Security scanner for computers and networks.

learn more… | top users | synonyms

0
votes
2answers
20 views

NMAP shows multiple outputs in OS detection

I am experimenting with NMAP in our network as an assignment, and I meant to do OS scan on one specific host 192.168.2.18, for which I chose the following command, nmap -O 192.168.2.18 and I was ...
1
vote
2answers
56 views

How can the nmap tool be used to evade a firewall/IDS?

Some techniques are used to secure the operating system against network attacks e.g.: firewalls, antivirus software, an IDS like SNORT, etc. To take advantage of the nmap tool, is it possible to ...
0
votes
1answer
29 views

Unable to scan live hosts in a home network

I have been trying to scan live hosts that is connected to my home network using nmap but it keeps on returning the IP address of my router and my personal computer. I tried using the following ...
1
vote
1answer
35 views

Samba open ports, not being filtered

nmap scan of my ubuntu computer, output when ran with -sV: 139/tcp open netbios-ssn Samba smbd 3.X (workgroup: MEDIAPC) 445/tcp open netbios-ssn Samba smbd 3.X (workgroup: ...
1
vote
1answer
24 views

NMAP - Port 4111 XGRID? [closed]

Starting Nmap 7.12 ( https://nmap.org ) at 2016-04-24 10:19 BST Stats: 0:00:27 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan Service scan Timing: About 0.00% done Nmap scan report for ...
1
vote
0answers
45 views

I am hoping someone can shed some light on these nmap scan results

I am concerned that a friends computer may be compromised. They were complaining about the computer getting really hot, difficulty maintaining an online connection, finding unread non junk emails in ...
0
votes
1answer
62 views

Strange behavior of Nmap

I do port scanning with Nmap when HotSpot Shield VPN is running; and I am receiving strange result - when HotSpot Shield is running, Nmap tells me that all of the ports are open and when HotSpot is ...
0
votes
1answer
49 views

OS fingerprinting via TCP

I have searched online about this topic and the only information I got is that TCP SYN/ACK can be used to know the type of the target OS. If that is true, I don't understand how this occurs? Does TCP ...
11
votes
5answers
3k views

Why do hackers scan for open ports?

So, whenever you hear of the mean little hackers who hack websites you hear of "port scanning". I understand what it is (looking for all open ports / services on a remote machine), however that begs ...
1
vote
2answers
41 views

Wireshark as a network scanner [closed]

I have been playing with nmap lately, trying out arp-ping scanning and using idle hosts, etc... Looking at Wireshark, there is always some suspicious activity when performing scans. The thing is, I ...
3
votes
2answers
70 views

Nmap through proxy

Using the following command: nmap --proxy socks4://*.*.*.*:25074 -sV -O --reason scanme.nmap.org I'm not sure if nmap is really using the proxy specified Had an idea of scanning "localhost" or ...
0
votes
3answers
56 views

nmap -sP scan question

I'm trying to find the IP of my other computer on the network for penetration testing, but when I do -sP 192.168.1.1/24 I get all hosts are up (up to 255), and it doesn't identify any particular IP ...
2
votes
3answers
26 views

Nmap scan output for other nmap scan

I was wondering if it was possible to output the result of a nmap scan (>, oN/-oX/-oS/-oG, or an other way) in a way that I would be able to import the results for another nmap scan. For example, ...
1
vote
0answers
39 views

Port scanning on server

My use case is to check open ports on multiple servers, so when I try: nmap -iL list.txt then nmap only scans for some particular ports whether they are open or closed, but when I try: namp -p ...
0
votes
2answers
55 views

Missing scripts in NMAP

I've just installed the latest Kali and updated everything. nmap is version 7.12. I've noticed that smb-check-vulns.nse is not present. As far as I can tell, most other scripts I use are there but ...
2
votes
1answer
83 views

Scanning private IPs from outside network

My question is only for informative purposes: Is it possible with Nmap (or other tool) to scan a range of private IPs (let's say 10.0.0.0/8) but being outside any private network (using those IPs) ? ...
5
votes
1answer
87 views

Nmap doesn't scan the whole range of IPs

I have multiple machines on my home network with a range of private IPs from 10.0.0.0 to 10.255.255.255. When I scan the network, I use: nmap -v 10.0.0.0/8 But the console shows this: Starting ...
1
vote
1answer
44 views

How can I detect the remote operating system?

Is it possible to detect the operating system type remotely from another system using any tools like nmap without admin privileges? What are the other alternatives for achieving this?
1
vote
2answers
40 views

Scanning a Foreign Network for Active Hosts using Nmap or Hping3

I Have a Router setup at my home. I Just have a private IP. I wanted to scan for active hosts on my network. When I do it locally, I use, Nmap, nmap -sn -v x.x.x.* So, is their any way to do it ...
1
vote
2answers
14 views

How do I ask nmap to probe designated service type, and do not run scripts?

I would like to probe if a port is running socks or squid service, but nmap runs all service probes by default, can I change that? Also from the debug output, there's a NSE script pre-scanning, can I ...
3
votes
1answer
21 views

Why can't nmap identify the danted(socks5) service on non-standard port?

I'm testing nmap's abilities, I started a socks5 proxy server with danted, and started it on port 10090 I tried the following command, and expect it to tell me port 10090 runs a socks server, nmap ...
1
vote
2answers
84 views

Using nmap to bypass a firewall and perform OS fingerprinting

How can I use nmap to perform operating system detection on a system which has all of its ports filtered by a firewall? Is there a way to bypass it? I have tried: syn scan, xmas scan, fragment ...
2
votes
4answers
119 views

With Nmap it is possible to scan according mac address?

I would like to know if it's possible to use Nmap in order to scan hosts according to their mac address. Or if it's not possible to do it directly, is there an option (i didn't find) to select only ...
4
votes
1answer
61 views

Armitage check exploit

I am with all fairness not the most experienced penetration tester, I am doing an industry placement where I can improve my skills. I am using Armitage in Kali Linux to check for vulnerabilities in ...
4
votes
2answers
72 views

Nmap update - SSL/TLS ciper strength indication

Previously with nmap I found it easy to understand the strengths of ciphers noted by the tool (strong, weak...) However this has now changed to a rating of A-F. What does this mean and why did they ...
1
vote
2answers
63 views

Nmap scan report with all port status

Is there a way to ask nmap to print the final scan report with the state of all ports tested and the reason? For example when the scan is launched with --reason : Nmap scan report for 127.0.0.1 ...
3
votes
2answers
52 views

All ports are unfiltered

I'm currently studying a peneteration/hacking course. I am trying to use nmap against a target to find all the ports that are filtered. I thought if I used an ACK-scan nmap would give me all the ...
-1
votes
2answers
56 views

Nmap - host discovery doesn't show all hosts

I tried to scan my network for hosts. However, it seems like it didn't scan the MAC. I tried all kinds of TCP and UDP scans on different kind of ports but the hosts doesn't show up. It's strange ...
3
votes
0answers
24 views

NMAP host discovery reporting discrepant results between NAT and Bridged mode

I figured this would be the most relevant place to ask this question. I'm using a Kali VM to run some network scans. The results are different depending on whether my network interface is bridged or ...
0
votes
1answer
79 views

Block OS fingerprinting without using iptables

I have a linux machine connected to a Windows 98 pc on port 104. Now I want to block the OS fingerprinting using nmap for the windows 98 pc. I tired using iptables ( blocking the particular port ) but ...
2
votes
1answer
49 views

How to perform an idle scan against a target using Nmap with a list of zombies? [closed]

I want to perform port scan against a target but the firewall at the target only allows traffic to the ports through certain IP address/machines. I tried to perform an idle scan in Nmap but it only ...
1
vote
1answer
48 views

How can I know why Nmap identified a service or OS the way it did?

Nmap uses a variety of testing methods and fingerprints to determine - or at least guess at - what services are running on each discovered port, and what operating system is running on the host. (When ...
3
votes
1answer
198 views

Detecting POODLE and BEAST using nmap

Need your expert advice for the following - POODLE - We can deduce if a server is vulnerable to poodle if it supports sslv3 protocol and uses CBC Ciphers. BEAST - Any server supporting sslv3 OR TLS ...
0
votes
2answers
116 views

How to scan for ports opened by TCP/UDP sockets with nmap or any other tool?

I'm new to nmap and I've been digging with it lately to scan some devices on the current LAN for ports opened by socket programs which are running. First I ran a simple UDP server on my machine on ...
0
votes
4answers
196 views

VM Kali Linux - nmap why is so slow? [closed]

I was scanning an IP using this command: nmap -sT -p- -Pn <Ip_Address>, but is very slow scanning. To reach 100%, the command line said 3 hours remaining. Why is it so slow?
3
votes
1answer
63 views

Can still ping from secure network?

I have a standard network and wanted to make a more secure one so I bought a second router and set it up as a separate network daisy chained so it can get internet. I managed to make the setup, with ...
1
vote
1answer
36 views

Network Scans Find Absent Device

Using Nessus (an uncredentialed full scan) and Nmap (essentially a full port scan), I am finding a phantom device. This device is supposed to be a well-out-of-commission device, but is returning a ...
3
votes
0answers
84 views

Unknown ports shown on Nmap scan…and other strange behavior

My local network has been exhibiting some inexplicable behaviour. Firstly connecting to my websites domain name from inside the lan redirected me to my router's login page. I checked again with 3g ...
1
vote
1answer
43 views

Nmap scan giving different result to my iptables configuration

I am running a simple webserver on a VPS, the only ports I have open are 80 - for HTTP (webserver) 12345 - an unusual port for SSH connection to administer server. I wanted to see how my ...
0
votes
1answer
53 views

nmap SYN scan taking forever

I read on a book that the SYN scan in nmap is usually a lot faster than the TCP connect scan, because it doesn't go through all the three way handshake connection. But when i try both scans on the ...
0
votes
1answer
39 views

what does Pn options stands for in nmap [closed]

I have a very weak memory, and i can't remember an option unless i understand what it stands for. I can remember -sT option in nmap because i know that s stands for scan, and T for TCP Connect. I ...
0
votes
1answer
67 views

Open ports on router

I have a TP-Link TD W8970 modem/router. Just for fun i tried to perform a port scan on it. I found this: $ nmap -p 1-65535 -n 192.168.1.1 Starting Nmap 6.00 ( http://nmap.org ) at 2016-01-21 16:17 ...
0
votes
0answers
46 views

Establish dynamic port forward/proxy-chain through compromised Windows host

The scenario Attacker IP (public): 1.2.3.4 Compromised Windows Workstation IP (internal): 4.5.6.7 Setup: Firewall between workstation and attacker IP, permits outbound connections on port 21. ...
1
vote
1answer
138 views

NMap Showing Unknown Private IPs

Like this question nmap is showing unknown IPs from 192.168.2.* in my home network which has an IP range of 192.168.1.*. Unlike the above question, every single IP appears to be completely locked ...
2
votes
3answers
344 views

Nmap http-brute - Supplying arguments for bruting via GET

I'm attempting to brute a site in my test lab with Nmap's http-brute nse, which has the URL structure https://192.168.101.6/api/auth?email=a@b.com&password=pass Unfortunately Nmap's official ...
1
vote
2answers
82 views

Why does nmap remotely show when I have port 6969 open, but not others?

Specifically, I was running a node.js application on port 6969 which I thought was strictly local. I discovered this was not the case when I ran nmap <myip> from a different computer and found ...
4
votes
3answers
167 views

Nmap showing ISPs router's DNS port in addition to target's ports

Whenever I do nmap scans my ISP router DNS port like the following. This happens for every IP or target. $ nmap -T4 -A -v stackoverflow.com PORT STATE SERVICE VERSION 53/tcp open domain ...
3
votes
2answers
201 views

Deauth all users on AP except yourself

I am looking to create a small first project to further my self education into infosec. I will be putting this on my Github. My idea is to create a script that automates the process of deauthing all ...
0
votes
1answer
90 views

Nmap NSE Password Brute Force is Stopping on First Positive Instance

I'm running an Nmap brute force against metasploitable2 (telnet). The script is stopping on the first found username/password and is not iterating through the entire user/password file i have ...
0
votes
1answer
40 views

Resuming an interrupted nmap scan:

I need to: --resume <filename>: Resume an aborted interrupted scan. But I didn’t: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, ...