but before that I change my local directory to Desktop.

Then I use DIR command to list the directories in the FTP server.

There are four directories in the FTP server:Detroit, Images:lena and users. I go to the users directory using command cd users and then list the files in the directory by using command ls. There is one text file named users.txt in the directory.

I decide to download the file users.txt to my machine using the command get users.txt. Since I had set my local directory to desktop it will be downloaded to Desktop.

Let’s see the contents of the users.txt file just downloaded. It contains some usernames and passwords.

In the same way, I enter into another directory of interest to me “Images” and download the only image present in it to my desktop.

In this way, I can download any number of files from the remote server to my local machine. That’s all for in password cracking with Brutus.