Questions tagged [nmap]
A robust and open source security tool for network discovery and security auditing.
532
questions
0
votes
0
answers
158
views
How to perform focused scan of public IP using nmap? [duplicate]
Scanning my router using the private IP address using nmap reveals the open ports:
Obtaining the public IP address of the router can be achieved by executing the command:
nslookup myip.opendns.com ...
- 101
2
votes
2
answers
122
views
Attack surface when no incoming port is open [closed]
Let's assume that the only attack to be feared on a computer is one via the network in which the machine is embedded.
What options does an attacker have if the machine has no open incoming ports?
(For ...
- 21
0
votes
0
answers
75
views
Default nmap script execution when specifying --script banner
I have a subscription for a NSE scripts feed for nmap. There are some of those scripts which have the default category (among others)
I am running nmap in the following way
nmap --privileged -oX - -T3 ...
0
votes
0
answers
98
views
nmap scanning a slow host
Is there way how to enforce nmap waiting for replies longer (10 seconds)? I want to scan an embedded device which utilizes some sleep modes and it process packets from wi-fi module with very high ...
- 101
0
votes
0
answers
153
views
NMAP same destination ip, different scanner interface, different result
I am trying to check the port status of a external IP using NMAP, I am getting different result on different interface to same destination (destination is a public IP).
When NMAP tried from the ...
1
vote
0
answers
145
views
NMAP sending ARP request to destination IP instead of default gateway [closed]
I am doing an NMAP port scan to a remote IP present in a different subnet. NMAP initiates an ARP request first to the remote IP instead of the default gateway(even if the ARP entry is present in the ...
1
vote
1
answer
424
views
Vulnerability scanning on target Android device
Is there an nmap vulnerability scanning script (vuln, vulscan, nmap-vulners etc) for scanning target Android devices on the network?
If not, is there any specific scanning tool that scans for CVE on ...
- 41
0
votes
0
answers
113
views
How to scan private IPs from the Internet [duplicate]
If we have any public IP and their private network IP, which command should we use to scan their private IP to find their vulnerabilities and open ports?
- 1
1
vote
1
answer
282
views
Nmap recommendations for ICS scanning
ICS systems seem to have to be handled with care concerning network load. So my question is if you probably have any suggestions on how to configure nmap to scan as many machines as possible in ...
- 15
0
votes
0
answers
139
views
Does NMAP detect SecurityOnion honeypots?
I'm installing SecurityOnion Intrusion Detection Honeypot. Does NMAP recognise it as CentOS7 or it might give a hint to the hacker that it is a security onion machine build?
Does SecurityOnion have ...
- 111
1
vote
0
answers
93
views
What tool can I use to verify the output from Nmap? [closed]
With OS detection enabled I noticed that the device fingerprints is running something entirely wrong. Is there another tool that I can use that can verify since something looks odd?
- 11
0
votes
1
answer
249
views
Nmap is returning different results when run on different source networks on the target same network
I am running a CODA4680 in bridge mode connected to my pfsense 1100 (and yes it is getting a true public ip). I set it up the standard way, didn't touch the rules.
I performed an NMAP scan from my ...
- 1
0
votes
1
answer
107
views
Reason ports are toggling between no-response and host unrechable for the SAME machine, why?
I'm trying to learn pentesting and one thing that triggers me for my workshop is :
I have an ip address where all reason's ports are no-response, the status for all ports are filtered but when I re-do ...
- 101
1
vote
1
answer
249
views
nmap: no exact OS matches when adding the exact signature to nmap-os-db
I'm currently trying to learn Nmap -O (OS guess feature).
I'm launching the following command: nmap -O 172.17.0.3
This command is generating the following fingerprint as output:
No exact OS ...
- 11
3
votes
2
answers
2k
views
nmap doesn't give service versions using -sV
Running the command
nmap -sV -T4 -A x.x.x.x
results in
5901/tcp open ssl/vnc-1?
|_ssl-date: TLS randomness does not represent time
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 503 ...
- 33
0
votes
1
answer
359
views
Is there a way to identify whether "filtered" state in nmap output caused by a network or host-based firewall?
Is there a way to identify whether "filtered" state for a specific port in nmap output is caused by a network firewall or host-based firewall?
- 180
2
votes
1
answer
701
views
How do I find subnets on the network in order to scan them for hosts?
I'm new to Security and I'm doing INE's Penetration Testing Student Learning path. In the current lab, (Find the Secret Server) we have this setup:
The exercise focuses on adding an entry to the ...
- 121
2
votes
1
answer
1k
views
How to remotely check if SSL 3.0 is enabled on server?
I would like to remotely verify whether SSL 3.0 is running on several servers.
Previously, this command:
openssl s_client -connect example.com:443 -ssl3
Would have worked but now I am getting the ...
- 23
0
votes
0
answers
2k
views
Scan for open ports on subdomain
I am curently scanning for open ports on a subdomain. Say I have example.com and subdomain.example.com, but this subdomain can only be reached at port 8443. How can I scan for other potential open ...
- 1
1
vote
1
answer
602
views
How to confirm what service is running on a port identified by nmap?
Probing with nmap returns BlackICE on a couple of ports however it seems to be a really old tool according to these manuals.
Starting Nmap 7.80 ( https://nmap.org ) at 2022-10-16 20:27 EDT
Nmap scan ...
- 141
1
vote
1
answer
312
views
How can I port scan my p2p device?
I have a device and I am trying to port scan it. I did the basic
nmap -A -p0- 192.168.0.x
but I am just getting
0/tcp filtered unknown
so I don't think it is working. The device works on p2p so I am ...
1
vote
1
answer
224
views
Prevent Discovery of Port from NMAP scan using -Pn
Is there a way to prevent a port from being discovered by nmap? I found that port 1433 is still being flagged as "open" when using the following command:
nmap <ip_add> -Pn -p1433
or
...
- 11
0
votes
1
answer
2k
views
Why did Nmap not yield results when scanning a friend's public IP address? [duplicate]
I am trying to learn more about Nmap but it seems like it can only really give any information if you're actually connected to the network you're scanning on. For example, a friend and I gave each ...
- 13
0
votes
1
answer
197
views
What is the version of the scanned OS?
I've scanned a target with metasploit scanner/smb/smb_version and nmap -O.
smb_version: Windows 2016 Standard (build:14393)
Nmap: Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
What is ...
0
votes
0
answers
96
views
Does fragrouter work with OpenVPN?
My goal is to evade IDS/IPS detection and scan the target with nmap. If the scan is detected, the target seems to stop responding for 10s. I think that IP Fragmentation Attack is exactly what I need.
...
- 11
1
vote
0
answers
3k
views
SSLLabs' SSLTest vs. nmap ssl-enum-ciphers
Recently I conducted a SSL server test to assess the SSL configuration of my server. While the overall grade A+ was pretty good, it was found that the server supports several cipher suites that are ...
- 121
0
votes
1
answer
447
views
Nmap reports an open port as closed
I'm running an OpenVPN server and can use it normally; I know for a fact that the port is open. Running an Nmap scan on port 1194 (the one I'm using) says it is closed. What could be causing this ...
- 74
1
vote
1
answer
175
views
The server acts as a database server , but there is no open port regarding that why?
I've taken a pen-testing course and for the final certificate, I have to analyze a server and make a report regarding the vulnerabilities.
The server does multiple functionalities, It acts as a web ...
- 41
0
votes
1
answer
901
views
How to interpret the output of nmap "vulners"
I am trying to judge the security of a web app and I have the sample output below from nmap. But I'm not really sure how to properly interpret it.
Is it merely a printout of all the CVEs for this ...
- 87
0
votes
0
answers
112
views
Stealth scan or -PS
I want to find out how -PS works for service discovery very well when there are the stealth scan options such as -sS, available in nmap.
I am currently testing nmap.scanme.org and I know there is a ...
0
votes
1
answer
17k
views
I am trying to exploit port 7000/tcp afs3-fileserver
I have been trying to exploit a cheap smart tv box that I have bought a while ago and after my nmap scan I found that port 7000/tcp was open but researching about the port gave back not much ...
- 1
2
votes
0
answers
1k
views
Check for allowed OpenVPN SSL/TLS cipher suites from the client-side
I would like to check cipher suites that the OpenVPN server accepts. I used nmap:
nmap -sU --script ssl-enum-ciphers -p 1194 <IP>
but the results are only:
Host is up (0.0033s latency).
PORT ...
- 1,323
0
votes
0
answers
86
views
nmap scanning Raspbian with strange results
I'm a high schooler in a CyberDefense Class and we are learning to PenTest.
I'm on Red Team and my teacher set up a system with Rasbian as the OS. When I run a scan on the computer scanning the Top ...
- 1
0
votes
0
answers
168
views
How to detect a firewall used
I was scanning a network with Nmap.
I'm looking for advanced commands for detecting firewalls.
6
votes
2
answers
11k
views
How do you scan multiple subnets using Nmap?
I'm looking to scan a network with multiple subnets. I'm looking for a way to shorten this to one command rather than entering each subnet. So let's say I'm try to scan 192.168.1.xx, 192.168.2.xx and ...
- 71
2
votes
1
answer
281
views
How are nmap arp pings implemented?
Nmap issues the raw ARP requests and handles retransmission and
timeout periods at its own discretion
The above is how nmap describes arp pings, but how is a layer 2 concept returned to the sender (...
- 23
1
vote
0
answers
125
views
How to evaluate a responsive but unknown network protocol?
I am studying CREST CPSA where the syllabus is listed here.
There is a part of the syllabus which states I should know the Evaluation of responsive but unknown network applications.
I find this ...
- 201
2
votes
0
answers
1k
views
Windows XP SP3 2002 is not vulnerable to MS08-067
Why is my VM not vulnerable to MS08-067?
There are similar question on stack exchange, yes, but they fail to specify all relevant information and so non receive a meaningful, thoughtful nor thorough ...
1
vote
1
answer
1k
views
Why when i nmap scan a machine i get the port 554 (RTSP) open?
I train on vulnerable boxes and during my recon phase, I use nmap to collect info on open ports.
I use the command nmap -sS [IP|URL] and no matter the machine, I get the result that port 554 - RTSP ...
- 11
1
vote
1
answer
1k
views
What are the drawbacks of a stealthy port scan?
I read that port scanning services like nmap will conduct a "TCP Connect Scan". They'll attempt to make a TCP connection to each of the ports within the range provided. But because each of ...
- 113
0
votes
1
answer
554
views
Nmap returns both, mysql and mariadb versions, how do I khow which one is actually running?
I ran nmap scan and output included following line:
3306/tcp open mysql MySQL 5.5.5-10.3.25-MariaDB-0+deb10u1
How do I know which one is actually running, MySQL or MariaDB?
- 119
3
votes
3
answers
332
views
What is the value of port knocking when I have strict firewall rules
I have specifically allowed three external machines to SSH into my server. All other traffic will be dropped. Using nmap from another machine, I am unable to see my server's SSH port and it shows ...
- 41
0
votes
0
answers
37
views
How to configure Snort 3 to detect nmap's port scanning? [duplicate]
How to configure snort 3 to detect nmap's port scanning? For instance I want to know that an external machine A is looking with nmap for open ports on my machine B.
Such a port scan can include all ...
- 101
0
votes
1
answer
246
views
ncrack ssl option
There is the following option in ncrack (from the man page):
Misc options:
ssl: enable SSL over this service
ssl (Enable/Disable SSL over service)
By enabling SSL, Ncrack will try to open a TCP ...
- 252
1
vote
1
answer
3k
views
difference between icmp ping scan and normal ping scan
I'm learning to use nmap on my kali linux and was testing out the various types of scans available in it.
-sn is for ping scan which basically prevents nmap from scanning all the ports (and probably ...
- 113
0
votes
1
answer
572
views
Fingerprinting Cisco ASA Device
I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host&...
- 3
1
vote
1
answer
2k
views
Blocking nginx from nmap version detection [duplicate]
Is there an efficient way to hide nginx from Nmap's Version Detection scan (nmap -sV)? The following is a sample result, we are trying to hide the nginx (reverse proxy) string.
PORT STATE SERVICE ...
- 13
0
votes
1
answer
249
views
does Nmap automatically use proxychains if configured?
I have configured my proxy chains in /etc/proxychains.conf. Then when just run nmap or even nc without the proxychains prefix, it automatically uses the proxy chains and routes the traffic through the ...
- 11
1
vote
3
answers
3k
views
Scanning a domain name
When we scan a domain name such as www.nmap.org,
Question 1: We are actually scanning the server that the website is hosted on, right?
Question 2: If there is another domain hosted on the same server, ...
- 41
0
votes
1
answer
10k
views
How to resolve hostnames with nmap to perform scans?
I went through old threads on this forum and tried --resolve-all but it doesn't seem to work.
If I use nmap -sn <hostname> It throws an error Failed to resolve <hostname>
If I use nmap -sn ...
- 1