Nmap_Scan_Analysis.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# **Network Scanning and Security Assessment with Nmap**\n",
    "### **Introduction**\n",
    "In this project, I explore **Nmap (Network Mapper)**, a powerful open-source network scanning tool used by cybersecurity professionals, network administrators, and ethical hackers. The primary objective of this project is to conduct a comprehensive **network reconnaissance scan**, analyze the discovered devices and services, and assess potential security implications.\n",
    "\n",
    "### **Objectives of This Project**\n",
    "By the end of this project, I will have:\n",
    "1️⃣ **Installed and used Nmap** to scan a local network.  \n",
    "2️⃣ **Identified active devices**, their IP addresses, and open ports.  \n",
    "3️⃣ **Analyzed running services and potential security risks** associated with open ports.  \n",
    "4️⃣ **Understood how subnet scanning works** using CIDR notation.  \n",
    "5️⃣ **Explored advanced scanning techniques** and how Nmap can be used for vulnerability detection and automation.\n",
    "\n",
    "### **Why Is This Project Important?**\n",
    "🔹 **Security Assessment:** Understanding which devices and services are exposed on a network is crucial for **identifying vulnerabilities**.  \n",
    "🔹 **Penetration Testing Preparation:** Learning how attackers might perform reconnaissance helps in **hardening defenses**.  \n",
    "🔹 **Practical Cybersecurity Experience:** Hands-on experience with **real-world tools like Nmap** strengthens network security skills.  \n",
    "🔹 **Automated Network Monitoring:** Nmap can be used in **scripts to regularly monitor a network** for unexpected changes.\n",
    "\n",
    "### **Scope of the Project**\n",
    "This project will cover:\n",
    "✔ **A full subnet scan** (`192.168.1.0/24`) to identify all connected devices.  \n",
    "✔ **Analysis of open ports**, services, and potential vulnerabilities.  \n",
    "✔ **Security recommendations** based on findings.  \n",
    "✔ **Further exploration** of Nmap’s capabilities, including stealth scanning and automation with Python.\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Command Executed**\n",
    "\n",
    "nmap -A 192.168.1.0/24\n",
    "🔹 Performs an aggressive scan (-A) on all devices in the 192.168.1.x subnet (up to 256 IPs).\n",
    "🔹 Identifies open ports, services, operating systems, and device details.\n",
    "\n",
    "**🔍 General Information at the Start**\n",
    "\n",
    "Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-27 14:50 PST\n",
    "✔ Nmap version: 7.95\n",
    "✔ Website: https://nmap.org\n",
    "✔ Scan start time: 2025-02-27 at 14:50 PST\n",
    "\n",
    "**📌 Device 1: iPhone.attlocal.net (192.168.1.78)**\n",
    "\n",
    "Nmap scan report for iPhone.attlocal.net (192.168.1.78)\n",
    "Host is up (0.010s latency).\n",
    "✔ Device Name: iPhone\n",
    "✔ IP Address: 192.168.1.78\n",
    "✔ Host is online: ✅ (0.010 seconds response time)\n",
    "\n",
    "Not shown: 999 closed tcp ports (conn-refused)\n",
    "PORT      STATE SERVICE    VERSION\n",
    "62078/tcp open  tcpwrapped\n",
    "✔ 999 ports are closed (rejected connection attempts).\n",
    "✔ One open port:\n",
    "\n",
    "Port 62078/tcp → Marked as tcpwrapped\n",
    "🔹 \"tcpwrapped\" means the service requires authentication, so Nmap couldn’t detect more details.\n",
    "\n",
    "\n",
    "**📌 Device 2: unknown38b8008eb820.attlocal.net (192.168.1.85)**\n",
    "\n",
    "Nmap scan report for unknown38b8008eb820.attlocal.net (192.168.1.85)\n",
    "Host is up (0.0065s latency).\n",
    "✔ Device name unknown (not resolved).\n",
    "✔ IP Address: 192.168.1.85\n",
    "✔ Host is online: ✅ (0.0065s response time)\n",
    "\n",
    "Not shown: 994 closed tcp ports (conn-refused)\n",
    "✔ 994 ports closed, but 6 ports open:\n",
    "\n",
    "🚪 Open Ports and Services\n",
    "\n",
    "80/tcp   open  http            nginx\n",
    "|_http-title: 404 Not Found\n",
    "Port 80 = HTTP Web Server\n",
    "Service: nginx (a lightweight web server)\n",
    "404 Not Found = Web server is running but not hosting a page.\n",
    "\n",
    "7000/tcp open  rtsp            AirTunes rtspd 377.40.00\n",
    "|_irc-info: Unable to open connection\n",
    "|_rtsp-methods: ERROR: Script execution failed (use -d to debug)\n",
    "Port 7000 = RTSP (Real-Time Streaming Protocol)\n",
    "Used for streaming audio/video (AirTunes/Apple Music streaming).\n",
    "Error: Couldn’t retrieve all details.\n",
    "\n",
    "8008/tcp open  http?\n",
    "|_http-title: Site doesn't have a title.\n",
    "Port 8008 = HTTP service (possibly Chromecast or Google Home-related).\n",
    "\n",
    "8009/tcp open  ssl/castv2      Ninja Sphere Chromecast driver\n",
    "|_ssl-date: TLS randomness does not represent time\n",
    "Port 8009 = Chromecast communication\n",
    "TLS issue: Certificate doesn’t match a valid date.\n",
    "\n",
    "8443/tcp open  ssl/https-alt?\n",
    "|_http-title: Site doesn't have a title.\n",
    "Port 8443 = HTTPS alternative port\n",
    "🔹 Likely an encrypted web service.\n",
    "\n",
    "9000/tcp open  ssl/cslistener?\n",
    "Port 9000 = Unknown service (cslistener?).\n",
    "\n",
    "\n",
    "**📌 Device 3: Nest-Audio.attlocal.net (192.168.1.95)**\n",
    "\n",
    "Nmap scan report for Nest-Audio.attlocal.net (192.168.1.95)\n",
    "Host is up (0.0069s latency).\n",
    "✔ Device: Google Nest Audio\n",
    "✔ IP Address: 192.168.1.95\n",
    "✔ Host is online: ✅ (0.0069s response time)\n",
    "\n",
    "\n",
    "Not shown: 994 closed tcp ports (conn-refused)\n",
    "✔ 994 closed ports\n",
    "✔ 6 open ports:\n",
    "\n",
    "🚪 Open Ports and Services\n",
    "\n",
    "8008/tcp  open  http?\n",
    "|_http-title: Site doesn't have a title.\n",
    "Port 8008 = Likely Google Home Web Interface\n",
    "\n",
    "8009/tcp  open  ssl/ajp13?\n",
    "| ssl-cert: Subject: commonName=11798fb2-fce0-f921-f25a-8534fc8d7616\n",
    "| Not valid before: 2025-02-27T10:53:44\n",
    "|_Not valid after:  2025-03-01T10:53:44\n",
    "Port 8009 = Google Home communication.\n",
    "SSL certificate only valid for a few days.\n",
    "\n",
    "8443/tcp  open  ssl/https-alt?\n",
    "Port 8443 = Encrypted HTTPS service.\n",
    "\n",
    "9000/tcp  open  ssl/cslistener?\n",
    "10001/tcp open  ssl/scp-config?\n",
    "10002/tcp open  documentum?\n",
    "Unknown services, possibly IoT-related.\n",
    "\n",
    "\n",
    "**📌 Device 4: Stevens-Laptop.attlocal.net (192.168.1.148)**\n",
    "\n",
    "Nmap scan report for Stevens-Laptop.attlocal.net (192.168.1.148)\n",
    "Host is up (0.00014s latency).\n",
    "✔ Device: Your MacBook\n",
    "✔ IP Address: 192.168.1.148\n",
    "✔ Host is online: ✅ (0.00014s response time)\n",
    "\n",
    "\n",
    "Not shown: 996 closed tcp ports (conn-refused)\n",
    "PORT     STATE SERVICE    VERSION\n",
    "✔ 996 closed ports\n",
    "✔ 4 open ports:\n",
    "\n",
    "🚪 Open Ports and Services\n",
    "\n",
    "88/tcp   open  tcpwrapped\n",
    "Port 88 = Usually Kerberos authentication.\n",
    "\n",
    "5000/tcp open  rtsp       AirTunes rtspd 775.3.1\n",
    "Port 5000 = Apple’s streaming service.\n",
    "\n",
    "5900/tcp open  vnc        Apple remote desktop vnc\n",
    "| vnc-info: \n",
    "|   Protocol version: 3.889\n",
    "|   Security types: \n",
    "|     Apple Remote Desktop (30)\n",
    "|     Unknown security type (33)\n",
    "|     Unknown security type (36)\n",
    "|_    Mac OS X security type (35)\n",
    "Port 5900 = VNC (Virtual Network Computing)\n",
    "🔹 Remote desktop sharing is enabled.\n",
    "\n",
    "7000/tcp open  rtsp       AirTunes rtspd 775.3.1\n",
    "Port 7000 = Apple AirTunes streaming.\n",
    "\n",
    "\n",
    "**📌 Device 5: dsldevice.attlocal.net (192.168.1.254) (Router)**\n",
    "\n",
    "Nmap scan report for dsldevice.attlocal.net (192.168.1.254)\n",
    "Host is up (0.0039s latency).\n",
    "✔ Device: Your Router (Arris Group, Inc.)\n",
    "✔ IP Address: 192.168.1.254\n",
    "\n",
    "\n",
    "PORT    STATE    SERVICE  VERSION\n",
    "53/tcp  open     domain   dnsmasq 2.89\n",
    "Port 53 = DNS service for resolving domain names.\n",
    "\n",
    "80/tcp  open     http     lighttpd 1.4.69\n",
    "| http-title: Status\n",
    "Port 80 = Router’s web interface.\n",
    "\n",
    "443/tcp open     ssl/http lighttpd 1.4.69\n",
    "Port 443 = HTTPS web interface."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### **Section 1: Introduction to Nmap**\n",
    "What is Nmap?\n",
    "Nmap (Network Mapper) is an open-source network scanning tool used for discovering devices, scanning ports, and identifying services running on hosts. It is widely used by cybersecurity professionals, network administrators, and ethical hackers to map networks and assess security.\n",
    "\n",
    "####. **🔹 What Can Nmap Do?**\n",
    "Host Discovery: Find devices that are active on a network.\n",
    "Port Scanning: Identify open ports on devices.\n",
    "Service and Version Detection: Determine which services are running on open ports.\n",
    "OS Detection: Guess the operating system of a device.\n",
    "Vulnerability Scanning: Identify weak spots in a network.\n",
    "\n",
    "\n",
    "**🔹 Why is Nmap Important?**\n",
    "Helps assess network security by revealing open ports and services.\n",
    "Aids in penetration testing by identifying potential vulnerabilities.\n",
    "Allows network monitoring by mapping network devices and their activity.\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "#### **Section 2: Using Nmap in This Project**\n",
    "Project Objective:\n",
    "In this project, I used Nmap to scan a local network (192.168.1.0/24) to: \n",
    "1️⃣ Identify active devices on the network.\n",
    "2️⃣ Detect open ports and services running on these devices.\n",
    "3️⃣ Analyze the security implications of these findings.\n",
    "\n",
    "**Nmap Command Used:**\n",
    "nmap -A 192.168.1.0/24\n",
    "\n",
    "**🔹 What This Command Does**\n",
    "1️⃣ nmap\n",
    "This is the base command that runs Nmap, the network scanning tool.\n",
    "2️⃣ -A (Aggressive Scan Mode)\n",
    "Enables advanced scanning features, including:\n",
    "OS Detection: Tries to determine the operating system of the target.\n",
    "Service Version Detection: Identifies software running on open ports.\n",
    "Script Scanning: Runs some of Nmap's NSE (Nmap Scripting Engine) scripts to gather additional information.\n",
    "Traceroute: Maps the network path to the target device.\n",
    "3️⃣ 192.168.1.0/24 (Subnet to Scan)\n",
    "This specifies the network range to be scanned.\n",
    "/24 CIDR Notation means:\n",
    "Scans all 256 IP addresses in the 192.168.1.x range (from 192.168.1.0 to 192.168.1.255).\n",
    "Common in home and small office networks.\n",
    "\n",
    "What Does /24 Mean in CIDR Notation?\n",
    "In IPv4 addressing, an address consists of 32 bits, divided into four 8-bit octets:\n",
    "\n",
    "Example: 192.168.1.0 → Binary Representation\n",
    "\n",
    "192   .   168   .   1   .   0\n",
    "11000000 . 10101000 . 00000001 . 00000000\n",
    "The /24 means that 24 bits are dedicated to the network portion, and the remaining 8 bits are available for host addresses.\n",
    "\n",
    "192.168.1.0/24\n",
    "First 24 bits (network portion): 192.168.1\n",
    "Last 8 bits (host portion): 0 to 255\n",
    "Thus, this notation defines the entire range from 192.168.1.0 to 192.168.1.255, meaning: ✅ 256 total addresses (2⁸ = 256)\n",
    "✅ First address (192.168.1.0) is the network ID (not assignable to a host)\n",
    "✅ Last address (192.168.1.255) is the broadcast address (used for sending data to all devices on the subnet)\n",
    "✅ Usable host IPs: 192.168.1.1 to 192.168.1.254 (254 available hosts)\n",
    "\n",
    "🔹 Why is /24 Common in Home & Small Office Networks?\n",
    "Allows for 254 usable hosts, which is enough for most home and small business networks.\n",
    "Easy to manage—most consumer routers automatically assign IPs in this range.\n",
    "Ensures proper segmentation—separates devices from the larger internet while allowing LAN communication.\n",
    "\n",
    "🔹 Other Subnet Examples\n",
    "CIDR Notation\tSubnet Mask\t        Total IPs\t        Usable Hosts\tExample Network Range\n",
    "/30\t             255.255.255.252\t4\t                2\t            192.168.1.0 - 192.168.1.3\n",
    "/29\t             255.255.255.248\t8\t                6\t            192.168.1.0 - 192.168.1.7\n",
    "/28\t             255.255.255.240\t16\t                14\t            192.168.1.0 - 192.168.1.15\n",
    "/27\t             255.255.255.224\t32\t                30\t            192.168.1.0 - 192.168.1.31\n",
    "/24\t             255.255.255.0\t    256\t                254\t            192.168.1.0 - 192.168.1.255\n",
    "/16\t             255.255.0.0\t    65,536\t            65,534\t        192.168.0.0 - 192.168.255.255\n",
    "/8\t             255.0.0.0\t1       6.7 million\t        16.7 million\t10.0.0.0 - 10.255.255.255\n",
    "📌 Summary\n",
    "✅ CIDR Notation (/24) means the first 24 bits are reserved for the network and the last 8 bits are for hosts.\n",
    "✅ 192.168.1.0/24 scans 256 total IPs (192.168.1.0 - 192.168.1.255).\n",
    "✅ Common in home and small office networks because it allows for 254 usable host addresses.\n",
    "✅ Understanding CIDR and subnet masks is essential for networking and cybersecurity roles.\n",
    "\n",
    "\n",
    "\n",
    "**📌 Section 3: Results & Interpretation**\n",
    "The scan revealed 6 active devices on the network. Below is a summary:\n",
    "\n",
    "Device\t             IP Address\t           Open Ports\t                      Services Detected\n",
    "\n",
    "iPhone\t             192.168.1.78\t        62078\t                           Apple sync service (tcp wrapped)\n",
    "Google Chromecast\t 192.168.1.85\t        80, 7000, 8008, 8009, 8443, 9000   HTTP, SSL, Chromecast services\n",
    "Google Nest Audio\t 192.168.1.95\t        8008, 8009, 8443, 9000\t           Chromecast services\n",
    "My MacBook\t         192.168.1.148\t        88, 5000, 5900, 7000\t           Apple Remote Desktop (VNC), AirTunes\n",
    "Unknown Device\t     192.168.1.180\t        No open ports\t                   Possible firewall or offline\n",
    "Router (DSL Modem)\t 192.168.1.254\t        53, 80, 443\tDNS                    Web Admin Panel, HTTPS\n",
    "\n",
    "\n",
    "**🔍 Key Findings**\n",
    "\n",
    "⚠️ Open VNC Port (5900) on MacBook:\n",
    "Risk: Allows remote access to the system.\n",
    "Solution: Disable Remote Management in System Settings > Sharing unless needed.\n",
    "\n",
    "⚠️ Router’s Open Web Admin Panel (80, 443)\n",
    "Risk: If default credentials are weak, the router can be accessed.\n",
    "Solution: Log in to https://192.168.1.254 and ensure strong passwords & firmware updates are in place.\n",
    "\n",
    "\n",
    "\n",
    "📌 Section 4: Where to Go Next with Nmap?\n",
    "Now that I have basic network reconnaissance data, I can expand my cybersecurity lab with new Nmap-based projects.\n",
    "\n",
    "🔹 Other Nmap Use Cases for Future Labs\n",
    "1 Deep Scan a Specific Device\n",
    "Now that we know our MacBook has open VNC ports, we can scan only our MacBook for a more detailed vulnerability assessment:\n",
    "\n",
    "\n",
    "nmap -p- -A 192.168.1.148\n",
    "-p-: Scans all 65,535 ports (instead of just common ones).\n",
    "-A: Enables OS and service detection.\n",
    "\n",
    "\n",
    "2️⃣ Running a Stealth Scan to Avoid Detection\n",
    "In real-world penetration testing, attackers often use stealthy scans to avoid detection by firewalls.\n",
    "We can use Nmap’s \"SYN Scan\":\n",
    "\n",
    "\n",
    "nmap -sS -A 192.168.1.148\n",
    "-sS: Performs a stealth SYN scan instead of a full connection scan.\n",
    "Why? This scan is less detectable by intrusion detection systems (IDS).\n",
    "\n",
    "\n",
    "3️⃣ Checking for Vulnerable Services with Nmap Scripting Engine (NSE)\n",
    "Nmap has built-in vulnerability scripts.\n",
    "For example, we can scan for vulnerabilities in HTTP services:\n",
    "\n",
    "\n",
    "nmap --script vuln -p 80,443 192.168.1.254\n",
    "--script vuln: Runs vulnerability checks against ports 80 (HTTP) and 443 (HTTPS).\n",
    "\n",
    "\n",
    "4️⃣ Automating Scans with a Python Script\n",
    "To automate network scanning, we can write a simple Python script to run Nmap:\n",
    "\n",
    "\n",
    "import nmap\n",
    "\n",
    "scanner = nmap.PortScanner()\n",
    "ip_target = \"192.168.1.0/24\"\n",
    "\n",
    "print(f\"Scanning network {ip_target}...\")\n",
    "scanner.scan(hosts=ip_target, arguments=\"-A\")\n",
    "\n",
    "for host in scanner.all_hosts():\n",
    "    print(f\"\\nHost: {host} ({scanner[host].hostname()})\")\n",
    "    print(f\"State: {scanner[host].state()}\")\n",
    "\n",
    "    for proto in scanner[host].all_protocols():\n",
    "        print(f\"Protocol: {proto}\")\n",
    "        ports = scanner[host][proto].keys()\n",
    "        for port in ports:\n",
    "            print(f\"Port: {port} | State: {scanner[host][proto][port]['state']}\")\n",
    "Uses the Nmap Python library (python-nmap).\n",
    "Automates scanning entire subnets.\n",
    "\n",
    "\n",
    "**📌 Section 5: Conclusion:**\n",
    "\n",
    "Learned about Nmap and its capabilities.\n",
    "Ran a network scan on a local network.\n",
    "Interpreted the results and identified security risks.\n",
    "Explored ways to expand our cybersecurity labs."
   ]
  }
 ],
 "metadata": {
  "language_info": {
   "name": "python"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}