Security scanner for computers and networks.

learn more… | top users | synonyms

1
vote
0answers
730 views

What is my router listening for on ports 5555 and 3333? [closed]

I recently discovered nmap and pointed it at my router out of curiosity. It found that ports 3333 and 5555 are open but doesn't recognise either service. I investigated and found: I can successfully ...
3
votes
1answer
196 views

Honeyd Isn't Detecting Loud Scans [closed]

I've got the Honeyd honeypot in one virtual machine (kali) and nmap in another (ubuntu), the config file looks like this: create default set default default tcp action closed set default default udp ...
2
votes
2answers
726 views

Why does NMAP scan list hosts as up? [closed]

When running an NMAP scan of my internal network (192.168.1.0/24) from my Mac, NMAP sees all hosts as live. It also believes there is a port 80 http service running on every IP when I do not have 254 ...
1
vote
2answers
163 views

Nmap scan list of domains and provide boolean if up/down

I have a newline separated list of domains that I would like to perform an arbitrary nmap scan on (e.g. aggressive, syn) and I would like to output a boolean that indicates whether or not any ports ...
5
votes
5answers
19k views

How to bypass tcpwrapped with nmap scan

I'd a scan task and I faced following result Host is up (0.032s latency). Scanned at 2012-10-25 16:06:38 AST for 856s PORT STATE SERVICE VERSION 1/tcp open tcpwrapped 3/tcp open ...
7
votes
2answers
524 views

How nmap guesses the operating system?

nmap has the capability to guess the operating system with the option -O. I was highly surprised that it can find the correct kernel or service pack. * How nmap guesses the operating system? * What ...
1
vote
2answers
122 views

nmap crashing embedded-system in strange way

I'm trying to find out what nmap-commands crash an embedded-system. In the process I can see behaviour that I don't understand: On the system port 80 is open and 79 is closed. nmap -p 79-80 -T5 -A ...
5
votes
1answer
372 views

Where can I use the TCP FIN scan?

For a coursework i've got to run the various port scans, i'm having trouble with the FIN scan though, I can't seem to find a system where I can try it, everywhere I try it all ports either come back ...
15
votes
2answers
2k views

Is it possible to identify who's behind a nmap -D scan?

Nmap's -D option stands for decoy, which means that the attacker can simulate that the attack is coming from multiple IPs, including attacker's IP. From the point of view of the victim, is it ...
0
votes
2answers
185 views

viability scanner inside AWS

So I have 2 soon to be 3 VPC's within AWS, I want to run a automated nmap scan on all three VPC's every few weeks to make sure nothing has been opened, added etc what would be the best way to achieve ...
0
votes
2answers
275 views

Does Nmap requires a closed TCP port to do OS fingerprinting?

I was checking the security of a server by running Nmap. Last time it gives me the following results, indicating that OS could not be fingerprinted: PORT STATE SERVICE VERSION 21/tcp ...
2
votes
1answer
76 views

Optimal flags to specify when using nmap to guess the OS on remote devices?

Optimal flags to specify when using nmap to guess the OS on remote devices? I'm currently using the following: nmap --privileged -sS -sU -sY -sZ -O --osscan-guess -F -r 192.168.200.223 This seems ...
2
votes
2answers
524 views

Nmap scanning computers behind a wireless modem [closed]

Let's suppose that I have a router and three computers connected to Internet through that router. When I tried to get the external IP address for each computer, I got the same address. I think this ...
0
votes
1answer
264 views

nmap - “No exact OS matches for host (test conditions non-ideal)” even with 1 open, 1 closed port

I'm trying to do some Nmap OS detection and I'm running into some results I don't understand. The scan I'm running is the following: nmap -O -F -v -T2 -oA nmap-uphosts-OSdetect -iL < my_in_file ...
2
votes
1answer
86 views

Is there any difference for OS fingerprint technique used in Nmap inside -A and -O?

Is there any difference between the technique or algorithm used from Nmap to guess the OS between the option -A and -O? If not, why -O option requires root privileges but -A that it is doing at least ...
0
votes
1answer
141 views

NMAP not reporting open ports with -sS scan

Is there any reason why an -sS scan (or most others) would not report an open port that doesn't have a service attached to it? For example, in a regular -sS scan, the following port will be missing, ...
2
votes
2answers
2k views

How to block network scans with pfsense?

I am using pfsense as firewall, and I would like to know how I can stop network scans from enumerating open services and ports. Thanks
0
votes
2answers
595 views

Identifying HP Printers with NMAP and then using results in Python/Perl

Great write up on network printer hacking at IronGeek's site here for anyone interested http://www.irongeek.com/i.php?page=security/networkprinterhacking. Here's what I want to do: Scan the subnet ...
1
vote
2answers
242 views

Nmap stealth scan shows that port is filtered

The title is really bad, but I was able to find better. I have installed Debian on VMware, and set iptables to block any traffic except port 80 (inbound and outbound). When I run a nmap scan it shows ...
-1
votes
1answer
199 views

How to create a script that returns only the mobile devices on a network using NMAP

I would like to create a script using NMAP on Mac that 1) scans the entire LAN, and 2) Returns the number of mobile devices.
1
vote
3answers
375 views

What exactly does one get from a Nmap Scan?

I know nmap is a port scanner and its output shows all the open ports, the services running on those ports, the underlying OS and technology, etc. What should one take from this result in easiest ...
0
votes
2answers
153 views

Nmap reporting the status of a port as both opened and closed

If I do not define any range (or if the range is large like a hundreds of ports), Nmap is returning ports as opened. However, if I put a smaller range or just scan a specific port, it says it's ...
0
votes
1answer
105 views

If I port scan a server on the outside of a firewall will this also tell me the ports the firewall is blocking?

Theoretically I was thinking a firewall inspects the TCP header and looks at the destination port and discards/forwards based on its firewall rules. So could I port scan an external server to the ...
0
votes
1answer
2k views

how to bypass windows xp firewall with nmap

I'm scanning a Windows XP in a virtualized environment. I use all of needed arguments to bypass its firewall but it doesn't answer: nmap -e eth0 -Pn --data-length 5 --badsum -g 80 -S 192.168.1.103 -f ...
0
votes
3answers
429 views

nmap.online inconsistent results

I recently used nmap online to test my firewall security on the WAN port. I purposely did some port forwarding but received inconsistent results. I opened ports 6881 to 6889 on the firewall and did 2 ...
2
votes
2answers
4k views

NMAP DNS Service Detection

I was looking out how NMAP identifies DNS services. After determining that port 53 is open it issues a standard query TXT version.bind to find out if BIND is running on the domain port. Then, I saw ...
0
votes
1answer
3k views

Nmap SSL service detection: How to check all open ports only for SSL service?

I am running nmap to probe services that use SSL.¹ In order to detect vulnerability in non-standard ports, I am using the -sV option to perform service discovery. But it is very slow since it runs ...
3
votes
1answer
591 views

Scan All private subnets with NMAP [closed]

I have a managed switch on my network but I don't remember the subnet. How can I scan all the private network without changing my ip address : 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 Thanks for ...
1
vote
4answers
218 views

Comprehensive audit of firewall - is Internet truly not accessible?

We have many Linux servers in several co-locations over the world. By design, these machines generally should not be able to access the Internet. Depending on location and role, some sites may have ...
2
votes
1answer
4k views

How do I use nmap to scan a range of IPv6 addresses? [closed]

I need to scan a range of IPv6 addresses with Nmap, but I'm not sure how to do this. When scanning for an IPv4 range, I would usually do this: nmap -sP 192.168.*.* or nmap -sP 192.168.1.* but if ...
3
votes
2answers
2k views

Why do multiple IP Addresses in my local network point to the same computer?

I'm new to linux and nmap, and I am attempting to do a scan of my local network. Using nmap I find that there are 4 hosts on my network (10.0.2.2, 10.0.2.3, 10.0.2.4, 10.0.2.15). I am using VirtualBox ...
4
votes
2answers
487 views

Determing live hosts past a restrictive firewall with nmap

Sometimes when I am doing an external security assesment, I run into hosts that have the following restrictions/configuration: All ICMP traffic is blocked An IDS or some device returns all ports as ...
9
votes
4answers
3k views

nmap showing unknown IPs on private network

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
1
vote
0answers
375 views

Bypass Nmap Scans Being Blocked [closed]

A friend has set up a VM for me to play with, I am currently stuck on a little problem: On this network he set up, there are 6 machines and a router, 5 servers (plus the router) show up on a typical ...
3
votes
1answer
164 views

Use nmap correctly

I currently have a VPS in a data center, I asked the admin to open a port to install a ftp server. It opened port 3345, at first I tought the port is not forwarded correctly, because I ran nmap as ...
0
votes
1answer
824 views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
2
votes
1answer
94 views

Does nmap limit probes when using time limiting on decoy scans?

If I set a rate limit (e.g. -T1) on an nmap scan that uses decoys, does the rate limit apply to all probes, or just each individual source? I checked the documentation, but can't see anything ...
4
votes
5answers
3k views

Nmap reporting almost every port as open

I have noticed during some assesments when doing a TCP port scan, Nmap will report almost every port as open for a machine. Using for example nmap -sS -PN -T4 target -p0-65535, over 20,000 ports will ...
0
votes
1answer
270 views

Is it possible to scan a remote host in another network if I know a port that is opened?

First of all, this question is not the same as is it possible to test out remote host by using nmap?, because on that question, the questioner is asking for something impossible due to NAT's nature. ...
6
votes
2answers
3k views

How does nmap do a zombie and decoy scan?

We're learning nmap in my ethical hacking class. We got showed how we can use nmap to perform a zombie scan: nmap -PN -sI zombieIP targetIP and decoy scan: nmap -p 135 -D decoyIP targetIP I ...
1
vote
1answer
794 views

How does nmap determine if it's running HTTP service on a port? Fails here

I'm running apache on 192.168.56.178, which listens on port 80, 8090 and 8095 (configured as <VirtualHost *>). Now If I open my browser and point to any of those 3 ports, e.g ...
1
vote
3answers
336 views

Port Scanning Host that has Rate Limiting Enabled

I am trying to enumerate on of my lab machines. It seems that it has rate limiting enabled since I am getting blocked after the first few probes. I need to scan the whole 65535 tcp ports. I tried ...
4
votes
3answers
9k views

Why does an nmap -sT scan show ports filtered but -sS shows ports closed

What are possible reasons why an nmap -sT scan would show "ports filtered" but an identical nmap -sS scan shows "ports closed"? I understand that -sT is a full TCP Connect, which is easier to detect ...
0
votes
1answer
143 views

Understanding a Zenmap output

I'm running Zenmap on my Windows 7 laptop. I ran an intense scan with UDP targeting my router 192.168.1.1.I realize that I'm probing into the back end of the router from the inside and that any open ...
4
votes
1answer
566 views

Is it possible to detect host-machine of my virtual-machines?

So basically I need to know is there any way to find a connection (or relation) between packets sent by my VMs and my host machine. In my lab I have lots of workstations, each running a VirtualBox ...
11
votes
4answers
3k views

Is my network being sniffed?

Is there any way to find out if someone who is connected to my network is sniffing packets? There is a way with nmap if his card is in promiscuous mode but what if it is passive?
6
votes
4answers
886 views

Trying to firewall ports 1863, 5190

I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need. But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further? ...
1
vote
4answers
3k views

How to make nmap list an unfiltered port?

I have a host that is NAT'ed and I have opened a single port in my router so the host is reachable by the external world. I tested if it was reachable by running a service and connecting to it ...
9
votes
3answers
17k views

How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve ...
5
votes
1answer
5k views

How can I see traceroute details in NMAP?

I'm using NMAP for Network scan ; The output does not contain the full traceroute details. Can I view all intermediate routers/hosts using the NMAP GUI? A simple VPN connection IP traceroute... ...