Security scanner for computers and networks.

learn more… | top users | synonyms

2
votes
2answers
64 views

Nmap does not detect Linux Mint

I can't identity my Linux Mint 17 machine on my home network. I use nmap -O -v 192.168.2.28 However, I get the following output (below). I am just learning nmap, so I don't know what all of the ...
66
votes
4answers
177k views

How to find live hosts on my network?

I am trying to find the live hosts on my network using nmap. I am scanning the network in Ubuntu using the command sudo nmap -sP 192.168.2.1/24. However, I am unable to find the live hosts. I just get ...
0
votes
0answers
7 views

With nmap and awk, displaying any http ports with the host's ip [migrated]

I scanned around 50 hosts on a network with this command: nmap -sV -iL sweep_ips.txt -oG result.txt ex: ... Host: 192.168.x.x () Ports: 8000/open/tcp//http//Apache httpd 2.2.3 ((CentOS))/ ...
1
vote
1answer
29 views

How can this kind of attack be countermeasured by using a sniffer?

As an IT admin, what can I do to countermeasure an attack performed like this page explains? http://www.pivpn.net/2015/08/hide-your-ass-hide-by-mac-address-and.html What they do is to put a raspberry ...
1
vote
1answer
23 views

Nmap write output only when all scanned ports are open

Can anyone tell me how, or if it possible to get nmap to write output to a file if ALL of the ports defined in the scan are open? Such as in a boolean & statement - i.e. 636 & 902 & 5989 ...
5
votes
5answers
2k views

Sharing Nmap scan results in a web page [closed]

Is there a tool that allow the sharing of nmap scan results ? I know nmap can produce XML and I can easily convert them in HTML. I would like to know if there is a tool with more features. For ...
9
votes
4answers
1k views

Filtered ports - What exactly filters them?

By the NMAP definition, unfiltered ports are the ones which cannot be determined to be open or closed since packet filtering prevents its probes from reaching the port. (ISBN 9780979958717 pag. 77) ...
3
votes
2answers
48 views

When should I drop a packet with ICMP type 3, code 9 or 10, TCP RST, or TCP ACK?

This answer says there are a few ways of dealing with a blocked packet at a firewall: At each of these levels a 1st IP packet (and any other protocol packet as an ESP or AH packet) might receive ...
1
vote
1answer
38 views

NMap for getting machines connected to a network switch [duplicate]

I am currently exploring Nmap for its capabilities. Can anyone tell how can Nmap be used to query the machines connected to a network switch?
1
vote
2answers
48 views

If I write an nmap job into crontab from PHP code to run background, how can I get the status of the nmap cronjob?

I am trying to write a php code test to write an nmap scan (with parameters) scheduled into crontab file. While the nmap is running I would like to get the status of that specific nmap scan. For ...
3
votes
4answers
878 views

Is there a nmap command to get the top # most common ports?

I understand nmap by default scans the top 1k 'most common' ports (-F reduces to 100) I understand it gets these 'most common' ports based on the nmap-services file, specifically the frequency (3rd ...
1
vote
0answers
78 views

'http_login' metasploit module isn't able to Brute Force the target. Any suggestions? [closed]

I'm trying to Brute force the http Basic authentication on the domain pentesteracademylab.appspot.com The complete path is pentesteracademylab.appspot.com/lab/webapp/basicauth I'm using the ...
3
votes
2answers
71 views

Scanning multiple subnets with nmap to determine open services & ports

First off, I know nmap's documentation is very powerful and I have been reading through it rather extensively. I will be scanning externally, with permission, to determine ports & services that ...
1
vote
0answers
87 views

WPA2-Enterprise - unable to find a way around Lanner Electronics

I have currently been working in an environment where I am connected to a WPA2-Enterprise network requiring me to enter my username and password for the network whenever I connect. I have been asked ...
0
votes
2answers
78 views

Client misunderstanding nmap [closed]

My client wants their public facing IP addresses to be secure, but thinks that running nmap port scans will draw attention from hackers. To settle this once and for all, what do you say?
1
vote
3answers
152 views

How can I scan open ports through Windows Firewall?

I use Kali Linux and VMWare for testing some penetration techniques. The problem is that when I scan ports with Nmap to my Windows IP "all ports are filtered". I know that the firewall is blocking the ...
6
votes
1answer
154 views

What is the purpose of using different DNS server in nmap?

nmap allows the use of different DNS servers (not local). What is the benefit of doing so?
0
votes
2answers
99 views

Effective NMAP scan technique

I need to scan large network which has 5000 IPs. I have limited time duration. I have done initial maths and concluded that, in a group of 4 individual has to perform 70 IP nmap scan. Consider that I ...
2
votes
2answers
184 views

nmap detects opened port but can't connect with telnet

I've made an scan to one single IP with nmap and it reports that the port 65301 is opened, and even it detects that it's maybe the service pcanywhere. sudo nmap -p 65000-65535 -sV x.x.x.x Starting ...
2
votes
1answer
63 views

explanation of an nmap behaviour

I'm testing some vulnerabilities on a machine which has the port 22333 opened (it's used as the ssh port, and I can connect to it without any problem and the telned command get connected): $ telnet ...
2
votes
2answers
38 views

Any way to circumvent a 'filtered' response on NMap?

I know that a filtered response on NMap means that the firewall dropped the packets or that NMap just didn't receive a response, but is there any way to circumvent this? Is it possible that the ...
0
votes
1answer
58 views

Does nmap help to know if firewall is turned on?

Is it possible to know firewall status using nmap? How?
1
vote
2answers
95 views

NMap to scan a private subnetwork

I have a test network setup based on virtual machines. My host machine, a web server and the firewall is under the 192.168.0.0/24 network (gateway is 192.168.0.1); a server machine is located behind ...
2
votes
3answers
257 views

Printer IP scanning via Nmap

I want to scan printer IPs in my organization. Is there authentic method? I am using Nmap. I have already checked some commands like: 1) nmap -O 10.10x.x.0/24 -oG - | grep printer >> outfile ...
8
votes
4answers
7k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
3
votes
4answers
478 views

How to run nmap HTTP scripts on unusual ports

How can I make nmap run the HTTP-scripts on ports that are unusual for HTTP, say TCP port 123? On something like nmap -n --script="http* ..." -p123 target nmap does nothing except to check that port ...
2
votes
5answers
4k views

Increase speed in nmap UDP scan?

How can I get nmap quicker in scanning UDP ports? This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
1
vote
1answer
60 views

Caching ARP to avoid L2 detection on switched network?

Using nmap on a very large (/16) switched network can lead to an excessive number of ARP requests which can be detected by simple ARP counters listening to broadcasted ARP requests. Is there a way ...
2
votes
2answers
98 views

nmap script with credentials

I'm using Nmap for penetration testing for a while, and I need to know: assuming I revealed user credentials: username & password, Is there any script that I can use, for searching what resources ...
0
votes
1answer
850 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. The ...
-1
votes
1answer
48 views

NMAP Scan- Results Differ

I'm trying to determine a servers IP address via ping and open ports/services by running an NMAP scan. At work, when I ping my website/server, I get a response from 172.16.XX.X If I run an NMAP scan, ...
1
vote
0answers
59 views

Pathping for test Pinging from subnets

Does anyone know if PathPing or NMAP can ping or scan from predefinded source IPs? I am checking connectivity from agents on remote hosts to a destination site from my host. Is there a switch or tool ...
4
votes
1answer
242 views

Firewalk through a Firewall on our subnet

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram: (Skip to the bottom of the following explanation for a direct list of ...
5
votes
3answers
567 views

How can I practice using nmap without scanning some real site or performing computer trespass?

I want to learn nmap and its various options. What can I do or setup in order to see examples of issues found by nmap - e.g., something with security holes on purpose.
1
vote
1answer
70 views

NMAP Scan Returns Odd OS Detection [closed]

I am new to NMAP but I was using it to troubleshoot some issues I have been having. I ran a scan on a device and I know the device runs some sort of Linux or Ubuntu OS and I was attempting to figure ...
7
votes
6answers
2k views

How to bypass Nmap blockage?

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside? Also, does blocking nmap on a network provide any security? ...
1
vote
3answers
2k views

Determining false positives when scanning for live hosts with Nmap

When doing a vulnerability assessment on a large network, it seems general practice to determine which hosts on the network are live. This can be done in various ways. From what I have read it is ...
1
vote
1answer
232 views

proxychains-ng with nmap issues

Can anyone tell me if proxychains-ng has limitations to work with nmap? I found that it does not work well when using -sV option in nmap. (stop at "Initiating NSE at ..." and never finish the scan) ...
1
vote
1answer
187 views

nmap not running as root shows unknown open ports for a fraction of a second

On a server running Ubuntu 14.04.2 I was doing some basic security auditing when I ran the command nmap -p -d 1-65535 as a non-root user. Interestingly it reported a few (1-5 at a time, average, ...
1
vote
2answers
181 views

Can't successfully do an idle scan

I have kali linux installed in VirtualBox and would like to do an idle scan. For this I need to find a suitable zombie pc. I'm using the ipidseq script to find one. The script finds some ip addresses ...
2
votes
2answers
219 views

nmap says “variable 'keys' is not declared” when trying to run ssl-ccs-injection.nse

I'm running nmap 6.47 on Windows 7 and am trying to run the ssl-ccs-injection.nse script. After getting an error, I ran it with the -d (debug) option and the error in the subject is what showed up. I ...
5
votes
2answers
831 views

Why would a stealth scan attract more attention than a connect scan?

I'm reading an Information Security book and am faced with the question: Why may nmap stealth scans(SYN) attract more attention than simple connect scans(TCP connect())? Why might it be?
3
votes
2answers
185 views

Why does a nmap scan give different results depending on whether it's run from inside or outside a LAN

I am testing/setting up a Thompson TG585v7 router/firewall. Results when running nmap from a computer INSIDE the LAN $ sudo nmap -O 210.86.xxx.xxx Starting Nmap 6.40 ( http://nmap.org ) at ...
3
votes
2answers
219 views

If nmap reports a port is open, does that ALSO mean a service is listening on the port?

I have a Thompson TG585v7 router/firewall whose firewall is configured to FORWARD several ports to a computer X54 within the LAN. These ports are in the range 1024 through to 2500 That X54 ...
-4
votes
3answers
808 views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
0
votes
1answer
1k views

Proxychains + nmap = segmentation fault

If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:- root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p ...
1
vote
1answer
144 views

What is the fastest way to scan all ports of a single machine

I am doing some research and I need a very quick way to scan for open ports on a single machine. To provide some context, I know that my machine will have a port open waiting for UDP packets for about ...
1
vote
2answers
924 views

What kind of vulnerability it may have for known ssh-hostkey?

I saw there is NSE script in nmap that can retrieve the ssh-hostkey(RSA or DSA) from the target host. For example, 22/tcp open ssh | ssh-hostkey: 2048 ...
-2
votes
2answers
98 views

What's the difference between nmap -v and nmap -O?

As I'm a newbie in this, I'm unaware of the differences between making a scan using nmap -v localhost and nmap -O localhost? Any help would be appreciated.
6
votes
3answers
1k views

What are the security issues of open ports?

What could be the threats of having the ports open, after performing a nmap scan and identifying the open ports? I already searched for some answers for this question, but couldn't find anything ...