Security scanner for computers and networks.

learn more… | top users | synonyms

1
vote
1answer
51 views

How can I know why Nmap identified a service or OS the way it did?

Nmap uses a variety of testing methods and fingerprints to determine - or at least guess at - what services are running on each discovered port, and what operating system is running on the host. (When ...
1
vote
2answers
74 views

Scanning a Foreign Network for Active Hosts using Nmap or Hping3

I Have a Router setup at my home. I Just have a private IP. I wanted to scan for active hosts on my network. When I do it locally, I use, Nmap, nmap -sn -v x.x.x.* So, is their any way to do it ...
5
votes
1answer
1k views

Firewalk through a Firewall on our subnet

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram: (Skip to the bottom of the following explanation for a direct list of ...
1
vote
2answers
16 views

How do I ask nmap to probe designated service type, and do not run scripts?

I would like to probe if a port is running socks or squid service, but nmap runs all service probes by default, can I change that? Also from the debug output, there's a NSE script pre-scanning, can I ...
3
votes
1answer
31 views

Why can't nmap identify the danted(socks5) service on non-standard port?

I'm testing nmap's abilities, I started a socks5 proxy server with danted, and started it on port 10090 I tried the following command, and expect it to tell me port 10090 runs a socks server, nmap ...
5
votes
2answers
95 views

Nmap update - SSL/TLS ciper strength indication

Previously with nmap I found it easy to understand the strengths of ciphers noted by the tool (strong, weak...) However this has now changed to a rating of A-F. What does this mean and why did they ...
4
votes
1answer
91 views

Armitage check exploit

I am with all fairness not the most experienced penetration tester, I am doing an industry placement where I can improve my skills. I am using Armitage in Kali Linux to check for vulnerabilities in ...
1
vote
2answers
105 views

Nmap scan report with all port status

Is there a way to ask nmap to print the final scan report with the state of all ports tested and the reason? For example when the scan is launched with --reason : Nmap scan report for 127.0.0.1 ...
2
votes
1answer
496 views

What is the fastest way to scan all ports of a single machine

I am doing some research and I need a very quick way to scan for open ports on a single machine. To provide some context, I know that my machine will have a port open waiting for UDP packets for about ...
-1
votes
2answers
127 views

Nmap - host discovery doesn't show all hosts

I tried to scan my network for hosts. However, it seems like it didn't scan the MAC. I tried all kinds of TCP and UDP scans on different kind of ports but the hosts doesn't show up. It's strange ...
3
votes
0answers
34 views

NMAP host discovery reporting discrepant results between NAT and Bridged mode

I figured this would be the most relevant place to ask this question. I'm using a Kali VM to run some network scans. The results are different depending on whether my network interface is bridged or ...
2
votes
2answers
507 views

nmap says “variable 'keys' is not declared” when trying to run ssl-ccs-injection.nse

I'm running nmap 6.47 on Windows 7 and am trying to run the ssl-ccs-injection.nse script. After getting an error, I ran it with the -d (debug) option and the error in the subject is what showed up. I ...
2
votes
1answer
54 views

How to perform an idle scan against a target using Nmap with a list of zombies? [closed]

I want to perform port scan against a target but the firewall at the target only allows traffic to the ports through certain IP address/machines. I tried to perform an idle scan in Nmap but it only ...
0
votes
2answers
243 views

How to scan for ports opened by TCP/UDP sockets with nmap or any other tool?

I'm new to nmap and I've been digging with it lately to scan some devices on the current LAN for ports opened by socket programs which are running. First I ran a simple UDP server on my machine on ...
3
votes
1answer
451 views

Detecting POODLE and BEAST using nmap

Need your expert advice for the following - POODLE - We can deduce if a server is vulnerable to poodle if it supports sslv3 protocol and uses CBC Ciphers. BEAST - Any server supporting sslv3 OR TLS ...
3
votes
0answers
119 views

Unknown ports shown on Nmap scan…and other strange behavior

My local network has been exhibiting some inexplicable behaviour. Firstly connecting to my websites domain name from inside the lan redirected me to my router's login page. I checked again with 3g ...
3
votes
1answer
71 views

Can still ping from secure network?

I have a standard network and wanted to make a more secure one so I bought a second router and set it up as a separate network daisy chained so it can get internet. I managed to make the setup, with ...
1
vote
1answer
39 views

Network Scans Find Absent Device

Using Nessus (an uncredentialed full scan) and Nmap (essentially a full port scan), I am finding a phantom device. This device is supposed to be a well-out-of-commission device, but is returning a ...
0
votes
5answers
1k views

NMAP scan fails

I started to read a metasploit guide book so I set up 2 Machines in VirtualBox for pen testing (host - BT 5, the second - WinXP SP2). When Im trying to scan open ports with NMAP on the Windows machine,...
1
vote
1answer
57 views

Nmap scan giving different result to my iptables configuration

I am running a simple webserver on a VPS, the only ports I have open are 80 - for HTTP (webserver) 12345 - an unusual port for SSH connection to administer server. I wanted to see how my ...
0
votes
1answer
70 views

nmap SYN scan taking forever

I read on a book that the SYN scan in nmap is usually a lot faster than the TCP connect scan, because it doesn't go through all the three way handshake connection. But when i try both scans on the ...
0
votes
1answer
44 views

what does Pn options stands for in nmap [closed]

I have a very weak memory, and i can't remember an option unless i understand what it stands for. I can remember -sT option in nmap because i know that s stands for scan, and T for TCP Connect. I ...
2
votes
3answers
774 views

Nmap http-brute - Supplying arguments for bruting via GET

I'm attempting to brute a site in my test lab with Nmap's http-brute nse, which has the URL structure https://192.168.101.6/api/auth?email=a@b.com&password=pass Unfortunately Nmap's official ...
0
votes
1answer
106 views

Open ports on router

I have a TP-Link TD W8970 modem/router. Just for fun i tried to perform a port scan on it. I found this: $ nmap -p 1-65535 -n 192.168.1.1 Starting Nmap 6.00 ( http://nmap.org ) at 2016-01-21 16:17 ...
1
vote
1answer
166 views

NMap Showing Unknown Private IPs

Like this question nmap is showing unknown IPs from 192.168.2.* in my home network which has an IP range of 192.168.1.*. Unlike the above question, every single IP appears to be completely locked ...
0
votes
0answers
93 views

Establish dynamic port forward/proxy-chain through compromised Windows host

The scenario Attacker IP (public): 1.2.3.4 Compromised Windows Workstation IP (internal): 4.5.6.7 Setup: Firewall between workstation and attacker IP, permits outbound connections on port 21. ...
-5
votes
3answers
4k views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
1
vote
2answers
111 views

Why does nmap remotely show when I have port 6969 open, but not others?

Specifically, I was running a node.js application on port 6969 which I thought was strictly local. I discovered this was not the case when I ran nmap <myip> from a different computer and found ...
4
votes
3answers
284 views

Nmap showing ISPs router's DNS port in addition to target's ports

Whenever I do nmap scans my ISP router DNS port like the following. This happens for every IP or target. $ nmap -T4 -A -v stackoverflow.com PORT STATE SERVICE VERSION 53/tcp open domain ...
3
votes
2answers
392 views

Deauth all users on AP except yourself

I am looking to create a small first project to further my self education into infosec. I will be putting this on my Github. My idea is to create a script that automates the process of deauthing all ...
1
vote
1answer
219 views

Nmap NSE Password Brute Force is Stopping on First Positive Instance

I'm running an Nmap brute force against metasploitable2 (telnet). The script is stopping on the first found username/password and is not iterating through the entire user/password file i have provided....
0
votes
1answer
65 views

Resuming an interrupted nmap scan:

I need to: --resume <filename>: Resume an aborted interrupted scan. But I didn’t: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, ...
-1
votes
1answer
473 views

Netdiscover running on NAT interface not finding IP addresses on host-only network?

I am practicing penetration testing techniques using Kali Linux (most recent distro) and various vulnerable virtual machines (DVWA, Metasplotiable). My attack and targets are all running via VMPlayer....
5
votes
1answer
7k views

Nmap scan produces all “unknown”

I scanned both localhost, and the IP address of the LAN adapter, and this is the produced output. Starting Nmap 5.51 ( http://nmap.org ) at 2012-10-12 18:06 Eastern Daylight Time Skipping SYN Stealth ...
1
vote
2answers
3k views

Proxychains + nmap = segmentation fault

If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:- root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p 22,80,222,...
1
vote
2answers
96 views

Is a Windows (fresh installation) 7 really this safe against NMAP or am I missing something?

I am playing with NMAP in my small private network performing port scanning. So far I went through scanning the following OSs (Unaltered new installations - Meaning no extra software installed!): ...
0
votes
1answer
151 views

Why are db_nmap results filtered, but Nmap is not

I've recently started playing with Kali on VMWare Player and Metasploitable 2 on VmWare Player. Both are on the same (default install) subnet. Metasploitable 2 has 2 adapters: settings:NAT and Host ...
1
vote
1answer
80 views

Open TCP port on cable modem TG1672G

TG1672G cable modem in bridge mode, the modem's built in router still gets a IPv4/IPv6 public address (and devices connected to the modem can get public IPv4/IPv6 addresses too). This modem is Intel ...
2
votes
0answers
174 views

nmap OS scan showing DD-WRT when I'm not running it?

This weekend, I set up pfSense on a spare box that I had sitting in the garage. It seems cool and powerful, but I haven't messed with it much yet. Was doing some basic nmap scanning from work against ...
1
vote
1answer
35 views

NMAP's explicitely closed ports

I'm working on a challenge and I notice this odd output for a full port scan? abc@desktop:~$ nmap -T5 -p- -sV x.x.x.x -PN Interesting ports on x.x.x.x: Not shown: 65533 filtered ports PORT ...
1
vote
2answers
150 views

Network scan across multiple subnets and output list of names and IP's

We have multiple sites with multiple subnets. We have mandated that the admins at those sites enter DNS names for all devices that exist on the network. (anything with an IP gets a name) I want to be ...
7
votes
1answer
1k views

Message signing disabled (dangerous, but default)

Over the last couple of years, I've developed a fairly keen interest in Penetration Testing & Information Security. Throughout this time, I've acquired (and accumulated) a range of different ...
2
votes
2answers
211 views

Router reboots when using Nmap

I hope this question is OK to ask here. When I scan a external IP-address with Nmap my router always reboots itself, sometimes I even have to manually restart it by using the power switch. The ...
1
vote
1answer
45 views

Does nmap port scan return the correct ports for the websites that don't allow direct IP access

I am new to the field of penetration testing, and I'm currently testing an application, for learning purposes with their legit, written permit. When I did a nslookup for that site, it returned me an ...
1
vote
2answers
201 views

nmap localhost UDP scan fails, even though netcat is listening

I open two terminal windows on my linux box. On one, I have netcat listen to a UDP port and on other I nmap -sU that port. Netcat receives the connection and the data, but nmap reports the udp port ...
4
votes
1answer
318 views

Is my router/modem compromised?

So I recently ran a port scan (just TCP) on my home router/modem (AT&T U-Verse) and found two peculiar ports that are open. Here is the scan output/results for nmap 192.168.1.254 -P0: Starting ...
2
votes
2answers
113 views

How can the connection of a rogue VPN router be countermeasured with a sniffer?

As an IT admin, what can I do to countermeasure an attack performed like this page explains? http://www.pivpn.net/2015/08/hide-your-ass-hide-by-mac-address-and.html What they do is to put a raspberry ...
2
votes
2answers
78 views

nmap output to file different than interactive output?

I am running a simple SYN scan of all ports on all hosts that I found on a previous ping scan saved to a file: targets like this: nmap -sS -p- -v -T5 -oN puzzling.txt -iL targets As the scan runs ...
0
votes
2answers
312 views

Can't successfully do an idle scan

I have Kali Linux installed in VirtualBox and would like to do an idle scan. For this I need to find a suitable zombie PC. I'm using the ipidseq script to find one. The script finds some IP addresses ...
2
votes
2answers
2k views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...