This the priliminary phase of newtork pentest where information about hosts, the services that the hosts are running, network mapping, etc are done. The main things to do are:

  1. Map out the network.
  2. Identify possible targets.
  3. Identify the services running on those targets.

Discovering the Hosts

  • Using ICMP protocol – pingsweep
$ nmap -sn 192.168.1.1/24 -oA output/

  • If ICMP traffic is blocked in the internal network, scanning of common ports can be done.
$ nmap -Pn -n -p 22,80,443,2222 192.168.1.1/24 -oA output/

  • Making the scan faster
$ nmap -Pn -n -p 22,80,443,2222 192.168.1.1/24 --min-hostgroup 256 --min-rate 1280 -oA output/

Discovering services

  • Banner grab with port scan 
$ nmap -Pn -n 192.168.1.1/24 -p 0-65535 -sV -A -oA <folder>  --min-rate 50000 --min-hostgroup 22
Flags:
sV: Probe open ports to determine service/version info
A: Enable OS detection, version detection..