Security scanner for computers and networks.

learn more… | top users | synonyms

-5
votes
0answers
29 views

How to scan a target behind a firewall using Firewalk? [on hold]

I have used firewalk nmap script and the output of this script is: Host ip XX.XX.XX.XX Blocked ports 1,3-4,6-7,9,13,17,19-20 Traceroute: my router ip not important ip ip ... the host which in ...
2
votes
2answers
27 views

Any way to circumvent a 'filtered' response on NMap?

I know that a filtered response on NMap means that the firewall dropped the packets or that NMap just didn't receive a response, but is there any way to circumvent this? Is it possible that the ...
0
votes
1answer
35 views

Does nmap help to know if firewall is turned on?

Is it possible to know firewall status using nmap? How?
1
vote
2answers
77 views

NMap to scan a private subnetwork

I have a test network setup based on virtual machines. My host machine, a web server and the firewall is under the 192.168.0.0/24 network (gateway is 192.168.0.1); a server machine is located behind ...
2
votes
3answers
123 views

Printer IP scanning via Nmap

I want to scan printer IPs in my organization. Is there authentic method? I am using Nmap. I have already checked some commands like: 1) nmap -O 10.10x.x.0/24 -oG - | grep printer >> outfile ...
8
votes
4answers
6k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
3
votes
4answers
275 views

How to run nmap HTTP scripts on unusual ports

How can I make nmap run the HTTP-scripts on ports that are unusual for HTTP, say TCP port 123? On something like nmap -n --script="http* ..." -p123 target nmap does nothing except to check that port ...
1
vote
5answers
3k views

Increase speed in nmap UDP scan?

How can I get nmap quicker in scanning UDP ports? This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
0
votes
1answer
31 views

Caching ARP to avoid L2 detection on switched network?

Using nmap on a very large (/16) switched network can lead to an excessive number of ARP requests which can be detected by simple ARP counters listening to broadcasted ARP requests. Is there a way ...
2
votes
2answers
45 views

nmap script with credentials

I'm using Nmap for penetration testing for a while, and I need to know: assuming I revealed user credentials: username & password, Is there any script that I can use, for searching what resources ...
3
votes
4answers
534 views

Is there a nmap command to get the top # most common ports?

I understand nmap by default scans the top 1k 'most common' ports (-F reduces to 100) I understand it gets these 'most common' ports based on the nmap-services file, specifically the frequency (3rd ...
0
votes
1answer
655 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. The ...
-1
votes
1answer
46 views

NMAP Scan- Results Differ

I'm trying to determine a servers IP address via ping and open ports/services by running an NMAP scan. At work, when I ping my website/server, I get a response from 172.16.XX.X If I run an NMAP scan, ...
1
vote
0answers
52 views

Pathping for test Pinging from subnets

Does anyone know if PathPing or NMAP can ping or scan from predefinded source IPs? I am checking connectivity from agents on remote hosts to a destination site from my host. Is there a switch or tool ...
4
votes
1answer
113 views

Firewalk through a Firewall on our subnet

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram: (Skip to the bottom of the following explanation for a direct list of ...
5
votes
3answers
469 views

How can I practice using nmap without scanning some real site or performing computer trespass?

I want to learn nmap and its various options. What can I do or setup in order to see examples of issues found by nmap - e.g., something with security holes on purpose.
1
vote
1answer
56 views

NMAP Scan Returns Odd OS Detection [closed]

I am new to NMAP but I was using it to troubleshoot some issues I have been having. I ran a scan on a device and I know the device runs some sort of Linux or Ubuntu OS and I was attempting to figure ...
7
votes
6answers
2k views

How to bypass Nmap blockage?

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside? Also, does blocking nmap on a network provide any security? ...
1
vote
3answers
1k views

Determining false positives when scanning for live hosts with Nmap

When doing a vulnerability assessment on a large network, it seems general practice to determine which hosts on the network are live. This can be done in various ways. From what I have read it is ...
1
vote
1answer
95 views

proxychains-ng with nmap issues

Can anyone tell me if proxychains-ng has limitations to work with nmap? I found that it does not work well when using -sV option in nmap. (stop at "Initiating NSE at ..." and never finish the scan) ...
1
vote
1answer
92 views

nmap not running as root shows unknown open ports for a fraction of a second

On a server running Ubuntu 14.04.2 I was doing some basic security auditing when I ran the command nmap -p -d 1-65535 as a non-root user. Interestingly it reported a few (1-5 at a time, average, ...
1
vote
2answers
160 views

Can't successfully do an idle scan

I have kali linux installed in VirtualBox and would like to do an idle scan. For this I need to find a suitable zombie pc. I'm using the ipidseq script to find one. The script finds some ip addresses ...
2
votes
2answers
135 views

nmap says “variable 'keys' is not declared” when trying to run ssl-ccs-injection.nse

I'm running nmap 6.47 on Windows 7 and am trying to run the ssl-ccs-injection.nse script. After getting an error, I ran it with the -d (debug) option and the error in the subject is what showed up. I ...
5
votes
2answers
761 views

Why would a stealth scan attract more attention than a connect scan?

I'm reading an Information Security book and am faced with the question: Why may nmap stealth scans(SYN) attract more attention than simple connect scans(TCP connect())? Why might it be?
3
votes
2answers
115 views

Why does a nmap scan give different results depending on whether it's run from inside or outside a LAN

I am testing/setting up a Thompson TG585v7 router/firewall. Results when running nmap from a computer INSIDE the LAN $ sudo nmap -O 210.86.xxx.xxx Starting Nmap 6.40 ( http://nmap.org ) at ...
3
votes
2answers
143 views

If nmap reports a port is open, does that ALSO mean a service is listening on the port?

I have a Thompson TG585v7 router/firewall whose firewall is configured to FORWARD several ports to a computer X54 within the LAN. These ports are in the range 1024 through to 2500 That X54 ...
-4
votes
3answers
215 views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
0
votes
1answer
848 views

Proxychains + nmap = segmentation fault

If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:- root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p ...
1
vote
1answer
102 views

What is the fastest way to scan all ports of a single machine

I am doing some research and I need a very quick way to scan for open ports on a single machine. To provide some context, I know that my machine will have a port open waiting for UDP packets for about ...
1
vote
2answers
420 views

What kind of vulnerability it may have for known ssh-hostkey?

I saw there is NSE script in nmap that can retrieve the ssh-hostkey(RSA or DSA) from the target host. For example, 22/tcp open ssh | ssh-hostkey: 2048 ...
-2
votes
2answers
68 views

What's the difference between nmap -v and nmap -O?

As I'm a newbie in this, I'm unaware of the differences between making a scan using nmap -v localhost and nmap -O localhost? Any help would be appreciated.
6
votes
3answers
1k views

What are the security issues of open ports?

What could be the threats of having the ports open, after performing a nmap scan and identifying the open ports? I already searched for some answers for this question, but couldn't find anything ...
2
votes
1answer
109 views

Understanding nmap output / author explanation …(Scapy)

I just read this example and explanation (below) in the OReilly book Security Power Tools (2007) in section 6.3 that is written by the creator of Scapy, Philippe Biondi. I think the example is very ...
2
votes
2answers
3k views

nmap no ping returns host is active and all ports are filtered

I am trying to determine if hosts are up. For hosts where a ping fails, I run a nmap (6.40) Regular and/or Quick scan. For a subset of my hosts, the nmap response is "Host seems down". As a follow up ...
1
vote
1answer
113 views

Why is nmap that slow on my system (ubuntu 14.04)?

I just started to learn something about portscanning with nmap. when i try to run an a nullscan or any other type on a virtual machine (win7 no firewall) the scan needs a lot of time to perform: ...
-2
votes
2answers
329 views

Which all ports are in danger and needs to be closed with immediate attention?

This is the nmap scan results on my server (used for email and web serving) from a remote scan. Which all ports are in danger and why? PORT STATE SERVICE 21/tcp open ftp 25/tcp open ...
2
votes
2answers
393 views

How to force nmap to check all the ports?

I heard that nmap scans for only 1000 most common ports while we do server scan. Is it possible to force nmap to check all the ports for scanning? If yes,How?
0
votes
4answers
294 views

nmap mac os lots of questionable ports open

Ive been recently trying to lock down my network at home and suspect that someone has hacked my linksys router because port 3128 seems to be open through the router and I have no knowledge setting or ...
0
votes
2answers
196 views

different results using nmap with/without sudo

Why is the reason that after running $ nmap -sP 192.168.1.0/24 I got three results, but running $sudo nmap -sP 192.168.1.0/24 shows seven results. What is the role of using sudo here?
-3
votes
1answer
103 views

Is there scan-me-for-vulnerabilities services? [closed]

Where can I get more similar to nmap.online-domain-tools.com scan services. Edit: Probably, nobody know what does nmap.online-domain-tools.com is. I'm trying to explain: Network service. For ...
-2
votes
1answer
42 views

What does running nmap on a server reveal about your computer?

If you run the nmap command on a server eg. nmap espn.com or nmap -Pn espn.com what information does that reveal to the server about you (eg. ip address or MAC address)? Does using a private vpn ...
1
vote
1answer
185 views

Nmap from Kali Linux and from Amazon EC2 instance - vastly differing results

I'm running a basic scan using nmap from 1) a VM of Kali Linux running on personal machine 2) an instance of Amazon Linux, running on Amazon's EC2 cloud These two runs (against any target) are ...
-1
votes
1answer
89 views

What does “unknown” status in nmap mean? [duplicate]

scanned my IP number with nmap and I got all "unknown" status ports. What does that mean?
1
vote
0answers
590 views

What is my router listening for on ports 5555 and 3333? [closed]

I recently discovered nmap and pointed it at my router out of curiosity. It found that ports 3333 and 5555 are open but doesn't recognise either service. I investigated and found: I can successfully ...
3
votes
1answer
178 views

Honeyd Isn't Detecting Loud Scans [closed]

I've got the Honeyd honeypot in one virtual machine (kali) and nmap in another (ubuntu), the config file looks like this: create default set default default tcp action closed set default default udp ...
2
votes
2answers
546 views

Why does NMAP scan list hosts as up? [closed]

When running an NMAP scan of my internal network (192.168.1.0/24) from my Mac, NMAP sees all hosts as live. It also believes there is a port 80 http service running on every IP when I do not have 254 ...
0
votes
0answers
61 views

WPA2 ENTERPRISE - Unable to find a way around Lanner Electronics

Gday, I have currently been working in an environment where i am connected to a WPA2 Enterprise network requiring me to enter my username and password for the network whenever i connect. I have been ...
1
vote
2answers
149 views

Nmap scan list of domains and provide boolean if up/down

I have a newline separated list of domains that I would like to perform an arbitrary nmap scan on (e.g. aggressive, syn) and I would like to output a boolean that indicates whether or not any ports ...
5
votes
5answers
18k views

How to bypass tcpwrapped with nmap scan

I'd a scan task and I faced following result Host is up (0.032s latency). Scanned at 2012-10-25 16:06:38 AST for 856s PORT STATE SERVICE VERSION 1/tcp open tcpwrapped 3/tcp open ...
7
votes
2answers
500 views

How nmap guesses the operating system?

nmap has the capability to guess the operating system with the option -O. I was highly surprised that it can find the correct kernel or service pack. * How nmap guesses the operating system? * What ...