Nmap: Network Scanning — Panduan Lengkap

# =============================================
# Instalasi Nmap di Berbagai OS
# =============================================

# Linux (Debian/Ubuntu)
sudo apt update
sudo apt install nmap -y

# Linux (RHEL/CentOS/Fedora)
sudo dnf install nmap -y
# atau
sudo yum install nmap -y

# Linux (Arch)
sudo pacman -S nmap

# macOS (Homebrew)
brew install nmap

# Windows
# Download installer dari https://nmap.org/download.html
# atau gunakan Chocolatey:
choco install nmap

# Verifikasi instalasi
nmap --version
# Output: Nmap version 7.94 ( https://nmap.org )

# =============================================
# Nmap Zenmap (GUI) — Opsional
# =============================================
# Linux
sudo apt install zenmap -y

# macOS/Windows: Sudah termasuk dalam installer

# Syntax umum Nmap
nmap [scan type] [options] {target}

# =============================================
# Target Specification
# =============================================

# Scan satu host
nmap 192.168.1.1

# Scan berdasarkan hostname
nmap scanme.nmap.org

# Scan range IP
nmap 192.168.1.1-100        # 192.168.1.1 sampai 192.168.1.100

# Scan subnet (CIDR)
nmap 192.168.1.0/24          # Seluruh subnet /24

# Scan multiple target
nmap 192.168.1.1 192.168.1.2 192.168.1.3

# Scan dari file list
nmap -iL targets.txt

# Kecualikan host
nmap 192.168.1.0/24 --exclude 192.168.1.1
nmap 192.168.1.0/24 --excludefile exclude.txt

# =============================================
# Scan Semua Port
# =============================================

# Scan 1000 port default (cepat)
nmap 192.168.1.1

# Scan semua 65535 port (lambat tapi lengkap)
nmap -p- 192.168.1.1

# Scan port spesifik
nmap -p 22,80,443,8080 192.168.1.1

# Scan range port
nmap -p 1-1000 192.168.1.1

# Scan port terkenal (1-1024)
nmap -F 192.168.1.1

# Scan top 20 port paling umum
nmap --top-ports 20 192.168.1.1

# =============================================
# 1. TCP Connect Scan (-sT)
# Melengkapi 3-way handshake penuh
# Paling akurat tapi paling terdeteksi
# =============================================
sudo nmap -sT 192.168.1.1

# =============================================
# 2. SYN Scan / Half-Open Scan (-sS) — DEFAULT
# Mengirim SYN, menerima SYN/ACK → port open
# Tidak menyelesaikan handshake (lebih stealth)
# Memerlukan root/sudo
# =============================================
sudo nmap -sS 192.168.1.1

# =============================================
# 3. NULL Scan (-sN)
# Mengirim paket tanpa flag TCP
# Open port → tidak ada response
# Closed port → RST response
# =============================================
sudo nmap -sN 192.168.1.1

# =============================================
# 4. FIN Scan (-sF)
# Mengirim paket dengan flag FIN
# Mirip dengan NULL scan
# Bisa melewati beberapa firewall stateless
# =============================================
sudo nmap -sF 192.168.1.1

# =============================================
# 5. XMAS Scan (-sX)
# Mengirim paket dengan FIN, PSH, URG flags
# Dinamakan "XMAS" karena flags menyala seperti pohon Natal
# =============================================
sudo nmap -sX 192.168.1.1

# =============================================
# 6. ACK Scan (-sA)
# Menentukan apakah port difilter oleh firewall
# Bukan untuk menentukan open/closed
# Open/Closed → RST response
# Filtered → tidak ada response / ICMP error
# =============================================
sudo nmap -sA 192.168.1.1

# =============================================
# 7. Window Scan (-sW)
# Mirip ACK scan tapi memeriksa TCP window size
# Bisa membedakan open dan closed pada beberapa sistem
# =============================================
sudo nmap -sW 192.168.1.1

# =============================================
# 8. Maimon Scan (-sM)
# Mengirim FIN/ACK flag
# Dinamai penemunya: Uriel Maimon
# =============================================
sudo nmap -sM 192.168.1.1

# =============================================
# UDP Scan (-sU)
# UDP scanning LAMBAT karena tidak ada handshake
# Port terbuka → tidak ada response (atau aplikasi response)
# Port tertutup → ICMP Port Unreachable
# Filtered → ICMP unreachable diblokir (atau tidak ada)
# =============================================

# Scan port UDP tertentu
sudo nmap -sU -p 53,67,68,69,123,161,162,500,514,1900 192.168.1.1

# Scan top 100 port UDP
sudo nmap -sU --top-ports 100 192.168.1.1

# Kombinasi TCP + UDP scan
sudo nmap -sS -sU -p T:22,80,443,U:53,67,161 192.168.1.1

# =============================================
# Service yang Umum di Port UDP
# =============================================
# 53    - DNS
# 67/68 - DHCP
# 69    - TFTP
# 123   - NTP
# 161   - SNMP
# 162   - SNMP Trap
# 500   - IKE (IPSec)
# 514   - Syslog
# 1900  - UPnP/SSDP
# 5353  - mDNS

# =============================================
# Version Detection (-sV)
# Mengirim probe ke port terbuka untuk mengidentifikasi
# layanan dan versi yang tepat
# =============================================

# Version scan standar
sudo nmap -sV 192.168.1.1

# Output contoh:
# PORT    STATE SERVICE VERSION
# 22/tcp  open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1
# 80/tcp  open  http    Apache httpd 2.4.52
# 443/tcp open  ssl/http Apache httpd 2.4.52
# 3306/tcp open mysql  MySQL 8.0.32

# Version scan dengan intensity lebih tinggi (lebih lambat, lebih akurat)
sudo nmap -sV --version-intensity 9 192.168.1.1

# Version intensity levels:
# 0 = Light (cepat, kurang akurat)
# 1-7 = Normal range
# 8-9 = All probes (lambat, paling akurat)

# =============================================
# Aggressive Scan (-A)
# Mengaktifkan: OS detection, version detection,
# script scanning, dan traceroute
# =============================================
sudo nmap -A 192.168.1.1

# Setara dengan: nmap -sV -sC -O --traceroute 192.168.1.1

# =============================================
# Banner Grabbing Manual
# =============================================

# Grab banner dari port 22 (SSH)
echo "" | nc -w 3 192.168.1.1 22

# Grab banner dari port 80 (HTTP)
echo "HEAD / HTTP/1.0\r\n\r\n" | nc -w 3 192.168.1.1 80

# =============================================
# Contoh Output Service Detection
# =============================================
# PORT     STATE SERVICE     VERSION
# 21/tcp   open  ftp         vsftpd 3.0.3
# 22/tcp   open  ssh         OpenSSH 8.9p1 Ubuntu 3
# 25/tcp   open  smtp        Postfix smtpd
# 80/tcp   open  http        nginx 1.18.0
# 443/tcp  open  ssl/https   nginx 1.18.0
# 3306/tcp open  mysql       MySQL 8.0.32-0ubuntu0.22.04.2
# 5432/tcp open  postgresql  PostgreSQL 14.7
# 8080/tcp open  http-proxy  Squid http proxy 5.2
# 8443/tcp open  ssl/https   Jetty 11.0.13
# Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

# =============================================
# OS Detection (-O)
# Memerlukan root/sudo
# Membutuhkan minimal 1 port open dan 1 closed
# =============================================

# Basic OS detection
sudo nmap -O 192.168.1.1

# Contoh output:
# OS details: Linux 4.15 - 5.6
# Network Distance: 1 hop
# OS CPE: cpe:/o:linux:linux_kernel:4.15
# Aggressive OS guesses: Linux 4.15 (95%), Linux 5.0 (93%)

# OS detection dengan guess yang lebih agresif
sudo nmap -O --osscan-guess 192.168.1.1

# Limit detection ke 5 hasil terbaik
sudo nmap -O --max-os-tries 5 192.168.1.1

# Kombinasi lengkap: OS + Version + Scripts + Traceroute
sudo nmap -A 192.168.1.1

# =============================================
# TCP/IP Fingerprinting Detail
# =============================================
# Nmap menganalisis:
# 1. Initial Sequence Number (ISN) randomness
# 2. IP ID sequence generation
# 3. TCP initial window size
# 4. TCP options (order, values)
# 5. Don't Fragment (DF) bit
# 6. Initial TTL value
# 7. TCP timestamp behavior
# 8. SYN/ACK/RST response behavior

# =============================================
# Contoh Output Detail OS Detection
# =============================================
# Running: Linux 4.X|5.X (95%)
# OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
# OS details: Linux 4.15 - 5.6
# Uptime guess: 45.231 days (since Sun May 11 03:42:17 2026)
# Network Distance: 1 hop
# TCP Sequence Prediction: Difficulty 256 (Good luck!)
# IP ID Sequence Generation: All zeros

# =============================================
# Menggunakan NSE Scripts
# =============================================

# Jalankan script "default" (sama dengan -sC)
sudo nmap -sC 192.168.1.1
# Setara dengan: nmap --script=default 192.168.1.1

# Jalankan script spesifik
sudo nmap --script=http-title 192.168.1.1
sudo nmap --script=ssl-cert -p 443 192.168.1.1

# Jalankan beberapa script sekaligus
sudo nmap --script=http-title,http-headers,http-methods -p 80,443 192.168.1.1

# Jalankan semua script dalam kategori
sudo nmap --script=vuln 192.168.1.1
sudo nmap --script=safe 192.168.1.1
sudo nmap --script=discovery 192.168.1.1

# Jalankan semua script dalam beberapa kategori
sudo nmap --script="safe and vuln" 192.168.1.1

# Kecualikan script tertentu
sudo nmap --script="not dos" 192.168.1.1

# =============================================
# Contoh Script Penting untuk Security Audit
# =============================================

# SSL/TLS audit
sudo nmap -sV --script=ssl-enum-ciphers -p 443 192.168.1.1

# SMB vulnerability scan (EternalBlue, dll)
sudo nmap --script=smb-vuln* -p 445 192.168.1.1

# HTTP vulnerability scan
sudo nmap --script=http-vuln* -p 80,443,8080 192.168.1.1

# DNS enumeration
sudo nmap --script=dns-brute --script-args dns-brute.threads=10 example.com

# FTP anonymous login check
sudo nmap --script=ftp-anon -p 21 192.168.1.1

# SNMP enumeration
sudo nmap --script=snmp-brute,snmp-info -p 161 -sU 192.168.1.1

# MySQL enumeration
sudo nmap --script=mysql-info,mysql-enum -p 3306 192.168.1.1

# SSH audit
sudo nmap --script=ssh2-enum-algos,ssh-hostkey -p 22 192.168.1.1

# Vulners — cek CVE dari versi service yang terdeteksi
sudo nmap -sV --script=vulners 192.168.1.1

-- custom-http-check.nse
-- Script NSE untuk mengecek header keamanan HTTP

local http = require "http"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"

-- Metadata script
description = [[
Mengecek apakah web server memiliki security headers yang lengkap.
Digunakan untuk security audit konfigurasi web server.
]]

-- Kategorisasi
categories = {"safe", "discovery"}

-- Hanya jalankan pada port HTTP
portrule = shortport.http

-- Fungsi utama
action = function(host, port)
  local result = {}

  -- Kirim HTTP GET request
  local response = http.get(host, port, "/")

  if not response or not response.header then
    return "Tidak bisa mengakses web server"
  end

  -- Cek security headers
  local headers_to_check = {
    "Content-Security-Policy",
    "X-Frame-Options",
    "X-Content-Type-Options",
    "Strict-Transport-Security",
    "X-XSS-Protection",
    "Referrer-Policy",
    "Permissions-Policy"
  }

  for _, header_name in ipairs(headers_to_check) do
    local value = response.header[header_name:lower()]
    if value then
      table.insert(result, string.format("✅ %s: %s", header_name, value))
    else
      table.insert(result, string.format("❌ %s: TIDAK ADA", header_name))
    end
  end

  -- Cek server header (informasi disclosure)
  local server = response.header["server"]
  if server then
    table.insert(result, string.format("⚠️ Server: %s (info disclosure)", server))
  end

  -- Cek X-Powered-By header
  local powered = response.header["x-powered-by"]
  if powered then
    table.insert(result, string.format("⚠️ X-Powered-By: %s (info disclosure)", powered))
  end

  return stdnse.format_output(true, result)
end

-- Simpan di: /usr/share/nmap/scripts/custom-http-check.nse
-- Jalankan: nmap --script=custom-http-check -p 80,443 target
-- Update database: nmap --script-updatedb

# =============================================
# 1. Timing & Performance (-T)
# Mengontrol kecepatan scan untuk menghindari deteksi
# =============================================

# T0 - Paranoid (sangat lambat, untuk IDS evasion)
sudo nmap -T0 192.168.1.1

# T1 - Sneaky (lambat)
sudo nmap -T1 192.168.1.1

# T2 - Polite (lambat, kurangi bandwidth)
sudo nmap -T2 192.168.1.1

# T3 - Normal (default)
sudo nmap -T3 192.168.1.1

# T4 - Aggressive (cepat, untuk jaringan cepat)
sudo nmap -T4 192.168.1.1

# T5 - Insane (sangat cepat, akurasi berkurang)
sudo nmap -T5 192.168.1.1

# =============================================
# 2. Fragmentation (-f)
# Memecah paket menjadi fragmen kecil (8 byte)
# Bisa melewati beberapa packet filter/IDS
# =============================================
sudo nmap -f 192.168.1.1

# Fragmen dengan ukuran tertentu
sudo nmap -f --mtu 24 192.168.1.1

# =============================================
# 3. Spoof Source IP (-S)
# Mengirim paket dengan IP source palsu
# Perlu berada di network yang sama atau me-route
# =============================================
sudo nmap -S 10.0.0.100 -e eth0 192.168.1.1

# =============================================
# 4. Decoy Scan (-D)
# Mengirim scan dari banyak IP (termasuk IP palsu)
# IDS akan melihat traffic dari banyak sumber
# =============================================
sudo nmap -D RND:10 192.168.1.1    # 10 IP random decoy

# Tentukan decoy spesifik
sudo nmap -D 10.0.0.1,10.0.0.2,ME,10.0.0.3 192.168.1.1
# ME = IP asli Anda (posisikan di tengah)

# =============================================
# 5. Spoof MAC Address (--spoof-mac)
# Mengubah MAC address pada paket
# Hanya untuk Ethernet/WiFi
# =============================================
sudo nmap --spoof-mac 00:11:22:33:44:55 192.168.1.1
sudo nmap --spoof-mac Cisco 192.168.1.1     # Spoof sebagai Cisco
sudo nmap --spoof-mac 0 192.168.1.1          # Random MAC

# =============================================
# 6. Idle Scan (-sI) — Paling Stealth
# Menggunakan "zombie host" sebagai perantara
# Target hanya melihat traffic dari zombie, bukan Anda
# =============================================
sudo nmap -sI zombie_host:port 192.168.1.1
# Contoh: sudo nmap -sI 10.0.0.50:80 192.168.1.1

# =============================================
# 7. Source Port Manipulation (-g / --source-port)
# Mengirim dari port spesifik (misal 53/80)
# Firewall sering mengizinkan traffic dari port terkenal
# =============================================
sudo nmap -g 53 192.168.1.1     # DNS port
sudo nmap -g 80 192.168.1.1     # HTTP port
sudo nmap --source-port 443 192.168.1.1

# =============================================
# 8. Custom TTL (--ttl)
# Mengatur TTL untuk mengelabui deteksi
# =============================================
sudo nmap --ttl 128 192.168.1.1

# =============================================
# 9. Randomize Host Order (--randomize-hosts)
# Scan host dalam urutan acak untuk menghindari pattern
# =============================================
sudo nmap --randomize-hosts 192.168.1.0/24

# =============================================
# 10. Scan Delay (--scan-delay)
# Tambah delay antara probe
# =============================================
sudo nmap --scan-delay 5s 192.168.1.1
sudo nmap --max-rate 100 192.168.1.1   # Max 100 packets/detik

# =============================================
# Output Formats
# =============================================

# Normal output (ke layar, default)
sudo nmap 192.168.1.1

# Simpan ke file normal
sudo nmap -oN scan_result.txt 192.168.1.1

# XML output (untuk di-parse tool lain)
sudo nmap -oX scan_result.xml 192.168.1.1

# Grepable output (mudah di-grep/awk)
sudo nmap -oG scan_result.gnmap 192.168.1.1

# Simpan dalam SEMUA format sekaligus
sudo nmap -oA scan_result 192.168.1.1
# Menghasilkan: scan_result.nmap, scan_result.xml, scan_result.gnmap

# Script kiddie output (hanya untuk fun)
sudo nmap -oS scan_result.skid 192.168.1.1

# =============================================
# Verbosity & Debugging
# =============================================

# Increase verbosity (lebih banyak info di layar)
sudo nmap -v 192.168.1.1
sudo nmap -vv 192.168.1.1    # Lebih verbose
sudo nmap -vvv 192.168.1.1   # Sangat verbose

# Debug level
sudo nmap -d 192.168.1.1     # Debug level 1
sudo nmap -dd 192.168.1.1    # Debug level 2

# Reason (tampilkan alasan status port)
sudo nmap --reason 192.168.1.1

# Packet trace (tampilkan semua paket yang dikirim/diterima)
sudo nmap --packet-trace 192.168.1.1

# Open only (hanya tampilkan port open)
sudo nmap --open 192.168.1.1

# =============================================
# Contoh Scan Komprehensif
# =============================================

# Full comprehensive scan
sudo nmap -sS -sV -sC -O -A \
  -p- \
  --script=default,vuln \
  -T4 \
  --reason \
  --open \
  -oA full_scan_$(date +%Y%m%d) \
  192.168.1.0/24

# Penjelasan flags:
# -sS    = SYN scan (default, stealth)
# -sV    = Version detection
# -sC    = Default scripts
# -O     = OS detection
# -A     = Aggressive (OS + version + scripts + traceroute)
# -p-    = Scan semua 65535 port
# --script=default,vuln = Jalankan default + vuln scripts
# -T4    = Aggressive timing (cepat)
# --reason = Tampilkan alasan status port
# --open = Hanya tampilkan port terbuka
# -oA    = Simpan dalam semua format