Automating Network Scanning with Python and Nmap

Nmap is a powerful network scanning tool that can help you identify open ports, hosts, and vulnerabilities on a network. By using Nmap with Python, you can automate the scanning process and integrate it into your existing security tools.

In this tutorial, we will learn how to run an Nmap scan using Python and the python-nmap library.

Installation

Before we start, we need to install the python-nmap library. You can do this by running the following command in your terminal:

pip install python-nmap

This will install the library and all its dependencies.

Nmap Scan with Python

Now that we have installed the python-nmap library, we can use it to run an Nmap scan. The following Python code shows how to run a basic Nmap scan:

import nmap

scanner = nmap.PortScanner()

# Define target IP address or hostname
target = "scanme.nmap.org"

# Run a basic scan on the target
scanner.scan(target)

# Print the scan results
for host in scanner.all_hosts():
    print("Host: ", host)
    print("State: ", scanner[host].state())
    for proto in scanner[host].all_protocols():
        print("Protocol: ", proto)
        ports = scanner[host][proto].keys()
        for port in ports:
            print("Port: ", port, "State: ", scanner[host][proto][port]['state'])

In this code, we first import the nmap library and create a new scanner object. We then define the target IP address or hostname that we want to scan. In this case, we are scanning the scanme.nmap.org website, which is a public test site provided by Nmap.

Next, we run a basic scan on the target by calling the scan() method on the scanner object. This method will perform a TCP SYN scan on the most common ports.

Finally, we loop through the results of the scan and print the host, state, protocol, and port information for each host that was scanned.

Advanced Nmap Scans

While the basic Nmap scan is useful for identifying open ports and services, you may want to perform more advanced scans to identify vulnerabilities or to gather more information about a network.

The python-nmap library provides many options for customizing your Nmap scans. For example, you can specify the ports to scan, the scan type, the timing options, and more.

Here is an example of how to perform a more advanced Nmap scan using Python:

import nmap

scanner = nmap.PortScanner()

# Define target IP address or hostname
target = "scanme.nmap.org"

# Define Nmap options
options = "-sS -sV -O -A -p 1-1000"

# Run the Nmap scan with the specified options
scanner.scan(target, arguments=options)

# Print the scan results
for host in scanner.all_hosts():
    print("Host: ", host)
    print("State: ", scanner[host].state())
    for proto in scanner[host].all_protocols():
        print("Protocol: ", proto)
        ports = scanner[host][proto].keys()
        for port in ports:
            print("Port: ", port, "State: ", scanner[host][proto][port]['state'])

In this code, we define a more advanced Nmap scan by specifying the -sS (TCP SYN scan), -sV (version detection), -O (OS detection), -A (aggressive scan), and -p 1-1000 (scan ports 1 to 1000) options.

We then call the scan()method on the scanner object with the arguments parameter set to the options string we defined. This will run the Nmap scan with the specified options.

Finally, we loop through the results of the scan and print the host, state, protocol, and port information for each host that was scanned.

Conclusion

In this tutorial, we learned how to run an Nmap scan with Python using the python-nmap library. We started with a basic Nmap scan and then moved on to more advanced scans that can be customized with Nmap options.

Nmap is a powerful tool for network scanning and can be used to identify open ports, hosts, and vulnerabilities on a network. By using Nmap with Python, you can automate the scanning process and integrate it into your existing security tools.

Keep in mind that Nmap can be used to perform both legal and illegal activities. Always use Nmap in a responsible and ethical manner, and only scan networks and hosts that you have permission to scan.