Questions tagged [nmap]
A robust and open source security tool for network discovery and security auditing.
42
questions with no upvoted or accepted answers
4
votes
0
answers
562
views
Preventing Dionaea Service Identification
I've been working on trying to prevent Dionaea service identification using articles such as this. I've managed to disguise most of the ports that dionaea utilizes. However, when scanning with nmap, ...
3
votes
0
answers
941
views
What reason would you use the decoy scan option for Nmap?
I'm confused as to why you would use the -D option for Nmap. Is there any 'white hat' reason for using it? Or is it used particularly for malicious purposes?
2
votes
0
answers
1k
views
Check for allowed OpenVPN SSL/TLS cipher suites from the client-side
I would like to check cipher suites that the OpenVPN server accepts. I used nmap:
nmap -sU --script ssl-enum-ciphers -p 1194 <IP>
but the results are only:
Host is up (0.0033s latency).
PORT ...
2
votes
0
answers
1k
views
Windows XP SP3 2002 is not vulnerable to MS08-067
Why is my VM not vulnerable to MS08-067?
There are similar question on stack exchange, yes, but they fail to specify all relevant information and so non receive a meaningful, thoughtful nor thorough ...
2
votes
0
answers
257
views
WPA2-Enterprise - unable to find a way around Lanner Electronics
I have currently been working in an environment where I am connected to a WPA2-Enterprise network requiring me to enter my username and password for the network whenever I connect. I have been asked ...
1
vote
0
answers
2k
views
SSLLabs' SSLTest vs. nmap ssl-enum-ciphers
Recently I conducted a SSL server test to assess the SSL configuration of my server. While the overall grade A+ was pretty good, it was found that the server supports several cipher suites that are ...
1
vote
0
answers
119
views
How to evaluate a responsive but unknown network protocol?
I am studying CREST CPSA where the syllabus is listed here.
There is a part of the syllabus which states I should know the Evaluation of responsive but unknown network applications.
I find this ...
1
vote
0
answers
451
views
Unable to ping scan my machine (but I can ping)
I need to perform an nmap scan on all of the (responding) IPs in an array of VLANs.
The command is nested in a PowerShell for loop and looks something like this:
nmap.exe -Pn -T4 -A -oG [FILE].txt -oX ...
1
vote
0
answers
523
views
Is there an updated (non-Nmap) top 100 or top 1000 common ports list?
I know Nmap has nmap-services file which gives us the list of top 1000 ports/services found on the Internet. But this list seems to be outdated, as the Nmap top 1000 list doesn't include several ...
1
vote
0
answers
451
views
Inbound rules for a port is configured and disabled yet an NMap scan shows that the port is opened
I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules.
As mentioned on the app, Inbound connections that do not match a rule are simply blocked.
For ...
1
vote
0
answers
421
views
Why ever "trust" Nmap's reverse lookup for system hostname when doing host discovery?
Quick question. I was scanning a lab network with Nmap just doing host discovery to see what hosts were out there. I got a list of hosts, ips, hostnames, ports open, services, etc. Upon further ...
1
vote
0
answers
6k
views
Nmap only detect virtual hosts and not physical hosts (maybe segmented network)
When my network settings is set to NAT and interface is eth0, this is the output of a simple nmap scan
root@pc:~# nmap 192.168.0.0/24
Starting Nmap 7.60 ( https://nmap.org ) at 2018-03-04 18:47 EST
...
1
vote
0
answers
909
views
LOTs of filtered ports on my server
I'm setting up a dedicated server (4 days uptime, not in production yet).
I'm a coder, not a sysadmin or a security expert so bear with me.
I just tried to portscan it with nmap -p- -T5 -Pn -sV -v to ...
1
vote
0
answers
1k
views
Open Ports (WAN side) on Netgear R7000 Router using nmap
An nmap scan (WAN side) on my Netgear R7000 router indicates that there are two ports open: 80/tcp (http) and 1720/tcp (h323q931). My method to perform a WAN side scan on the router is to access the ...
1
vote
0
answers
737
views
Snort Show OS Fingerprint Scan Detection
when I run the OS fingerprinting scan with nmap, I don't know how to detect this with snort rules.
Can you suggest a method for the rules to detect this?
1
vote
0
answers
2k
views
Understanding remote OS detection using Scapy
I am trying to understand remote OS detection techniques using Scapy. I came across the following article SANS article on Remote OS detection using Scapy and have been trying to follow it.
The ...
1
vote
0
answers
529
views
Port scanning on server
My use case is to check open ports on multiple servers, so when I try:
nmap -iL list.txt
then nmap only scans for some particular ports whether they are open or closed, but when I try:
namp -p 1-...
1
vote
0
answers
247
views
Pathping for test Pinging from subnets
Does anyone know if PathPing or NMAP can ping or scan from predefinded source IPs?
I am checking connectivity from agents on remote hosts to a destination site from my host.
Is there a switch or tool ...
0
votes
0
answers
67
views
Default nmap script execution when specifying --script banner
I have a subscription for a NSE scripts feed for nmap. There are some of those scripts which have the default category (among others)
I am running nmap in the following way
nmap --privileged -oX - -T3 ...
0
votes
0
answers
90
views
nmap scanning a slow host
Is there way how to enforce nmap waiting for replies longer (10 seconds)? I want to scan an embedded device which utilizes some sleep modes and it process packets from wi-fi module with very high ...
0
votes
0
answers
143
views
NMAP same destination ip, different scanner interface, different result
I am trying to check the port status of a external IP using NMAP, I am getting different result on different interface to same destination (destination is a public IP).
When NMAP tried from the ...
0
votes
0
answers
131
views
Does NMAP detect SecurityOnion honeypots?
I'm installing SecurityOnion Intrusion Detection Honeypot. Does NMAP recognise it as CentOS7 or it might give a hint to the hacker that it is a security onion machine build?
Does SecurityOnion have ...
0
votes
0
answers
2k
views
Scan for open ports on subdomain
I am curently scanning for open ports on a subdomain. Say I have example.com and subdomain.example.com, but this subdomain can only be reached at port 8443. How can I scan for other potential open ...
0
votes
0
answers
90
views
Does fragrouter work with OpenVPN?
My goal is to evade IDS/IPS detection and scan the target with nmap. If the scan is detected, the target seems to stop responding for 10s. I think that IP Fragmentation Attack is exactly what I need.
...
0
votes
0
answers
108
views
Stealth scan or -PS
I want to find out how -PS works for service discovery very well when there are the stealth scan options such as -sS, available in nmap.
I am currently testing nmap.scanme.org and I know there is a ...
0
votes
1
answer
16k
views
I am trying to exploit port 7000/tcp afs3-fileserver
I have been trying to exploit a cheap smart tv box that I have bought a while ago and after my nmap scan I found that port 7000/tcp was open but researching about the port gave back not much ...
0
votes
0
answers
80
views
nmap scanning Raspbian with strange results
I'm a high schooler in a CyberDefense Class and we are learning to PenTest.
I'm on Red Team and my teacher set up a system with Rasbian as the OS. When I run a scan on the computer scanning the Top ...
0
votes
0
answers
159
views
How to detect a firewall used
I was scanning a network with Nmap.
I'm looking for advanced commands for detecting firewalls.
0
votes
1
answer
244
views
does Nmap automatically use proxychains if configured?
I have configured my proxy chains in /etc/proxychains.conf. Then when just run nmap or even nc without the proxychains prefix, it automatically uses the proxy chains and routes the traffic through the ...
0
votes
0
answers
152
views
how to resolve initiating errors while running scripts with Rustscan Scripting Engine?
I wrote a one-liner shell script for rustscan which runs gobuster if port 80 is open.
I have added the script to /home/$USER/.rustscan_scripts directory.
The script looks like:
#!/bin/bash
#tags=[&...
0
votes
1
answer
1k
views
Can I elicit responses from "any remote host" on "all protocols" if I want to?
An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”.
After some research, this is something that can be exploited.
It is explained here that:
By default, WSDAPI will listen ...
0
votes
0
answers
479
views
metasploit: run nmap on compromised host
I have just compromised a computer(legal in my local environment) and want to run nmap from that host to see further inside the network. I know I can use metasploit modules like "auxillary/...
0
votes
0
answers
477
views
Host not connected to my router shows up in a nmap scan
After scanning my local network with nmap, this host shows up listed as a nmap result but it is the only host that shows on nmap that is not listed as a client on my router list of connected devices.
...
0
votes
0
answers
245
views
Using nmap to detect realtime operating system
I would like to understand whether nmap can be used to detect the operating system type for realtime OS (Vxworks, threadx, free RTOS, etc.).
Has anyone done similar work before? Or if you have any ...
0
votes
0
answers
741
views
How to fingerprint Windows 10 reliably?
Recently, I have been practicing penetration testing and I have come to a standstill when trying to fingerprint the OS for a Windows 10 target with nmap.
For the most part, I'm not able to identify ...
0
votes
0
answers
835
views
Why nmap password scanner completes in 10 seconds and doesn't give any result?
I'm completely new to nmap and I'm trying to brute force passwords on a target. A command that I'm trying is:
nmap -p 80 --unprivileged --script http-form-brute <target>
But instead of "...
0
votes
1
answer
4k
views
NMAP - Terminate/stop scan on finding open port
Is there any command on nmap or on some other tool which will stop scan and move on to a different IP on finding a single open port?
Need to perform this for host discovery on few assets which has ...
0
votes
0
answers
755
views
What are all of these IPs addresses? Honeypots?
I was scanning my network (192.168.0.1-100) and I found many IP addresses that are not mine nor known, around 800 of them. I guess it has something to do with the ISP. After scanning the ips with nmap ...
0
votes
0
answers
4k
views
How to enumerate DCE services on open port 135?
I did a vulnerability scan on a machine and found a DCE Services Enumeration vulnerability. This is described as:
Distributed Computing Environment (DCE) services running on the remote host can be ...
0
votes
1
answer
122
views
Finding how many filtered ports of a host that would be listed as “filtered” on Nmap
I just started working on nmap and was confused by this question. I'm unsure if I understood it correctly, so I appreciate your help with this.
Using Nmap, find how many ports are filtered in testphp....
0
votes
1
answer
2k
views
Zenmap: Can't get hostnames for clients just IP addresses
I have run both a quick and intense scan on my network with Zenmap and I can't get the hostnames of the clients. If I do an ARP scan I get some hostnames and if I use Fing app on my iPhone, I can see ...
-1
votes
1
answer
212
views
Strange behavior of Nmap
I do port scanning with Nmap when HotSpot Shield VPN is running; and I am receiving strange result - when HotSpot Shield is running, Nmap tells me that all of the ports are open and when HotSpot is ...