Security scanner for computers and networks.

learn more… | top users | synonyms

0
votes
1answer
25 views

nmap - “No exact OS matches for host (test conditions non-ideal)” even with 1 open, 1 closed port

I'm trying to do some Nmap OS detection and I'm running into some results I don't understand. The scan I'm running is the following: nmap -O -F -v -T2 -oA nmap-uphosts-OSdetect -iL < my_in_file ...
0
votes
0answers
27 views

Proxychains + nmap = segmentation fault

If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:- root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p ...
2
votes
1answer
20 views

Is there any difference for OS fingerprint technique used in Nmap inside -A and -O?

Is there any difference between the technique or algorithm used from Nmap to guess the OS between the option -A and -O? If not, why -O option requires root privileges but -A that it is doing at least ...
0
votes
1answer
48 views

NMAP not reporting open ports with -sS scan

Is there any reason why an -sS scan (or most others) would not report an open port that doesn't have a service attached to it? For example, in a regular -sS scan, the following port will be missing, ...
0
votes
1answer
31 views

Can't successfully do an idle scan

I have kali linux installed in VirtualBox and would like to do an idle scan. For this I need to find a suitable zombie pc. I'm using the ipidseq script to find one. The script finds some ip addresses ...
1
vote
2answers
84 views

How to block network scans with pfsense?

I am using pfsense as firewall, and I would like to know how I can stop network scans from enumerating open services and ports. Thanks
0
votes
2answers
49 views

Identifying HP Printers with NMAP and then using results in Python/Perl

Great write up on network printer hacking at IronGeek's site here for anyone interested http://www.irongeek.com/i.php?page=security/networkprinterhacking. Here's what I want to do: Scan the subnet ...
0
votes
2answers
53 views

Nmap stealth scan shows that port is filtered

The title is really bad, but I was able to find better. I have installed Debian on VMware, and set iptables to block any traffic except port 80 (inbound and outbound). When I run a nmap scan it shows ...
-1
votes
1answer
47 views

How to create a script that returns only the mobile devices on a network using NMAP

I would like to create a script using NMAP on Mac that 1) scans the entire LAN, and 2) Returns the number of mobile devices.
1
vote
3answers
206 views

What exactly does one get from a Nmap Scan?

I know nmap is a port scanner and its output shows all the open ports, the services running on those ports, the underlying OS and technology, etc. What should one take from this result in easiest ...
0
votes
2answers
56 views

Nmap reporting the status of a port as both opened and closed

If I do not define any range (or if the range is large like a hundreds of ports), Nmap is returning ports as opened. However, if I put a smaller range or just scan a specific port, it says it's ...
0
votes
0answers
98 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. the ...
0
votes
1answer
48 views

If I port scan a server on the outside of a firewall will this also tell me the ports the firewall is blocking?

Theoretically I was thinking a firewall inspects the TCP header and looks at the destination port and discards/forwards based on its firewall rules. So could I port scan an external server to the ...
0
votes
1answer
373 views

how to bypass windows xp firewall with nmap

I'm scanning a Windows XP in a virtualized environment. I use all of needed arguments to bypass its firewall but it doesn't answer: nmap -e eth0 -Pn --data-length 5 --badsum -g 80 -S 192.168.1.103 -f ...
0
votes
3answers
328 views

nmap.online inconsistent results

I recently used nmap online to test my firewall security on the WAN port. I purposely did some port forwarding but received inconsistent results. I opened ports 6881 to 6889 on the firewall and did 2 ...
2
votes
2answers
3k views

NMAP DNS Service Detection

I was looking out how NMAP identifies DNS services. After determining that port 53 is open it issues a standard query TXT version.bind to find out if BIND is running on the domain port. Then, I saw ...
4
votes
3answers
12k views

How to bypass tcpwrapped with nmap scan

I'd a scan task and I faced following result Host is up (0.032s latency). Scanned at 2012-10-25 16:06:38 AST for 856s PORT STATE SERVICE VERSION 1/tcp open tcpwrapped 3/tcp open ...
0
votes
1answer
473 views

Nmap SSL service detection: How to check all open ports only for SSL service?

I am running nmap to probe services that use SSL.¹ In order to detect vulnerability in non-standard ports, I am using the -sV option to perform service discovery. But it is very slow since it runs ...
1
vote
1answer
106 views

Scan All private subnets with NMAP [closed]

I have a managed switch on my network but I don't remember the subnet. How can I scan all the private network without changing my ip address : 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 Thanks for ...
1
vote
4answers
156 views

Comprehensive audit of firewall - is Internet truly not accessible?

We have many Linux servers in several co-locations over the world. By design, these machines generally should not be able to access the Internet. Depending on location and role, some sites may have ...
0
votes
4answers
411 views

Increase speed in nmap UDP scan?

How can I get nmap quicker in scanning UDP ports? This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
0
votes
1answer
40 views

Optimal flags to specify when using nmap to guess the OS on remote devices?

Optimal flags to specify when using nmap to guess the OS on remote devices? I'm currently using the following: nmap --privileged -sS -sU -sY -sZ -O --osscan-guess -F -r 192.168.200.223 This seems ...
0
votes
1answer
924 views

How do I use nmap to scan a range of IPv6 addresses? [closed]

I need to scan a range of IPv6 addresses with Nmap, but I'm not sure how to do this. When scanning for an IPv4 range, I would usually do this: nmap -sP 192.168.*.* or nmap -sP 192.168.1.* but if ...
3
votes
2answers
723 views

Why do multiple IP Addresses in my local network point to the same computer?

I'm new to linux and nmap, and I am attempting to do a scan of my local network. Using nmap I find that there are 4 hosts on my network (10.0.2.2, 10.0.2.3, 10.0.2.4, 10.0.2.15). I am using VirtualBox ...
1
vote
2answers
1k views

nmap no ping returns host is active and all ports are filtered

I am trying to determine if hosts are up. For hosts where a ping fails, I run a nmap (6.40) Regular and/or Quick scan. For a subset of my hosts, the nmap response is "Host seems down". As a follow up ...
3
votes
2answers
281 views

Determing live hosts past a restrictive firewall with nmap

Sometimes when I am doing an external security assesment, I run into hosts that have the following restrictions/configuration: All ICMP traffic is blocked An IDS or some device returns all ports as ...
9
votes
4answers
2k views

nmap showing unknown IPs on private network

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
1
vote
0answers
167 views

Bypass Nmap Scans Being Blocked [closed]

A friend has set up a VM for me to play with, I am currently stuck on a little problem: On this network he set up, there are 6 machines and a router, 5 servers (plus the router) show up on a typical ...
3
votes
1answer
95 views

Use nmap correctly

I currently have a VPS in a data center, I asked the admin to open a port to install a ftp server. It opened port 3345, at first I tought the port is not forwarded correctly, because I ran nmap as ...
0
votes
2answers
515 views

Determining false positives when scanning for live hosts with Nmap

When doing a vulnerability assessment on a large network, it seems general practice to determine which hosts on the network are live. This can be done in various ways. From what I have read it is ...
0
votes
1answer
385 views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
2
votes
1answer
71 views

Does nmap limit probes when using time limiting on decoy scans?

If I set a rate limit (e.g. -T1) on an nmap scan that uses decoys, does the rate limit apply to all probes, or just each individual source? I checked the documentation, but can't see anything ...
2
votes
5answers
1k views

Nmap reporting almost every port as open

I have noticed during some assesments when doing a TCP port scan, Nmap will report almost every port as open for a machine. Using for example nmap -sS -PN -T4 target -p0-65535, over 20,000 ports will ...
0
votes
1answer
128 views

Is it possible to scan a remote host in another network if I know a port that is opened?

First of all, this question is not the same as is it possible to test out remote host by using nmap?, because on that question, the questioner is asking for something impossible due to NAT's nature. ...
6
votes
2answers
943 views

How does nmap do a zombie and decoy scan?

We're learning nmap in my ethical hacking class. We got showed how we can use nmap to perform a zombie scan: nmap -PN -sI zombieIP targetIP and decoy scan: nmap -p 135 -D decoyIP targetIP I ...
1
vote
1answer
264 views

How does nmap determine if it's running HTTP service on a port? Fails here

I'm running apache on 192.168.56.178, which listens on port 80, 8090 and 8095 (configured as <VirtualHost *>). Now If I open my browser and point to any of those 3 ports, e.g ...
1
vote
3answers
149 views

Port Scanning Host that has Rate Limiting Enabled

I am trying to enumerate on of my lab machines. It seems that it has rate limiting enabled since I am getting blocked after the first few probes. I need to scan the whole 65535 tcp ports. I tried ...
2
votes
3answers
4k views

Why does an nmap -sT scan show ports filtered but -sS shows ports closed

What are possible reasons why an nmap -sT scan would show "ports filtered" but an identical nmap -sS scan shows "ports closed"? I understand that -sT is a full TCP Connect, which is easier to detect ...
0
votes
1answer
99 views

Understanding a Zenmap output

I'm running Zenmap on my Windows 7 laptop. I ran an intense scan with UDP targeting my router 192.168.1.1.I realize that I'm probing into the back end of the router from the inside and that any open ...
3
votes
1answer
368 views

Is it possible to detect host-machine of my virtual-machines?

So basically I need to know is there any way to find a connection (or relation) between packets sent by my VMs and my host machine. In my lab I have lots of workstations, each running a VirtualBox ...
10
votes
4answers
2k views

Is my network being sniffed?

Is there any way to find out if someone who is connected to my network is sniffing packets? There is a way with nmap if his card is in promiscuous mode but what if it is passive?
6
votes
4answers
583 views

Trying to firewall ports 1863, 5190

I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need. But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further? ...
1
vote
4answers
1k views

How to make nmap list an unfiltered port?

I have a host that is NAT'ed and I have opened a single port in my router so the host is reachable by the external world. I tested if it was reachable by running a service and connecting to it ...
5
votes
3answers
7k views

How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve ...
3
votes
1answer
2k views

How can I see traceroute details in NMAP?

I'm using NMAP for Network scan ; The output does not contain the full traceroute details. Can I view all intermediate routers/hosts using the NMAP GUI? A simple VPN connection IP traceroute... ...
2
votes
1answer
497 views

Why are some ports reported as closed by nmap?

I was scanning a machine from inside the same LAN which is running and up to date Windows XP Home Edition which I suspect may be running some malware. The target machine has an up to date antivirus ...
23
votes
3answers
52k views

How to find live hosts on my network?

I am trying to find the live hosts on my network using nmap. I am scanning the network in Ubuntu using the command sudo nmap -sP 192.168.2.1/24. However, i am unable to find the live hosts. I just get ...
-1
votes
3answers
218 views

What does the question mark in nmap output indicate?

In the following nmap output: $ sudo nmap -sS -sV -vv -n -Pn -T5 x.x.x.1-255 -p80,23,21 -oG - | grep 'open' Host: x.x.x.x () Ports: 21/closed/tcp//ftp///, 23/open/tcp//telnet?///, ...
5
votes
1answer
1k views

How to use NMap to portscan a SonicWall that is blocking all attemtps?

It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
4
votes
3answers
776 views

Sharing Nmap scan results in a web page

Is there a tool that allow the sharing of nmap scan results ? I know nmap can produce XML and I can easily convert them in HTML. I would like to know if there is a tool with more features. For ...