Example 5-13. Running db_nmap
msf > db_nmap -sS -T
5
192.168.86.0/24
[
*
]
Nmap: Starting Nmap 7.60
(
https://nmap.org
)
at 2018-01-23 19:12 MST
[
*
]
Nmap: Warning: 192.168.86.31 giving up on port because
retransmission cap hit
(
2
)
.
[
*
]
Nmap: Warning: 192.168.86.218 giving up on port because retransmission cap hit
(
2
)
.
[
*
]
Nmap: Warning: 192.168.86.41 giving up on port because retransmission cap hit
(
2
)
.
[
*
]
Nmap: Warning: 192.168.86.44 giving up on port because retransmission cap hit
(
2
)
.
[
*
]
Nmap: Warning: 192.168.86.27 giving up on port because retransmission cap hit
(
2
)
.
[
*
]
Nmap: Warning: 192.168.86.26 giving up on port because retransmission cap hit
(
2
)
.
[
*
]
Nmap: Warning: 192.168.86.201 giving up on port because retransmission cap hit
(
2
)
.
[
*
]
Nmap:
Nmap scan report
for
testwifi.here
(
192.168.86.1
)
[
*
]
Nmap: Host is up
(
0.0080s latency
)
.
[
*
]
Nmap: Not shown:
995
closed ports
[
*
]
Nmap: PORT STATE SERVICE
[
*
]
Nmap: 53/tcp open domain
[
*
]
Nmap: 80/tcp
open http
[
*
]
Nmap: 5000/tcp open upnp
[
*
]
Nmap: 8080/tcp open http-proxy
[
*
]
Nmap: 8081/tcp open blackice-icecap
[
*
]
Nmap: MAC Address: 18:D6:C7:7D:F4:8A
(
Tp-link Technologies
)
Once
the port scanner is complete, all the hosts will be in the database. Additionally,
all of the services will be available to display as well. Looking at the hosts, you will get
the IP address,
MAC address, system name, and the operating system if it’s available.
To get the operating system, you need to have
nmap
run an operating system scan to
get that value. The MAC address is populated because I’m
running the scan on the
local network. If I were to run the scan remotely, the MAC address associated with
the IP address would be the router or gateway device on my local network.
When we are looking to exploit systems, though, we’re going to be looking for serv‐
ices that are listening on the network. We can get a list of the open ports by using
services
.
This is only a partial listing, but you can
see the open ports and the IP addresses for the services that are open. You’ll also see
some ports that are filtered, which suggests there may be a service on that port but
also a firewall blocking traffic to the port.
If you run a version scan, you’ll also get the
details about the service in the info column. You can see that two of the services listed
here have version information related to the service.
Example 5-14. Services results
msf > services
Services
========
host
port proto name state info
---- ---- ----- ---- ----- ----
