NMAP : Enumeration

To start learn hacking you are going to need these Operating system and tools. if you too good in programming then you may not need these tool, but for effective and quick response you are gonna need this setup.
As i list some tool in my previous blog the very first tool is Nmap. Nmap is 
a network security scanning tool, basically used for information gathering. you can collect all the essential information about the victim.like which operating system he/she is using.its freely available to everyone. its provides services like
1-Traceroute
2-Operating system detection
3-Detail expression of port scanning
4-Nmap scripting engine (it can check like wheather the proxy server can be accessed without password and many more things )
5-Packet tracing
6-Port scanning
7-Fragmanting
8-Ftp bounce
9-RPC and List scan
 ---------------------------------------------------------------------------------------------------------------------
A-Tcp Port Scanning
root@bt:~# nmap -sS 192.168.1.88

Starting Nmap 6.01 ( http://nmap.org ) at 2012-12-02 16:51 IST
Nmap scan report for 192.168.1.88
Host is up (0.00028s latency).
Not shown: 997 filtered ports
PORT     STATE SERVICE
902/tcp  open  iss-realsecure
912/tcp  open  apex-mesh
5357/tcp open  wsdapi
MAC Address: XX:XX:XX:XX:XX:XX (Intel) mac address of victim

Nmap done: 1 IP address (1 host up) scanned in 5.66 seconds.

we can use -sU to check for udp port that are opened. 

  nmap -sU 192.168.1.188
-----------------------------------------------------------------------------------------------------------------------
B-FIN packet scan 
root@bt:~# nmap -sF 192.168.1.88

Starting Nmap 6.01 ( http://nmap.org ) at 2012-12-02 16:57 IST
Nmap scan report for 192.168.1.88
Host is up (0.00017s latency).
All 1000 scanned ports on 192.168.1.88 are open|filtered
MAC Address: XX:XX:XX:XX:XX:XX
Nmap done: 1 IP address (1 host up) scanned in 21.15 secon 
---------------------------------------------------------------------------------------------------------------------
C-IP Protocol Scan

D-Version Detection

E-Idle Scanning

here we have an example of all the above
 ----------------------------------------------------------------------------------------------------------------
root@bt:~# nmap -sS -P0 -A -v 192.168.1.88

Starting Nmap 6.01 ( http://nmap.org ) at 2012-12-02 17:03 IST
NSE: Loaded 93 scripts for scanning.
NSE: Script Pre-scanning.
Initiating ARP Ping Scan at 17:03
Scanning 192.168.1.88 [1 port]
Completed ARP Ping Scan at 17:03, 0.00s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 17:03
Completed Parallel DNS resolution of 1 host. at 17:03, 0.00s elapsed
Initiating SYN Stealth Scan at 17:03
Scanning 192.168.1.88 [1000 ports]
Discovered open port 912/tcp on 192.168.1.88
Discovered open port 5357/tcp on 192.168.1.88
Discovered open port 902/tcp on 192.168.1.88
Completed SYN Stealth Scan at 17:03, 8.64s elapsed (1000 total ports)
Initiating Service scan at 17:03
Scanning 3 services on 192.168.1.88
Completed Service scan at 17:04, 11.02s elapsed (3 services on 1 host)
Initiating OS detection (try #1) against 192.168.1.88
NSE: Script scanning 192.168.1.88.
Initiating NSE at 17:04
Completed NSE at 17:04, 30.03s elapsed
Nmap scan report for 192.168.1.88
Host is up (0.00031s latency).
Not shown: 997 filtered ports
PORT     STATE SERVICE         VERSION
902/tcp  open  ssl/vmware-auth VMware Authentication Daemon 1.10 (Uses VNC, SOAP)
912/tcp  open  vmware-auth     VMware Authentication Daemon 1.0 (Uses VNC, SOAP)
5357/tcp open  http            Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-methods: No Allow or Public header in OPTIONS response (status code 503)
|_http-title: Service UnavailableMAC Address: XX:XX:XX:XX:XX:XX (Intel)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows 2008|7|Vista
OS CPE: cpe:/o:microsoft:windows_server_2008::beta3 cpe:/o:microsoft:windows_7::professional cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1
OS details: Microsoft Windows Server 2008 Beta 3, Microsoft Windows 7 Professional, Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7, Microsoft Windows Vista SP2 or Windows Server 2008
Uptime guess: 0.121 days (since Sun Dec  2 14:10:12 2012)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=260 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

TRACEROUTE
HOP RTT     ADDRESS
1   0.31 ms 192.168.1.88

NSE: Script Post-scanning.
Read data files from: /usr/local/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 53.00 seconds
           Raw packets sent: 2041 (92.356KB) | Rcvd: 11 (568B
-------------------------------------------------------------------------------------------------------------------------- 
             Trace-route example

nmap –packet-trace -p80 dmiessler.com
 SENT (0.1160s) TCP 204.11.219.126:40117 > 204.11.219.126:80 S ttl=40
     id=52313 iplen=44  seq=2829670227 win=1024
RCVD (0.1160s) TCP 204.11.219.126:40117 > 204.11.219.126:80 S ttl=40
     id=52313 iplen=44  seq=2829670227 win=1024
RCVD (0.1160s) TCP 204.11.219.126:80 > 204.11.219.126:40117 SA ttl=64
     id=0 iplen=44  seq=2909000595 win=32792 ack=2829670228
Interesting ports on dmiessler.com (204.11.219.126):
PORT   STATE SERVICE
80/tcp open  http



Nmap done: 1 IP address (1 host up) scanned in 0.13 second
   --------------------------------------------------------------------------------------------------------------------------
           Guys as we know the most important part of hacking is to gather information about the information about the victim.using nmap we can gather all possible information about the victim computer.