Nmap

To fingerprint the hosts on example.com, you can use the nmap tool. Here's how you can do it:

1. Install nmap: If you don't have nmap installed, you can download and install it from the official website (https://nmap.org/download.html).

2. Run the following command:

sudo nmap -sV -O example.com

• The -sV option is used to determine the service and version information of the target hosts.

• The -O option is used to enable OS detection and fingerprinting.

3. Analyze the output: The output will show the IP addresses and hostnames of the targets, along with the detected open ports and the services running on them. You'll also see the OS fingerprint and version information.

result of the nmap scan on example.com

Using nmap to scan a list of subdomains

You can use nmap in combination with the subdomains enumerated by subfinder to fingerprint the targets. Here's how you can do it:

1. Save the output of enumeration: Save the output of subfinder to a file. For example:

subfinder -d example.com > subdomains.txt

4. Run the following command:

nmap -sV -iL subdomains.txt

• The -sV option is used to determine the service and version information of the target hosts.

• The -iL option is used to specify a file containing a list of targets to scan.

Running nmap with Default set of scripts

To run all the nmap scripts on the example.com domain, you can use the following command:

nmap -sC -sV example.com

• The -sC option is used to enable the default set of scripts for vulnerability detection and service fingerprinting.

• The -sV option is used to determine the service and version information of the target hosts.

Detecting CVEs using nmap

To detect Common Vulnerabilities and Exposures (CVEs) on the example.com domain using nmap, you can use the following command:

nmap --script vuln example.com

• The --script vuln option is used to enable the nmap vulnerability detection scripts.

The output of the command will show the IP addresses and hostnames of the targets, along with the detected open ports and the services running on them. You'll also see the results of the nmap vulnerability detection scripts, including any CVEs or vulnerabilities that they detect.