Nmap is typically used to scan corporate networks and conduct security audits, but it can also reveal useful information about your home systems and gadgets.
Nmap is my favorite tool when it comes to security testing. In 1997, Gordon Lyon, aka Fyodor, developed Nmap. The "network mapper," also known as Nmap, has long been used in corporate networks to gather data on servers and desktop computers. Information on the active systems and services is provided by the tool (i.e., open ports). Additionally, it can aid in locating malicious software and weaknesses. Nmap makes it simple to find both new systems and network changes. Common uses include:
Host discovery — IP address probing and providing details on the systems that respond
Port scanning — A list of the services that are accessible
Version detection — identifying applications and their versions
OS detection — identifying the operating system and a few hardware features
For more than 20 years, sysadmins have been installing nmap on Linux. Since its initial 1997 release, nmap has also been made available for Windows and other Unix variations. It is a free and open-source security scanner that is actually regarded as a standard security tool. It is frequently employed in corporate settings for system information gathering and security analysis.
But here's a smart suggestion. If you were to use the tool at home, what would you anticipate finding? The outcomes might be much more fascinating than you anticipate. What about your routers, cell phones, tablets, and other devices, even if you only have one to three home computers? What could you learn about them? What can be found out? Let's quickly look and find out.
In order to tell nmap that you only want a list of IP addresses, you can use a few options to perform the fastest nmap scan possible. Here's an example:
And you can change that command to read like this if you only want a list of IP addresses:
Only two systems are displaying host names in this scan: butterfly, which is the system running the scan, and _gateway (a name provided for the router). Since the majority of the systems you end up probing (and possibly the local system as well) use dynamically assigned IP addresses, you might notice that they change but can still get a general idea of what they are. Let's run one more probe.
The -sn qualifier will not be used in this probe; instead, we will look at the services that are currently running on each of these systems to learn more about them.
In this instance, the main router offers a website that, upon inspection, displays configuration details and a telnet connection that offers a number of commands. Of course, in order to connect and execute the commands, you need a login.
And yes, by executing the listed commands, you can request information from it:
It turns out that the 192.168.0.4 system is a Netgear device that provides a web connection. Once more, connecting requires a login name and password, but just like the router, we can see that our network devices are much more chatty than you might have thought. If you received the login information, it will affect how much information you can obtain from them.
It turned out that the addresses 192.168.0.27 and 192.168.0.29 belonged to my mobile devices. I do have two of them, yes. I also have a Ncell phone that functions when the NTC phone doesn't because I live in one of the few areas where NTC coverage is weak. You can see that both phones are detected by my scan. Although they don't provide any of the standard network connection services, they do respond to ping requests.
When I pointed my browser to 192.168.0.11:9080 (the glrpc port) for 192.168.0.11, it displayed "status=ok." It's possible that this thing is one of my network extenders, but I'll try to be more specific.
My dad's printer's 192.168.0.28 address is its IP address. My nmap report showed that I could connect using a browser (port 80 was open), so I did so. This opened a helpful report that showed me that the printer was "ready" and that each of its four toner cartridges still had some capacity.
I now have a better understanding of all the devices that connect to my home network and how I can chat with them when I want to know more about how they're working thanks to my browser and the command line on my Linux system :)
Happy hacking!