nmap

Run nmap scans with the given parameters.

Network Security · Nmap

Details

IDnmap
ProviderOpen Source
CategoryNetwork Security
From Version5.0.0
Docker Imagedemisto/netutils:1.0.0.10187688
Supported ModulesAgentix XSIAM

README

Run nmap scans with the given parameters.
This integration was integrated and tested with version 7.70 of nmap. The nmap binary is shipped with the integration Docker. You can see the options available for running an nmap scan here: https://nmap.org/book/man-briefoptions.html. Some scan options require root access for using raw packet scanning techniques. See here for detailed scanning techniques. If you’ve configured the server to run Docker images with a non-root internal user and you want to use raw packet scanning (for example via the -sS option for SYN/ACK scan), make sure to exclude the demisto/nmap Docker image as documented For Cortex XSOAR 6 here. For Cortex XSOAR 8 Cloud here. For Cortex XSOAR 8.7 On-prem here.

Configure nmap in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

nmap-scan

Scan targets with the given parameters.

Base Command

nmap-scan

Input

Argument Name Description Required
targets The targets to scan. Accepts comma-separated list. Required
options The nmap options to use as documented by nmap. Required

Context Output

Path Type Description
NMAP.Scan.Summary unknown Scan summary.
NMAP.Scan.Version unknown nmap version.
NMAP.Scan.Started unknown Start time epoch.
NMAP.Scan.Ended unknown End time epoch.
NMAP.Scan.CommandLine unknown The command line being used.
NMAP.Scan.ScanType unknown The type of discovery scan.
NMAP.Scan.Hosts.Hostname unknown DNS hostname of scanned host.
NMAP.Scan.Hosts.Address unknown Scanned host address.
NMAP.Scan.Hosts.Status unknown Is the host up or down.
NMAP.Scan.Hosts.Services.Port unknown The port of the service.
NMAP.Scan.Hosts.Services.Protocol unknown The protocol of the service.
NMAP.Scan.Hosts.Services.State unknown The state of the service.
NMAP.Scan.Hosts.Services.Banner unknown Any captured banner from the service.
NMAP.Scan.Hosts.Services.Service unknown The service name.
NMAP.Scan.Hosts.ScriptResults.ID unknown The name of the script used.
NMAP.Scan.Hosts.ScriptResults.Output unknown The raw results of the script execution.
NMAP.Scan.Hosts.ScriptResults.Elements unknown Additional parseable fields from the script output.

Command Example

!nmap-scan options="-sV" targets=scanme.nmap.org

Context Example

{
    "NMAP": {
        "Scan": {
            "CommandLine": "/usr/bin/nmap -oX - -vvv --stats-every 1s -sV scanme.nmap.org",
            "Ended": 1588340465,
            "Hosts": [
                {
                    "Address": "45.33.32.156",
                    "Hostname": "scanme.nmap.org",
                    "Services": [
                        {
                            "Banner": "",
                            "Port": 21,
                            "Protocol": "tcp",
                            "Service": "tcpwrapped",
                            "State": "open"
                        },
                        {
                            "Banner": "product: OpenSSH version: 6.6.1p1 Ubuntu 2ubuntu2.13 extrainfo: Ubuntu Linux; protocol 2.0 ostype: Linux",
                            "Port": 22,
                            "Protocol": "tcp",
                            "Service": "ssh",
                            "State": "open"
                        },
                        {
                            "Banner": "product: Apache httpd version: 2.4.7 extrainfo: (Ubuntu)",
                            "Port": 80,
                            "Protocol": "tcp",
                            "Service": "http",
                            "State": "open"
                        },
                        {
                            "Banner": "",
                            "Port": 1723,
                            "Protocol": "tcp",
                            "Service": "tcpwrapped",
                            "State": "open"
                        },
                        {
                            "Banner": "",
                            "Port": 5060,
                            "Protocol": "tcp",
                            "Service": "sip",
                            "State": "open"
                        },
                        {
                            "Banner": "product: Nping echo",
                            "Port": 9929,
                            "Protocol": "tcp",
                            "Service": "nping-echo",
                            "State": "open"
                        },
                        {
                            "Banner": "",
                            "Port": 31337,
                            "Protocol": "tcp",
                            "Service": "tcpwrapped",
                            "State": "open"
                        }
                    ],
                    "Status": "up"
                }
            ],
            "ScanType": "connect",
            "Started": 1588340281,
            "Summary": "Nmap done at Fri May  1 13:41:05 2020; 1 IP address (1 host up) scanned in 183.98 seconds",
            "Version": "7.70"
        }
    }
}

Human Readable Output

Nmap done at Fri May 1 13:41:05 2020; 1 IP address (1 host up) scanned in 183.98 seconds

Nmap scan report for scanme.nmap.org (45.33.32.156)

Host is up

Services

Port Protocol State Service Banner
21 tcp open tcpwrapped  
22 tcp open ssh product: OpenSSH version: 6.6.1p1 Ubuntu 2ubuntu2.13 extrainfo: Ubuntu Linux; protocol 2.0 ostype: Linux
80 tcp open http product: Apache httpd version: 2.4.7 extrainfo: (Ubuntu)
1723 tcp open tcpwrapped  
5060 tcp open sip  
9929 tcp open nping-echo product: Nping echo
31337 tcp open tcpwrapped  

Commands (1)

  • nmap-scan

    Scan targets with the given parameters.

Source

Nmap.py Nmap.yml Nmap_description.md command_examples.txt
Download History Raw 
import demistomock as demisto
from CommonServerPython import *
from libnmap.parser import NmapParser
from libnmap.process import NmapProcess
from libnmap.reportjson import ReportEncoder

if demisto.command() == "test-module":
    demisto.results("ok")
    sys.exit(0)
if demisto.command() == "nmap-scan":
    nm = NmapProcess(argToList(demisto.args()["targets"]), options=demisto.args()["options"])
    rc = nm.run()
    if rc != 0:
        demisto.results(
            {"Type": entryTypes["error"], "ContentsFormat": formats["text"], "Contents": "Unable to execute - " + nm.stderr}
        )
        sys.exit(0)
    r = NmapParser.parse(nm.stdout)
    md = "## " + r.summary + "\n"
    hosts = []

    try:
        scan_type = r.scan_type

    except KeyError:
        scan_type = None

    for host in r.hosts:
        h = {}
        if len(host.hostnames):
            tmp_host = host.hostnames.pop()
            h["Hostname"] = tmp_host
        else:
            tmp_host = host.address

        h["Address"] = host.address
        h["Status"] = host.status
        svc = []
        md += f"### Nmap scan report for {tmp_host}" + (f" ({host.address})\n" if tmp_host != host.address else "\n")
        md += f"#### Host is {host.status}.\n"
        for serv in host.services:
            svc.append(
                {
                    "Port": serv.port,
                    "Protocol": serv.protocol,
                    "State": serv.state,
                    "Service": serv.service,
                    "Banner": serv.banner,
                }
            )
        extras = []
        for hostscript in host._extras.get("hostscript", []):
            extras.append(
                {
                    "ID": hostscript.get("id"),
                    "Output": hostscript.get("output"),
                    "Elements": hostscript.get("elements"),
                }
            )
        md += tableToMarkdown("Services", svc, ["Port", "Protocol", "State", "Service", "Banner"])
        md += tableToMarkdown("Script Results", extras, ["ID", "Output", "Elements"])
        h["Services"] = svc
        h["ScriptResults"] = extras
        hosts.append(h)
    scan = {
        "Summary": r.summary,
        "Version": r.version,
        "Started": r.started,
        "Ended": r.endtime,
        "CommandLine": r.commandline,
        "ScanType": scan_type,
        "Hosts": hosts,
    }
    demisto.results(
        {
            "ContentsFormat": formats["json"],
            "Type": entryTypes["note"],
            "Contents": json.dumps(r, cls=ReportEncoder),
            "HumanReadable": md,
            "EntryContext": {"NMAP.Scan": scan},
        }
    )