nmap - network range enumeration

• Host Discovery | Nmap Network Scanning

cat << 'EOF' > network_enum.sh
#!/bin/bash
nmap -sn 10.10.1.0/24 -oG - | awk '/Up$/{print $2}' > live_hosts.txt
nmap -sV -iL live_hosts.txt -oA service_scan
nmap -O -iL live_hosts.txt -oA os_scan
nmap -p- -iL live_hosts.txt -oA full_port_scan
EOF

chmod +x network_enum.sh && ./network_enum.sh

nmap -sn -PE 192.168.60.130

nmap -sn -PE 10.10.1.2-23

-sn

The default host discovery done with -sn consists of an ICMP Echo request, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request by default. When executed by an unprivileged user, only SYN packets are sent (using a connect call) to ports 80 and 443 on the target. When a privileged user tries to scan targets on a local ethernet network, ARP requests are used unless --send-ip was specified. The -sn option can be combined with any of the discovery probe types (the -P* options) for greater flexibility. If any of those probe type and port number options are used, the default probes are overridden. When strict firewalls are in place between the source host running Nmap and the target network, using those advanced techniques is recommended. Otherwise hosts could be missed when the firewall drops probes or their responses.