Security scanner for computers and networks.

learn more… | top users | synonyms

0
votes
1answer
112 views

Nmap SSL service detection: How to check all open ports only for SSL service?

I am running nmap to probe services that use SSL.¹ In order to detect vulnerability in non-standard ports, I am using the -sV option to perform service discovery. But it is very slow since it runs ...
1
vote
0answers
53 views

Why would ping succeed but nmap fail? [migrated]

Why does Nmap report "Host seems down" when a simple ping succeeds? me@computer:~$ ping 123.45.67.89 PING 123.45.67.89 (123.45.67.89) 56(84) bytes of data. 64 bytes from 123.45.67.89: icmp_req=1 ...
1
vote
1answer
36 views

Scan All private subnets with NMAP [closed]

I have a managed switch on my network but I don't remember the subnet. How can I scan all the private network without changing my ip address : 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 Thanks for ...
1
vote
4answers
106 views

Comprehensive audit of firewall - is Internet truly not accessible?

We have many Linux servers in several co-locations over the world. By design, these machines generally should not be able to access the Internet. Depending on location and role, some sites may have ...
0
votes
4answers
82 views

Increase speed in nmap UDP scan?

How can I get nmap quicker in scanning UDP ports? This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
0
votes
1answer
25 views

Optimal flags to specify when using nmap to guess the OS on remote devices?

Optimal flags to specify when using nmap to guess the OS on remote devices? I'm currently using the following: nmap --privileged -sS -sU -sY -sZ -O --osscan-guess -F -r 192.168.200.223 This seems ...
0
votes
1answer
230 views

How do I use nmap to scan a range of IPv6 addresses? [closed]

I need to scan a range of IPv6 addresses with Nmap, but I'm not sure how to do this. When scanning for an IPv4 range, I would usually do this: nmap -sP 192.168.*.* or nmap -sP 192.168.1.* but if ...
3
votes
2answers
293 views

Why do multiple IP Addresses in my local network point to the same computer?

I'm new to linux and nmap, and I am attempting to do a scan of my local network. Using nmap I find that there are 4 hosts on my network (10.0.2.2, 10.0.2.3, 10.0.2.4, 10.0.2.15). I am using VirtualBox ...
1
vote
2answers
278 views

nmap no ping returns host is active and all ports are filtered

I am trying to determine if hosts are up. For hosts where a ping fails, I run a nmap (6.40) Regular and/or Quick scan. For a subset of my hosts, the nmap response is "Host seems down". As a follow up ...
1
vote
0answers
117 views

Bypass Nmap Scans Being Blocked [closed]

A friend has set up a VM for me to play with, I am currently stuck on a little problem: On this network he set up, there are 6 machines and a router, 5 servers (plus the router) show up on a typical ...
3
votes
1answer
82 views

Use nmap correctly

I currently have a VPS in a data center, I asked the admin to open a port to install a ftp server. It opened port 3345, at first I tought the port is not forwarded correctly, because I ran nmap as ...
0
votes
1answer
248 views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
2
votes
1answer
55 views

Does nmap limit probes when using time limiting on decoy scans?

If I set a rate limit (e.g. -T1) on an nmap scan that uses decoys, does the rate limit apply to all probes, or just each individual source? I checked the documentation, but can't see anything ...
3
votes
2answers
184 views

Determing live hosts past a restrictive firewall with nmap

Sometimes when I am doing an external security assesment, I run into hosts that have the following restrictions/configuration: All ICMP traffic is blocked An IDS or some device returns all ports as ...
2
votes
5answers
639 views

Nmap reporting almost every port as open

I have noticed during some assesments when doing a TCP port scan, Nmap will report almost every port as open for a machine. Using for example nmap -sS -PN -T4 target -p0-65535, over 20,000 ports will ...
0
votes
1answer
92 views

Is it possible to scan a remote host in another network if I know a port that is opened?

First of all, this question is not the same as is it possible to test out remote host by using nmap?, because on that question, the questioner is asking for something impossible due to NAT's nature. ...
0
votes
2answers
297 views

Determining false positives when scanning for live hosts with Nmap

When doing a vulnerability assessment on a large network, it seems general practice to determine which hosts on the network are live. This can be done in various ways. From what I have read it is ...
6
votes
2answers
511 views

How does nmap do a zombie and decoy scan?

We're learning nmap in my ethical hacking class. We got showed how we can use nmap to perform a zombie scan: nmap -PN -sI zombieIP targetIP and decoy scan: nmap -p 135 -D decoyIP targetIP I ...
1
vote
1answer
167 views

How does nmap determine if it's running HTTP service on a port? Fails here

I'm running apache on 192.168.56.178, which listens on port 80, 8090 and 8095 (configured as <VirtualHost *>). Now If I open my browser and point to any of those 3 ports, e.g ...
1
vote
3answers
112 views

Port Scanning Host that has Rate Limiting Enabled

I am trying to enumerate on of my lab machines. It seems that it has rate limiting enabled since I am getting blocked after the first few probes. I need to scan the whole 65535 tcp ports. I tried ...
0
votes
1answer
85 views

Understanding a Zenmap output

I'm running Zenmap on my Windows 7 laptop. I ran an intense scan with UDP targeting my router 192.168.1.1.I realize that I'm probing into the back end of the router from the inside and that any open ...
3
votes
1answer
320 views

Is it possible to detect host-machine of my virtual-machines?

So basically I need to know is there any way to find a connection (or relation) between packets sent by my VMs and my host machine. In my lab I have lots of workstations, each running a VirtualBox ...
10
votes
4answers
1k views

Is my network being sniffed?

Is there any way to find out if someone who is connected to my network is sniffing packets? There is a way with nmap if his card is in promiscuous mode but what if it is passive?
1
vote
4answers
852 views

How to make nmap list an unfiltered port?

I have a host that is NAT'ed and I have opened a single port in my router so the host is reachable by the external world. I tested if it was reachable by running a service and connecting to it ...
4
votes
3answers
5k views

How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve ...
2
votes
1answer
1k views

How can I see traceroute details in NMAP?

I'm using NMAP for Network scan ; The output does not contain the full traceroute details. Can I view all intermediate routers/hosts using the NMAP GUI? A simple VPN connection IP traceroute... ...
2
votes
1answer
385 views

Why are some ports reported as closed by nmap?

I was scanning a machine from inside the same LAN which is running and up to date Windows XP Home Edition which I suspect may be running some malware. The target machine has an up to date antivirus ...
16
votes
3answers
32k views

How to find live hosts on my network?

I am trying to find the live hosts on my network using nmap. I am scanning the network in Ubuntu using the command sudo nmap -sP 192.168.2.1/24. However, i am unable to find the live hosts. I just get ...
6
votes
4answers
489 views

Trying to firewall ports 1863, 5190

I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need. But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further? ...
-1
votes
3answers
177 views

What does the question mark in nmap output indicate?

In the following nmap output: $ sudo nmap -sS -sV -vv -n -Pn -T5 x.x.x.1-255 -p80,23,21 -oG - | grep 'open' Host: x.x.x.x () Ports: 21/closed/tcp//ftp///, 23/open/tcp//telnet?///, ...
5
votes
1answer
851 views

How to use NMap to portscan a SonicWall that is blocking all attemtps?

It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
4
votes
3answers
576 views

Sharing Nmap scan results in a web page

Is there a tool that allow the sharing of nmap scan results ? I know nmap can produce XML and I can easily convert them in HTML. I would like to know if there is a tool with more features. For ...
4
votes
5answers
708 views

How to bypass Nmap blockage?

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside? Also, does blocking nmap on a network provide any security? ...
0
votes
3answers
282 views

nmap.online inconsistent results

I recently used nmap online to test my firewall security on the WAN port. I purposely did some port forwarding but received inconsistent results. I opened ports 6881 to 6889 on the firewall and did 2 ...
-2
votes
1answer
871 views

What does -Pn option mean in nmap? [closed]

I am trying to do a nmap scan on a machine in my home network. When I do the regular scan (using nmap 192.168.2.10 or nmap -sP 192.168.2.10), the results say host is down. However, when I use the ...
0
votes
4answers
415 views

NMAP scan fails

I started to read a metasploit guide book so I set up 2 Machines in VirtualBox for pen testing (host - BT 5, the second - WinXP SP2). When Im trying to scan open ports with NMAP on the Windows ...
4
votes
3answers
329 views

Are there any example domains where I can run my nmap scans just to learn?

I want to learn nmap and its various options. Are there any example domains which purposefully have security holes to facilitate learning nmap?
1
vote
2answers
591 views

How do I find a target on the wired network, from an attack system on Wi-Fi?

I'm trying to practice penetration testing on my home network. The target system is my desktop computer, which is connected to the network via ethernet cable. The attack system is my laptop, which is ...
2
votes
1answer
80 views

nmap: why is it “silly” to combine OS finding option (-O) with bounce scan (-b)

If you run an Nmap FTP bounce scan with nmap -O -b, nmap will do the scan, but it says that the scan "seems silly" before it starts. Why would the scan be silly? It actually appears to report a ton ...
2
votes
3answers
3k views

Why does an nmap -sT scan show ports filtered but -sS shows ports closed

What are possible reasons why an nmap -sT scan would show "ports filtered" but an identical nmap -sS scan shows "ports closed"? I understand that -sT is a full TCP Connect, which is easier to detect ...
-1
votes
5answers
725 views

Can I scan with nmap from cloud services? [closed]

Can i conduct nmap scanning from cloud services (i.e AWS)? i am looking to do external scanning for my company and want to set up something that will be quick, efficient, and cheap. I dont want to ...
3
votes
2answers
796 views

OS Fingerprinting for Android

Are traditional OS-fingerprinting techniques effective in identifying Android smartphones (OS version) on a network. From my research I found most Android network mappers can be only run from Android ...
2
votes
5answers
479 views

OS fingerprinting: can I rely on the results?

Using nmap -O www.example.com I get: Running (JUST GUESSING): Microsoft Windows 7|2008 (90%) So I can say the target site is running Windows. Using xprobe2 -v www.example.com, I'm just astonished ...
0
votes
3answers
155 views

How to retrieve a site whose server is running Linux

I'm struggling to find a way to retrieve through Google a list of sites having Linux as their server operating system. Actually, I'd like to be able to test the following command: nmap -O ...
0
votes
3answers
353 views

Some issues with iptables and nmap

When I scan my pc with nmap I see only one open port. I didn't define any rule in iptables so if I'm not mistaken, all connections should be denied by default. However I can use HTTP or SSH, so that ...
3
votes
2answers
184 views

are there any services to test nmap

While playing with nmap, I have started to wonder: are there any ip addresses which were specifically made to learn how to use nmap. (As far as I understood I can not just scan any ip address, ...
2
votes
1answer
2k views

Scan multicast IP range on specific port using nmap

I'd like to scan a multicast IP range on a specific port using nmap. When I try to simply do a nmap -p 10000 239.35.0.0/16, it just responds with an error stating Strange error from connect ...
1
vote
1answer
419 views

What are the best Nmap Scripting Engine (NSE) service discovery scripts? [closed]

Using nmap -sV can be quite verbose can -sU can take a very long time especially with -p 0-65535. To narrow your results and enumerate interesting services the wealth of NSE scripts can be very ...
3
votes
2answers
287 views

Which ports are potential security risks for nmap?

I'm using nmap and I am having trouble finding which ports are dangerous and pose the greatest security risks. Which ports are potential security risks for nmap? I was thinking samba, telnet, vnc ...
4
votes
3answers
10k views

How to bypass tcpwrapped with nmap scan

I'd a scan task and I faced following result Host is up (0.032s latency). Scanned at 2012-10-25 16:06:38 AST for 856s PORT STATE SERVICE VERSION 1/tcp open tcpwrapped 3/tcp open ...