Security scanner for computers and networks.

learn more… | top users | synonyms

6
votes
3answers
1k views

What are the security issues of open ports?

What could be the threats of having the ports open, after performing a nmap scan and identifying the open ports? I already searched for some answers for this question, but couldn't find anything ...
2
votes
1answer
155 views

Understanding nmap output / author explanation …(Scapy)

I just read this example and explanation (below) in the OReilly book Security Power Tools (2007) in section 6.3 that is written by the creator of Scapy, Philippe Biondi. I think the example is very ...
2
votes
2answers
4k views

nmap no ping returns host is active and all ports are filtered

I am trying to determine if hosts are up. For hosts where a ping fails, I run a nmap (6.40) Regular and/or Quick scan. For a subset of my hosts, the nmap response is "Host seems down". As a follow up ...
1
vote
1answer
241 views

Why is nmap that slow on my system (ubuntu 14.04)?

I just started to learn something about portscanning with nmap. when i try to run an a nullscan or any other type on a virtual machine (win7 no firewall) the scan needs a lot of time to perform: ...
-2
votes
2answers
518 views

Which all ports are in danger and needs to be closed with immediate attention?

This is the nmap scan results on my server (used for email and web serving) from a remote scan. Which all ports are in danger and why? PORT STATE SERVICE 21/tcp open ftp 25/tcp open ...
2
votes
2answers
527 views

How to force nmap to check all the ports?

I heard that nmap scans for only 1000 most common ports while we do server scan. Is it possible to force nmap to check all the ports for scanning? If yes,How?
0
votes
4answers
422 views

nmap mac os lots of questionable ports open

Ive been recently trying to lock down my network at home and suspect that someone has hacked my linksys router because port 3128 seems to be open through the router and I have no knowledge setting or ...
0
votes
2answers
371 views

different results using nmap with/without sudo

Why is the reason that after running $ nmap -sP 192.168.1.0/24 I got three results, but running $sudo nmap -sP 192.168.1.0/24 shows seven results. What is the role of using sudo here?
-3
votes
1answer
129 views

Is there scan-me-for-vulnerabilities services? [closed]

Where can I get more similar to nmap.online-domain-tools.com scan services. Edit: Probably, nobody know what does nmap.online-domain-tools.com is. I'm trying to explain: Network service. For ...
-2
votes
1answer
45 views

What does running nmap on a server reveal about your computer?

If you run the nmap command on a server eg. nmap espn.com or nmap -Pn espn.com what information does that reveal to the server about you (eg. ip address or MAC address)? Does using a private vpn ...
1
vote
1answer
246 views

Nmap from Kali Linux and from Amazon EC2 instance - vastly differing results

I'm running a basic scan using nmap from 1) a VM of Kali Linux running on personal machine 2) an instance of Amazon Linux, running on Amazon's EC2 cloud These two runs (against any target) are ...
-1
votes
1answer
140 views

What does “unknown” status in nmap mean? [duplicate]

scanned my IP number with nmap and I got all "unknown" status ports. What does that mean?
1
vote
0answers
888 views

What is my router listening for on ports 5555 and 3333? [closed]

I recently discovered nmap and pointed it at my router out of curiosity. It found that ports 3333 and 5555 are open but doesn't recognise either service. I investigated and found: I can successfully ...
3
votes
1answer
219 views

Honeyd Isn't Detecting Loud Scans [closed]

I've got the Honeyd honeypot in one virtual machine (kali) and nmap in another (ubuntu), the config file looks like this: create default set default default tcp action closed set default default udp ...
2
votes
2answers
995 views

Why does NMAP scan list hosts as up? [closed]

When running an NMAP scan of my internal network (192.168.1.0/24) from my Mac, NMAP sees all hosts as live. It also believes there is a port 80 http service running on every IP when I do not have 254 ...
1
vote
2answers
187 views

Nmap scan list of domains and provide boolean if up/down

I have a newline separated list of domains that I would like to perform an arbitrary nmap scan on (e.g. aggressive, syn) and I would like to output a boolean that indicates whether or not any ports ...
5
votes
5answers
21k views

How to bypass tcpwrapped with nmap scan

I'd a scan task and I faced following result Host is up (0.032s latency). Scanned at 2012-10-25 16:06:38 AST for 856s PORT STATE SERVICE VERSION 1/tcp open tcpwrapped 3/tcp open ...
7
votes
2answers
561 views

How nmap guesses the operating system?

nmap has the capability to guess the operating system with the option -O. I was highly surprised that it can find the correct kernel or service pack. * How nmap guesses the operating system? * What ...
1
vote
2answers
140 views

nmap crashing embedded-system in strange way

I'm trying to find out what nmap-commands crash an embedded-system. In the process I can see behaviour that I don't understand: On the system port 80 is open and 79 is closed. nmap -p 79-80 -T5 -A ...
5
votes
1answer
419 views

Where can I use the TCP FIN scan?

For a coursework i've got to run the various port scans, i'm having trouble with the FIN scan though, I can't seem to find a system where I can try it, everywhere I try it all ports either come back ...
15
votes
2answers
2k views

Is it possible to identify who's behind a nmap -D scan?

Nmap's -D option stands for decoy, which means that the attacker can simulate that the attack is coming from multiple IPs, including attacker's IP. From the point of view of the victim, is it ...
0
votes
2answers
220 views

viability scanner inside AWS

So I have 2 soon to be 3 VPC's within AWS, I want to run a automated nmap scan on all three VPC's every few weeks to make sure nothing has been opened, added etc what would be the best way to achieve ...
0
votes
2answers
343 views

Does Nmap requires a closed TCP port to do OS fingerprinting?

I was checking the security of a server by running Nmap. Last time it gives me the following results, indicating that OS could not be fingerprinted: PORT STATE SERVICE VERSION 21/tcp ...
3
votes
1answer
81 views

Optimal flags to specify when using nmap to guess the OS on remote devices?

Optimal flags to specify when using nmap to guess the OS on remote devices? I'm currently using the following: nmap --privileged -sS -sU -sY -sZ -O --osscan-guess -F -r 192.168.200.223 This seems ...
2
votes
2answers
658 views

Nmap scanning computers behind a wireless modem [closed]

Let's suppose that I have a router and three computers connected to Internet through that router. When I tried to get the external IP address for each computer, I got the same address. I think this ...
1
vote
1answer
319 views

nmap - “No exact OS matches for host (test conditions non-ideal)” even with 1 open, 1 closed port

I'm trying to do some Nmap OS detection and I'm running into some results I don't understand. The scan I'm running is the following: nmap -O -F -v -T2 -oA nmap-uphosts-OSdetect -iL < my_in_file ...
2
votes
1answer
98 views

Is there any difference for OS fingerprint technique used in Nmap inside -A and -O?

Is there any difference between the technique or algorithm used from Nmap to guess the OS between the option -A and -O? If not, why -O option requires root privileges but -A that it is doing at least ...
0
votes
1answer
154 views

NMAP not reporting open ports with -sS scan

Is there any reason why an -sS scan (or most others) would not report an open port that doesn't have a service attached to it? For example, in a regular -sS scan, the following port will be missing, ...
2
votes
2answers
3k views

How to block network scans with pfsense?

I am using pfsense as firewall, and I would like to know how I can stop network scans from enumerating open services and ports. Thanks
0
votes
2answers
666 views

Identifying HP Printers with NMAP and then using results in Python/Perl

Great write up on network printer hacking at IronGeek's site here for anyone interested http://www.irongeek.com/i.php?page=security/networkprinterhacking. Here's what I want to do: Scan the subnet ...
1
vote
2answers
306 views

Nmap stealth scan shows that port is filtered

The title is really bad, but I was able to find better. I have installed Debian on VMware, and set iptables to block any traffic except port 80 (inbound and outbound). When I run a nmap scan it shows ...
-1
votes
1answer
234 views

How to create a script that returns only the mobile devices on a network using NMAP

I would like to create a script using NMAP on Mac that 1) scans the entire LAN, and 2) Returns the number of mobile devices.
1
vote
3answers
431 views

What exactly does one get from a Nmap Scan?

I know nmap is a port scanner and its output shows all the open ports, the services running on those ports, the underlying OS and technology, etc. What should one take from this result in easiest ...
0
votes
2answers
167 views

Nmap reporting the status of a port as both opened and closed

If I do not define any range (or if the range is large like a hundreds of ports), Nmap is returning ports as opened. However, if I put a smaller range or just scan a specific port, it says it's ...
0
votes
1answer
118 views

If I port scan a server on the outside of a firewall will this also tell me the ports the firewall is blocking?

Theoretically I was thinking a firewall inspects the TCP header and looks at the destination port and discards/forwards based on its firewall rules. So could I port scan an external server to the ...
0
votes
1answer
2k views

how to bypass windows xp firewall with nmap

I'm scanning a Windows XP in a virtualized environment. I use all of needed arguments to bypass its firewall but it doesn't answer: nmap -e eth0 -Pn --data-length 5 --badsum -g 80 -S 192.168.1.103 -f ...
0
votes
3answers
449 views

nmap.online inconsistent results

I recently used nmap online to test my firewall security on the WAN port. I purposely did some port forwarding but received inconsistent results. I opened ports 6881 to 6889 on the firewall and did 2 ...
2
votes
2answers
5k views

NMAP DNS Service Detection

I was looking out how NMAP identifies DNS services. After determining that port 53 is open it issues a standard query TXT version.bind to find out if BIND is running on the domain port. Then, I saw ...
0
votes
1answer
3k views

Nmap SSL service detection: How to check all open ports only for SSL service?

I am running nmap to probe services that use SSL.¹ In order to detect vulnerability in non-standard ports, I am using the -sV option to perform service discovery. But it is very slow since it runs ...
3
votes
1answer
669 views

Scan All private subnets with NMAP [closed]

I have a managed switch on my network but I don't remember the subnet. How can I scan all the private network without changing my ip address : 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 Thanks for ...
1
vote
4answers
230 views

Comprehensive audit of firewall - is Internet truly not accessible?

We have many Linux servers in several co-locations over the world. By design, these machines generally should not be able to access the Internet. Depending on location and role, some sites may have ...
2
votes
1answer
5k views

How do I use nmap to scan a range of IPv6 addresses? [closed]

I need to scan a range of IPv6 addresses with Nmap, but I'm not sure how to do this. When scanning for an IPv4 range, I would usually do this: nmap -sP 192.168.*.* or nmap -sP 192.168.1.* but if ...
3
votes
2answers
2k views

Why do multiple IP Addresses in my local network point to the same computer?

I'm new to linux and nmap, and I am attempting to do a scan of my local network. Using nmap I find that there are 4 hosts on my network (10.0.2.2, 10.0.2.3, 10.0.2.4, 10.0.2.15). I am using VirtualBox ...
4
votes
2answers
503 views

Determing live hosts past a restrictive firewall with nmap

Sometimes when I am doing an external security assesment, I run into hosts that have the following restrictions/configuration: All ICMP traffic is blocked An IDS or some device returns all ports as ...
9
votes
4answers
3k views

nmap showing unknown IPs on private network

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
1
vote
0answers
407 views

Bypass Nmap Scans Being Blocked [closed]

A friend has set up a VM for me to play with, I am currently stuck on a little problem: On this network he set up, there are 6 machines and a router, 5 servers (plus the router) show up on a typical ...
3
votes
1answer
181 views

Use nmap correctly

I currently have a VPS in a data center, I asked the admin to open a port to install a ftp server. It opened port 3345, at first I tought the port is not forwarded correctly, because I ran nmap as ...
0
votes
1answer
907 views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
2
votes
1answer
100 views

Does nmap limit probes when using time limiting on decoy scans?

If I set a rate limit (e.g. -T1) on an nmap scan that uses decoys, does the rate limit apply to all probes, or just each individual source? I checked the documentation, but can't see anything ...
4
votes
5answers
3k views

Nmap reporting almost every port as open

I have noticed during some assesments when doing a TCP port scan, Nmap will report almost every port as open for a machine. Using for example nmap -sS -PN -T4 target -p0-65535, over 20,000 ports will ...