[snowblind956]

Excellent tutorial! I'm sure it will really help a lot of people. I'd like to offer a couple tips for finding out what's on your network, you can feel free to just ignore me if you'd like. I use fping to do a ping sweep of my target network, and I use several nmap commands to port scan. To ping sweep a range I use this command:

Code:

fping -a -g 192.168.0.1 192.168.0.254>filename.txt

This scans a whole subnet and makes a nice clean text file for our results. For my nmap syn scan i use:

Code:

nmap -p- -PN 192.168.0.10

to scan a single ip. Without the -p- nmap only scans the 1000 most common ports, and -PN skips the host discovery and just scans all ports as if they were alive. This takes a little longer but it's more thorough. Also don't forget to scan for UDP as well as TCP with at least this:

Code:

nmap -sUV 192.168.0.10

I don't use all of the extra's for udp only because it does take a lot longer than tcp, and if you're feeling like you could find more i urge you to look up different kinds of scans such as xmas and null. Also don't forget to vulnerability scan with a vulnerability scanner like nessus, nexpose, or openvas!