Security scanner for computers and networks.

learn more… | top users | synonyms

1
vote
2answers
88 views

Why does nmap remotely show when I have port 6969 open, but not others?

Specifically, I was running a node.js application on port 6969 which I thought was strictly local. I discovered this was not the case when I ran nmap <myip> from a different computer and found ...
4
votes
3answers
202 views

Nmap showing ISPs router's DNS port in addition to target's ports

Whenever I do nmap scans my ISP router DNS port like the following. This happens for every IP or target. $ nmap -T4 -A -v stackoverflow.com PORT STATE SERVICE VERSION 53/tcp open domain ...
3
votes
2answers
240 views

Deauth all users on AP except yourself

I am looking to create a small first project to further my self education into infosec. I will be putting this on my Github. My idea is to create a script that automates the process of deauthing all ...
0
votes
1answer
124 views

Nmap NSE Password Brute Force is Stopping on First Positive Instance

I'm running an Nmap brute force against metasploitable2 (telnet). The script is stopping on the first found username/password and is not iterating through the entire user/password file i have ...
0
votes
1answer
49 views

Resuming an interrupted nmap scan:

I need to: --resume <filename>: Resume an aborted interrupted scan. But I didn’t: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, ...
5
votes
2answers
140 views

Stop Nmap scan and preserve XML output

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
1
vote
2answers
91 views

Is a Windows (fresh installation) 7 really this safe against NMAP or am I missing something?

I am playing with NMAP in my small private network performing port scanning. So far I went through scanning the following OSs (Unaltered new installations - Meaning no extra software installed!): ...
0
votes
1answer
113 views

Why are db_nmap results filtered, but Nmap is not

I've recently started playing with Kali on VMWare Player and Metasploitable 2 on VmWare Player. Both are on the same (default install) subnet. Metasploitable 2 has 2 adapters: settings:NAT and Host ...
1
vote
1answer
73 views

Open TCP port on cable modem TG1672G

TG1672G cable modem in bridge mode, the modem's built in router still gets a IPv4/IPv6 public address (and devices connected to the modem can get public IPv4/IPv6 addresses too). This modem is Intel ...
-1
votes
1answer
327 views

Netdiscover running on NAT interface not finding IP addresses on host-only network?

I am practicing penetration testing techniques using Kali Linux (most recent distro) and various vulnerable virtual machines (DVWA, Metasplotiable). My attack and targets are all running via ...
2
votes
0answers
129 views

nmap OS scan showing DD-WRT when I'm not running it?

This weekend, I set up pfSense on a spare box that I had sitting in the garage. It seems cool and powerful, but I haven't messed with it much yet. Was doing some basic nmap scanning from work against ...
1
vote
1answer
33 views

NMAP's explicitely closed ports

I'm working on a challenge and I notice this odd output for a full port scan? abc@desktop:~$ nmap -T5 -p- -sV x.x.x.x -PN Interesting ports on x.x.x.x: Not shown: 65533 filtered ports PORT ...
1
vote
2answers
110 views

Network scan across multiple subnets and output list of names and IP's

We have multiple sites with multiple subnets. We have mandated that the admins at those sites enter DNS names for all devices that exist on the network. (anything with an IP gets a name) I want to be ...
2
votes
2answers
183 views

Router reboots when using Nmap

I hope this question is OK to ask here. When I scan a external IP-address with Nmap my router always reboots itself, sometimes I even have to manually restart it by using the power switch. The ...
1
vote
1answer
43 views

Does nmap port scan return the correct ports for the websites that don't allow direct IP access

I am new to the field of penetration testing, and I'm currently testing an application, for learning purposes with their legit, written permit. When I did a nslookup for that site, it returned me an ...
1
vote
2answers
162 views

nmap localhost UDP scan fails, even though netcat is listening

I open two terminal windows on my linux box. On one, I have netcat listen to a UDP port and on other I nmap -sU that port. Netcat receives the connection and the data, but nmap reports the udp port ...
4
votes
1answer
230 views

Is my router/modem compromised?

So I recently ran a port scan (just TCP) on my home router/modem (AT&T U-Verse) and found two peculiar ports that are open. Here is the scan output/results for nmap 192.168.1.254 -P0: Starting ...
1
vote
2answers
62 views

nmap output to file different than interactive output?

I am running a simple SYN scan of all ports on all hosts that I found on a previous ping scan saved to a file: targets like this: nmap -sS -p- -v -T5 -oN puzzling.txt -iL targets As the scan runs ...
6
votes
1answer
1k views

Message signing disabled (dangerous, but default)

Over the last couple of years, I've developed a fairly keen interest in Penetration Testing & Information Security. Throughout this time, I've acquired (and accumulated) a range of different ...
-2
votes
1answer
85 views

What's the difference between nmap and arp?

From what I understand, please correct me if I'm wrong, nmap allows you to discover machines on a network, any network whereas arp only allows you to discover machines in your own local network. Is ...
-1
votes
2answers
560 views

Does having these ports open indicate any vulnerabilities?

I installed Ubuntu Gnome a couple of weeks ago along with a few packages and some software. When I scanned my localhost using Nmap, I got the following results. Are there any obvious vulnerabilities, ...
-2
votes
2answers
252 views

Use of Nmap ssl/http md5 and SHA1 hashes

I have below stated result on of the system by map: 443/tcp open ssl/http Apache httpd 2.0.52 ((CentOS)) | http-methods: GET HEAD POST OPTIONS TRACE | Potentially risky methods: TRACE |_See ...
1
vote
2answers
142 views

Nmap does not detect Linux Mint

I can't identity my Linux Mint 17 machine on my home network. I use nmap -O -v 192.168.2.28 However, I get the following output (below). I am just learning nmap, so I don't know what all of the ...
2
votes
2answers
94 views

How can the connection of a rogue VPN router be countermeasured with a sniffer?

As an IT admin, what can I do to countermeasure an attack performed like this page explains? http://www.pivpn.net/2015/08/hide-your-ass-hide-by-mac-address-and.html What they do is to put a raspberry ...
1
vote
1answer
92 views

Nmap write output only when all scanned ports are open

Can anyone tell me how, or if it possible to get nmap to write output to a file if ALL of the ports defined in the scan are open? Such as in a boolean & statement - i.e. 636 & 902 & 5989 ...
3
votes
2answers
131 views

When should I drop a packet with ICMP type 3, code 9 or 10, TCP RST, or TCP ACK?

This answer says there are a few ways of dealing with a blocked packet at a firewall: At each of these levels a 1st IP packet (and any other protocol packet as an ESP or AH packet) might receive ...
10
votes
4answers
1k views

Filtered ports - What exactly filters them?

By the NMAP definition, unfiltered ports are the ones which cannot be determined to be open or closed since packet filtering prevents its probes from reaching the port. (ISBN 9780979958717 pag. 77) ...
1
vote
2answers
137 views

If I write an nmap job into crontab from PHP code to run background, how can I get the status of the nmap cronjob?

I am trying to write a php code test to write an nmap scan (with parameters) scheduled into crontab file. While the nmap is running I would like to get the status of that specific nmap scan. For ...
1
vote
1answer
115 views

NMap for getting machines connected to a network switch [duplicate]

I am currently exploring Nmap for its capabilities. Can anyone tell how can Nmap be used to query the machines connected to a network switch?
1
vote
0answers
531 views

'http_login' metasploit module isn't able to Brute Force the target. Any suggestions? [closed]

I'm trying to Brute force the http Basic authentication on the domain pentesteracademylab.appspot.com The complete path is pentesteracademylab.appspot.com/lab/webapp/basicauth I'm using the ...
3
votes
2answers
851 views

Scanning multiple subnets with nmap to determine open services & ports

First off, I know nmap's documentation is very powerful and I have been reading through it rather extensively. I will be scanning externally, with permission, to determine ports & services that ...
0
votes
2answers
89 views

Client misunderstanding nmap [closed]

My client wants their public facing IP addresses to be secure, but thinks that running nmap port scans will draw attention from hackers. To settle this once and for all, what do you say?
1
vote
3answers
702 views

How can I scan open ports through Windows Firewall?

I use Kali Linux and VMWare for testing some penetration techniques. The problem is that when I scan ports with Nmap to my Windows IP "all ports are filtered". I know that the firewall is blocking the ...
6
votes
1answer
195 views

What is the purpose of using different DNS server in nmap?

nmap allows the use of different DNS servers (not local). What is the benefit of doing so?
2
votes
2answers
813 views

nmap detects opened port but can't connect with telnet

I've made an scan to one single IP with nmap and it reports that the port 65301 is opened, and even it detects that it's maybe the service pcanywhere. sudo nmap -p 65000-65535 -sV x.x.x.x Starting ...
2
votes
1answer
112 views

explanation of an nmap behaviour

I'm testing some vulnerabilities on a machine which has the port 22333 opened (it's used as the ssh port, and I can connect to it without any problem and the telned command get connected): $ telnet ...
0
votes
2answers
181 views

Effective NMAP scan technique

I need to scan large network which has 5000 IPs. I have limited time duration. I have done initial maths and concluded that, in a group of 4 individual has to perform 70 IP nmap scan. Consider that I ...
2
votes
2answers
68 views

Any way to circumvent a 'filtered' response on NMap?

I know that a filtered response on NMap means that the firewall dropped the packets or that NMap just didn't receive a response, but is there any way to circumvent this? Is it possible that the ...
0
votes
1answer
153 views

Does nmap help to know if firewall is turned on?

Is it possible to know firewall status using nmap? How?
1
vote
2answers
156 views

NMap to scan a private subnetwork

I have a test network setup based on virtual machines. My host machine, a web server and the firewall is under the 192.168.0.0/24 network (gateway is 192.168.0.1); a server machine is located behind ...
4
votes
4answers
1k views

How to run nmap HTTP scripts on unusual ports

How can I make nmap run the HTTP-scripts on ports that are unusual for HTTP, say TCP port 123? On something like nmap -n --script="http* ..." -p123 target nmap does nothing except to check that port ...
1
vote
1answer
157 views

Caching ARP to avoid L2 detection on switched network?

Using nmap on a very large (/16) switched network can lead to an excessive number of ARP requests which can be detected by simple ARP counters listening to broadcasted ARP requests. Is there a way ...
2
votes
2answers
257 views

nmap script with credentials

I'm using Nmap for penetration testing for a while, and I need to know: assuming I revealed user credentials: username & password, Is there any script that I can use, for searching what resources ...
-1
votes
1answer
57 views

NMAP Scan- Results Differ

I'm trying to determine a servers IP address via ping and open ports/services by running an NMAP scan. At work, when I ping my website/server, I get a response from 172.16.XX.X If I run an NMAP scan, ...
5
votes
1answer
906 views

Firewalk through a Firewall on our subnet

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram: (Skip to the bottom of the following explanation for a direct list of ...
1
vote
1answer
111 views

NMAP Scan Returns Odd OS Detection [closed]

I am new to NMAP but I was using it to troubleshoot some issues I have been having. I ran a scan on a device and I know the device runs some sort of Linux or Ubuntu OS and I was attempting to figure ...
1
vote
1answer
746 views

proxychains-ng with nmap issues

Can anyone tell me if proxychains-ng has limitations to work with nmap? I found that it does not work well when using -sV option in nmap. (stop at "Initiating NSE at ..." and never finish the scan) ...
1
vote
1answer
484 views

nmap not running as root shows unknown open ports for a fraction of a second

On a server running Ubuntu 14.04.2 I was doing some basic security auditing when I ran the command nmap -p -d 1-65535 as a non-root user. Interestingly it reported a few (1-5 at a time, average, ...
2
votes
2answers
459 views

nmap says “variable 'keys' is not declared” when trying to run ssl-ccs-injection.nse

I'm running nmap 6.47 on Windows 7 and am trying to run the ssl-ccs-injection.nse script. After getting an error, I ran it with the -d (debug) option and the error in the subject is what showed up. I ...
5
votes
2answers
974 views

Why would a stealth scan attract more attention than a connect scan?

I'm reading an Information Security book and am faced with the question: Why may nmap stealth scans(SYN) attract more attention than simple connect scans(TCP connect())? Why might it be?