Security scanner for computers and networks.

learn more… | top users | synonyms

1
vote
0answers
95 views

What is my router listening for on ports 5555 and 3333? [closed]

I recently discovered nmap and pointed it at my router out of curiosity. It found that ports 3333 and 5555 are open but doesn't recognise either service. I investigated and found: I can successfully ...
1
vote
2answers
65 views

Why does NMAP scan list hosts as up? [closed]

When running an NMAP scan of my internal network (192.168.1.0/24) from my Mac, NMAP sees all hosts as live. It also believes there is a port 80 http service running on every IP when I do not have 254 ...
3
votes
1answer
54 views

Honeyd Isn't Detecting Loud Scans [closed]

I've got the Honeyd honeypot in one virtual machine (kali) and nmap in another (ubuntu), the config file looks like this: create default set default default tcp action closed set default default udp ...
0
votes
0answers
25 views

WPA2 ENTERPRISE - Unable to find a way around Lanner Electronics

Gday, I have currently been working in an environment where i am connected to a WPA2 Enterprise network requiring me to enter my username and password for the network whenever i connect. I have been ...
1
vote
2answers
108 views

Nmap scan list of domains and provide boolean if up/down

I have a newline separated list of domains that I would like to perform an arbitrary nmap scan on (e.g. aggressive, syn) and I would like to output a boolean that indicates whether or not any ports ...
7
votes
2answers
384 views

How nmap guesses the operating system?

nmap has the capability to guess the operating system with the option -O. I was highly surprised that it can find the correct kernel or service pack. * How nmap guesses the operating system? * What ...
1
vote
2answers
76 views

nmap crashing embedded-system in strange way

I'm trying to find out what nmap-commands crash an embedded-system. In the process I can see behaviour that I don't understand: On the system port 80 is open and 79 is closed. nmap -p 79-80 -T5 -A ...
5
votes
1answer
175 views

Where can I use the TCP FIN scan?

For a coursework i've got to run the various port scans, i'm having trouble with the FIN scan though, I can't seem to find a system where I can try it, everywhere I try it all ports either come back ...
15
votes
2answers
2k views

Is it possible to identify who's behind a nmap -D scan?

Nmap's -D option stands for decoy, which means that the attacker can simulate that the attack is coming from multiple IPs, including attacker's IP. From the point of view of the victim, is it ...
0
votes
2answers
65 views

viability scanner inside AWS

So I have 2 soon to be 3 VPC's within AWS, I want to run a automated nmap scan on all three VPC's every few weeks to make sure nothing has been opened, added etc what would be the best way to achieve ...
0
votes
2answers
99 views

Does Nmap requires a closed TCP port to do OS fingerprinting?

I was checking the security of a server by running Nmap. Last time it gives me the following results, indicating that OS could not be fingerprinted: PORT STATE SERVICE VERSION 21/tcp ...
2
votes
2answers
109 views

Nmap scanning computers behind a wireless modem [closed]

Let's suppose that I have a router and three computers connected to Internet through that router. When I tried to get the external IP address for each computer, I got the same address. I think this ...
0
votes
1answer
92 views

nmap - “No exact OS matches for host (test conditions non-ideal)” even with 1 open, 1 closed port

I'm trying to do some Nmap OS detection and I'm running into some results I don't understand. The scan I'm running is the following: nmap -O -F -v -T2 -oA nmap-uphosts-OSdetect -iL < my_in_file ...
1
vote
0answers
329 views

Proxychains + nmap = segmentation fault

If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:- root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p ...
2
votes
1answer
45 views

Is there any difference for OS fingerprint technique used in Nmap inside -A and -O?

Is there any difference between the technique or algorithm used from Nmap to guess the OS between the option -A and -O? If not, why -O option requires root privileges but -A that it is doing at least ...
2
votes
2answers
821 views

How to block network scans with pfsense?

I am using pfsense as firewall, and I would like to know how I can stop network scans from enumerating open services and ports. Thanks
0
votes
2answers
156 views

Identifying HP Printers with NMAP and then using results in Python/Perl

Great write up on network printer hacking at IronGeek's site here for anyone interested http://www.irongeek.com/i.php?page=security/networkprinterhacking. Here's what I want to do: Scan the subnet ...
0
votes
2answers
118 views

Nmap stealth scan shows that port is filtered

The title is really bad, but I was able to find better. I have installed Debian on VMware, and set iptables to block any traffic except port 80 (inbound and outbound). When I run a nmap scan it shows ...
0
votes
1answer
84 views

NMAP not reporting open ports with -sS scan

Is there any reason why an -sS scan (or most others) would not report an open port that doesn't have a service attached to it? For example, in a regular -sS scan, the following port will be missing, ...
-1
votes
1answer
79 views

How to create a script that returns only the mobile devices on a network using NMAP

I would like to create a script using NMAP on Mac that 1) scans the entire LAN, and 2) Returns the number of mobile devices.
1
vote
1answer
76 views

Can't successfully do an idle scan

I have kali linux installed in VirtualBox and would like to do an idle scan. For this I need to find a suitable zombie pc. I'm using the ipidseq script to find one. The script finds some ip addresses ...
1
vote
3answers
275 views

What exactly does one get from a Nmap Scan?

I know nmap is a port scanner and its output shows all the open ports, the services running on those ports, the underlying OS and technology, etc. What should one take from this result in easiest ...
0
votes
2answers
91 views

Nmap reporting the status of a port as both opened and closed

If I do not define any range (or if the range is large like a hundreds of ports), Nmap is returning ports as opened. However, if I put a smaller range or just scan a specific port, it says it's ...
0
votes
0answers
300 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. the ...
0
votes
1answer
67 views

If I port scan a server on the outside of a firewall will this also tell me the ports the firewall is blocking?

Theoretically I was thinking a firewall inspects the TCP header and looks at the destination port and discards/forwards based on its firewall rules. So could I port scan an external server to the ...
0
votes
1answer
916 views

how to bypass windows xp firewall with nmap

I'm scanning a Windows XP in a virtualized environment. I use all of needed arguments to bypass its firewall but it doesn't answer: nmap -e eth0 -Pn --data-length 5 --badsum -g 80 -S 192.168.1.103 -f ...
0
votes
1answer
1k views

Nmap SSL service detection: How to check all open ports only for SSL service?

I am running nmap to probe services that use SSL.¹ In order to detect vulnerability in non-standard ports, I am using the -sV option to perform service discovery. But it is very slow since it runs ...
3
votes
1answer
291 views

Scan All private subnets with NMAP [closed]

I have a managed switch on my network but I don't remember the subnet. How can I scan all the private network without changing my ip address : 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 Thanks for ...
1
vote
4answers
186 views

Comprehensive audit of firewall - is Internet truly not accessible?

We have many Linux servers in several co-locations over the world. By design, these machines generally should not be able to access the Internet. Depending on location and role, some sites may have ...
0
votes
4answers
1k views

Increase speed in nmap UDP scan?

How can I get nmap quicker in scanning UDP ports? This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
2
votes
1answer
62 views

Optimal flags to specify when using nmap to guess the OS on remote devices?

Optimal flags to specify when using nmap to guess the OS on remote devices? I'm currently using the following: nmap --privileged -sS -sU -sY -sZ -O --osscan-guess -F -r 192.168.200.223 This seems ...
1
vote
1answer
2k views

How do I use nmap to scan a range of IPv6 addresses? [closed]

I need to scan a range of IPv6 addresses with Nmap, but I'm not sure how to do this. When scanning for an IPv4 range, I would usually do this: nmap -sP 192.168.*.* or nmap -sP 192.168.1.* but if ...
3
votes
2answers
1k views

Why do multiple IP Addresses in my local network point to the same computer?

I'm new to linux and nmap, and I am attempting to do a scan of my local network. Using nmap I find that there are 4 hosts on my network (10.0.2.2, 10.0.2.3, 10.0.2.4, 10.0.2.15). I am using VirtualBox ...
1
vote
2answers
2k views

nmap no ping returns host is active and all ports are filtered

I am trying to determine if hosts are up. For hosts where a ping fails, I run a nmap (6.40) Regular and/or Quick scan. For a subset of my hosts, the nmap response is "Host seems down". As a follow up ...
1
vote
0answers
251 views

Bypass Nmap Scans Being Blocked [closed]

A friend has set up a VM for me to play with, I am currently stuck on a little problem: On this network he set up, there are 6 machines and a router, 5 servers (plus the router) show up on a typical ...
3
votes
1answer
118 views

Use nmap correctly

I currently have a VPS in a data center, I asked the admin to open a port to install a ftp server. It opened port 3345, at first I tought the port is not forwarded correctly, because I ran nmap as ...
0
votes
1answer
549 views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
2
votes
1answer
77 views

Does nmap limit probes when using time limiting on decoy scans?

If I set a rate limit (e.g. -T1) on an nmap scan that uses decoys, does the rate limit apply to all probes, or just each individual source? I checked the documentation, but can't see anything ...
3
votes
2answers
381 views

Determing live hosts past a restrictive firewall with nmap

Sometimes when I am doing an external security assesment, I run into hosts that have the following restrictions/configuration: All ICMP traffic is blocked An IDS or some device returns all ports as ...
2
votes
5answers
2k views

Nmap reporting almost every port as open

I have noticed during some assesments when doing a TCP port scan, Nmap will report almost every port as open for a machine. Using for example nmap -sS -PN -T4 target -p0-65535, over 20,000 ports will ...
0
votes
1answer
174 views

Is it possible to scan a remote host in another network if I know a port that is opened?

First of all, this question is not the same as is it possible to test out remote host by using nmap?, because on that question, the questioner is asking for something impossible due to NAT's nature. ...
0
votes
2answers
809 views

Determining false positives when scanning for live hosts with Nmap

When doing a vulnerability assessment on a large network, it seems general practice to determine which hosts on the network are live. This can be done in various ways. From what I have read it is ...
6
votes
2answers
2k views

How does nmap do a zombie and decoy scan?

We're learning nmap in my ethical hacking class. We got showed how we can use nmap to perform a zombie scan: nmap -PN -sI zombieIP targetIP and decoy scan: nmap -p 135 -D decoyIP targetIP I ...
1
vote
1answer
463 views

How does nmap determine if it's running HTTP service on a port? Fails here

I'm running apache on 192.168.56.178, which listens on port 80, 8090 and 8095 (configured as <VirtualHost *>). Now If I open my browser and point to any of those 3 ports, e.g ...
1
vote
3answers
211 views

Port Scanning Host that has Rate Limiting Enabled

I am trying to enumerate on of my lab machines. It seems that it has rate limiting enabled since I am getting blocked after the first few probes. I need to scan the whole 65535 tcp ports. I tried ...
0
votes
1answer
111 views

Understanding a Zenmap output

I'm running Zenmap on my Windows 7 laptop. I ran an intense scan with UDP targeting my router 192.168.1.1.I realize that I'm probing into the back end of the router from the inside and that any open ...
4
votes
1answer
434 views

Is it possible to detect host-machine of my virtual-machines?

So basically I need to know is there any way to find a connection (or relation) between packets sent by my VMs and my host machine. In my lab I have lots of workstations, each running a VirtualBox ...
11
votes
4answers
2k views

Is my network being sniffed?

Is there any way to find out if someone who is connected to my network is sniffing packets? There is a way with nmap if his card is in promiscuous mode but what if it is passive?
1
vote
4answers
2k views

How to make nmap list an unfiltered port?

I have a host that is NAT'ed and I have opened a single port in my router so the host is reachable by the external world. I tested if it was reachable by running a service and connecting to it ...
7
votes
3answers
10k views

How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve ...