Skip to main content

Nmap

Nmap logo

License Apache-2.0GitHub release (latest SemVer)OWASP Incubator ProjectArtifact HUBGitHub Repo starsTwitter Follower

What is NMAP?#

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.

To learn more about the Nmap scanner itself visit nmap.org.

NSE scripts#

Currently, the secureCodeBox Nmap parser supports the smb-protocols, ftp-anon, and ftp-banner script with compatibility for hostrules and portrules. If you want custom scripts to be parsed by secureCodeBox, you may contribute your script parser in parser/parser.js under const scriptParser

const scriptParser = {  "ftp-anon": parseFtpAnon,  "banner": parseBanner,  "smb-protocols": parseSmbProtocols,  [...] // Contributed custom parsers}

Scripts without an existing parser will only generate an open port finding. Scripts with parsers will add a script output finding.

Deployment#

The nmap chart can be deployed via helm:

# Install HelmChart (use -n to configure another namespace)helm upgrade --install nmap secureCodeBox/nmap

Scanner Configuration#

The Nmap scan targets are specified as the last parameter. The target should be a hostname, an IP address or an IP range. See Nmap Docs for details.

Additional Nmap scan features can be configured via the parameter attribute. For a detailed explanation to which parameters are available refer to the Nmap Reference Guide. All parameters are supported, but be careful with parameters that require root level rights, as these require additional configuration on the ScanType to be supported.

Some useful example parameters listed below:

  • -p xx: Scan ports of the target. Replace xx with a single port number or a range of ports.
  • -PS, -PA, -PU xx: Replace xx with the ports to scan. TCP SYN/ACK or UDP discovery.
  • -sV: Determine service and version info.
  • -O: Determine OS info. Note: This requires that Nmap is run as root, or that the user has the system capabilities to be extended to allow Nmap to send raw sockets. See more information on how to deploy the secureCodeBox nmap container to allow this and the nmap docs about privileged scans
  • -A: Determine service/version and OS info.
  • -script xx: Replace xx with the script name. Start the scan with the given script.
  • --script xx: Replace xx with a coma-separated list of scripts. Start the scan with the given scripts.

Requirements#

Kubernetes: >=v1.11.0-0

Additional Chart Configurations#

Operating System Scans#

caution

Warning! This is currently not tested and might require additional testing to work 😕

If you want to use Nmap to identify operating systems of hosts you'll need to weaken the securityContext config, as Nmap requires the capability to send raw sockets to identify operating systems. See Nmap Docs

You can deploy the ScanType with the config like this:

cat <<EOF | helm install nmap-privileged ./scanners/nmap --values -scanner:  nameAppend: "-privileged"  env:    - name: "NMAP_PRIVILEGED"      value: "true"  securityContext:    capabilities:      drop:        - all      add:        - CAP_NET_RAW        - CAP_NET_ADMIN        - CAP_NET_BIND_SERVICEEOF

Then, you can start scans with operating system identification enabled:

apiVersion: "execution.securecodebox.io/v1"kind: Scanmetadata:  name: "nmap-os-scan"spec:  scanType: "nmap-privileged"  parameters:    - --privileged    - "-O"    - www.iteratec.de

Values#

KeyTypeDefaultDescription
cascadingRules.enabledbooltrueEnables or disables the installation of the default cascading rules for this scanner
parser.affinityobject{}Optional affinity settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/)
parser.envlist[]Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
parser.image.pullPolicystring"IfNotPresent"Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
parser.image.repositorystring"docker.io/securecodebox/parser-nmap"Parser image repository
parser.image.tagstringdefaults to the charts versionParser image tag
parser.scopeLimiterAliasesobject{}Optional finding aliases to be used in the scopeLimiter.
parser.tolerationslist[]Optional tolerations settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
parser.ttlSecondsAfterFinishedstringnilseconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
scanner.activeDeadlineSecondsstringnilThere are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup)
scanner.affinityobject{}Optional affinity settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/)
scanner.backoffLimitint3There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy)
scanner.envlist[]Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
scanner.extraContainerslist[]Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
scanner.extraVolumeMountslist[]Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
scanner.extraVolumeslist[]Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
scanner.image.pullPolicystring"IfNotPresent"Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
scanner.image.repositorystring"docker.io/securecodebox/scanner-nmap"Container Image to run the scan
scanner.image.tagstringnildefaults to the charts appVersion
scanner.nameAppendstringnilappend a string to the default scantype name.
scanner.resourcesobject{}CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/)
scanner.securityContextobject{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
scanner.securityContext.allowPrivilegeEscalationboolfalseEnsure that users privileges cannot be escalated
scanner.securityContext.capabilities.drop[0]string"all"This drops all linux privileges from the container.
scanner.securityContext.privilegedboolfalseEnsures that the scanner container is not run in privileged mode
scanner.securityContext.readOnlyRootFilesystembooltruePrevents write access to the containers file system
scanner.securityContext.runAsNonRootbooltrueEnforces that the scanner image is run as a non root user
scanner.tolerationslist[]Optional tolerations settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
scanner.ttlSecondsAfterFinishedstringnilseconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/

License#

License

Code of secureCodeBox is licensed under the Apache License 2.0.

Examples#

basic-example#

# SPDX-FileCopyrightText: 2021 iteratec GmbH## SPDX-License-Identifier: Apache-2.0
apiVersion: "execution.securecodebox.io/v1"kind: Scanmetadata:  name: "nmap-scanme.nmap.org"spec:  scanType: "nmap"  parameters:    - scanme.nmap.org

example-with-parameters#

# SPDX-FileCopyrightText: 2021 iteratec GmbH## SPDX-License-Identifier: Apache-2.0
apiVersion: "execution.securecodebox.io/v1"kind: Scanmetadata:  name: "nmap-juice-shop-cluster-internal"spec:  scanType: "nmap"  parameters:    # Internal cluster is blocking our ping probes, therefore we skip them    - "-Pn"    # Service Detection enabled    - "-sV"    # Actual Service Address will depend on your cluster and namespace configuration. 🤷‍    - juice-shop.demo-targets.svc.cluster.local