Questions tagged [nmap]

A robust and open source security tool for network discovery and security auditing.

42 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
562 views

Preventing Dionaea Service Identification

I've been working on trying to prevent Dionaea service identification using articles such as this. I've managed to disguise most of the ports that dionaea utilizes. However, when scanning with nmap, ...
Lang Tran's user avatar
3 votes
0 answers
941 views

What reason would you use the decoy scan option for Nmap?

I'm confused as to why you would use the -D option for Nmap. Is there any 'white hat' reason for using it? Or is it used particularly for malicious purposes?
ssharma's user avatar
  • 171
2 votes
0 answers
1k views

Check for allowed OpenVPN SSL/TLS cipher suites from the client-side

I would like to check cipher suites that the OpenVPN server accepts. I used nmap: nmap -sU --script ssl-enum-ciphers -p 1194 <IP> but the results are only: Host is up (0.0033s latency). PORT ...
user187205's user avatar
  • 1,323
2 votes
0 answers
1k views

Windows XP SP3 2002 is not vulnerable to MS08-067

Why is my VM not vulnerable to MS08-067? There are similar question on stack exchange, yes, but they fail to specify all relevant information and so non receive a meaningful, thoughtful nor thorough ...
HackingAndJiuJItsu's user avatar
2 votes
0 answers
257 views

WPA2-Enterprise - unable to find a way around Lanner Electronics

I have currently been working in an environment where I am connected to a WPA2-Enterprise network requiring me to enter my username and password for the network whenever I connect. I have been asked ...
user3801447's user avatar
1 vote
0 answers
2k views

SSLLabs' SSLTest vs. nmap ssl-enum-ciphers

Recently I conducted a SSL server test to assess the SSL configuration of my server. While the overall grade A+ was pretty good, it was found that the server supports several cipher suites that are ...
dpr's user avatar
  • 121
1 vote
0 answers
119 views

How to evaluate a responsive but unknown network protocol?

I am studying CREST CPSA where the syllabus is listed here. There is a part of the syllabus which states I should know the Evaluation of responsive but unknown network applications. I find this ...
questioner's user avatar
1 vote
0 answers
451 views

Unable to ping scan my machine (but I can ping)

I need to perform an nmap scan on all of the (responding) IPs in an array of VLANs. The command is nested in a PowerShell for loop and looks something like this: nmap.exe -Pn -T4 -A -oG [FILE].txt -oX ...
TheCube's user avatar
  • 11
1 vote
0 answers
523 views

Is there an updated (non-Nmap) top 100 or top 1000 common ports list?

I know Nmap has nmap-services file which gives us the list of top 1000 ports/services found on the Internet. But this list seems to be outdated, as the Nmap top 1000 list doesn't include several ...
519dsd's user avatar
  • 11
1 vote
0 answers
451 views

Inbound rules for a port is configured and disabled yet an NMap scan shows that the port is opened

I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules. As mentioned on the app, Inbound connections that do not match a rule are simply blocked. For ...
Malabika Sen's user avatar
1 vote
0 answers
421 views

Why ever "trust" Nmap's reverse lookup for system hostname when doing host discovery?

Quick question. I was scanning a lab network with Nmap just doing host discovery to see what hosts were out there. I got a list of hosts, ips, hostnames, ports open, services, etc. Upon further ...
5lb Bass's user avatar
  • 111
1 vote
0 answers
6k views

Nmap only detect virtual hosts and not physical hosts (maybe segmented network)

When my network settings is set to NAT and interface is eth0, this is the output of a simple nmap scan root@pc:~# nmap 192.168.0.0/24 Starting Nmap 7.60 ( https://nmap.org ) at 2018-03-04 18:47 EST ...
Max Roatta's user avatar
1 vote
0 answers
909 views

LOTs of filtered ports on my server

I'm setting up a dedicated server (4 days uptime, not in production yet). I'm a coder, not a sysadmin or a security expert so bear with me. I just tried to portscan it with nmap -p- -T5 -Pn -sV -v to ...
Fiochkij's user avatar
1 vote
0 answers
1k views

Open Ports (WAN side) on Netgear R7000 Router using nmap

An nmap scan (WAN side) on my Netgear R7000 router indicates that there are two ports open: 80/tcp (http) and 1720/tcp (h323q931). My method to perform a WAN side scan on the router is to access the ...
user135584's user avatar
1 vote
0 answers
737 views

Snort Show OS Fingerprint Scan Detection

when I run the OS fingerprinting scan with nmap, I don't know how to detect this with snort rules. Can you suggest a method for the rules to detect this?
user132462's user avatar
1 vote
0 answers
2k views

Understanding remote OS detection using Scapy

I am trying to understand remote OS detection techniques using Scapy. I came across the following article SANS article on Remote OS detection using Scapy and have been trying to follow it. The ...
qre0ct's user avatar
  • 1,532
1 vote
0 answers
529 views

Port scanning on server

My use case is to check open ports on multiple servers, so when I try: nmap -iL list.txt then nmap only scans for some particular ports whether they are open or closed, but when I try: namp -p 1-...
bhartay's user avatar
  • 89
1 vote
0 answers
247 views

Pathping for test Pinging from subnets

Does anyone know if PathPing or NMAP can ping or scan from predefinded source IPs? I am checking connectivity from agents on remote hosts to a destination site from my host. Is there a switch or tool ...
Gregg Dotoli's user avatar
0 votes
0 answers
67 views

Default nmap script execution when specifying --script banner

I have a subscription for a NSE scripts feed for nmap. There are some of those scripts which have the default category (among others) I am running nmap in the following way nmap --privileged -oX - -T3 ...
alvaroalo's user avatar
0 votes
0 answers
90 views

nmap scanning a slow host

Is there way how to enforce nmap waiting for replies longer (10 seconds)? I want to scan an embedded device which utilizes some sleep modes and it process packets from wi-fi module with very high ...
Misaz's user avatar
  • 101
0 votes
0 answers
143 views

NMAP same destination ip, different scanner interface, different result

I am trying to check the port status of a external IP using NMAP, I am getting different result on different interface to same destination (destination is a public IP). When NMAP tried from the ...
Shaim Khanusiya's user avatar
0 votes
0 answers
131 views

Does NMAP detect SecurityOnion honeypots?

I'm installing SecurityOnion Intrusion Detection Honeypot. Does NMAP recognise it as CentOS7 or it might give a hint to the hacker that it is a security onion machine build? Does SecurityOnion have ...
user228062's user avatar
0 votes
0 answers
2k views

Scan for open ports on subdomain

I am curently scanning for open ports on a subdomain. Say I have example.com and subdomain.example.com, but this subdomain can only be reached at port 8443. How can I scan for other potential open ...
vargr616's user avatar
0 votes
0 answers
90 views

Does fragrouter work with OpenVPN?

My goal is to evade IDS/IPS detection and scan the target with nmap. If the scan is detected, the target seems to stop responding for 10s. I think that IP Fragmentation Attack is exactly what I need. ...
ksenia pi's user avatar
0 votes
0 answers
108 views

Stealth scan or -PS

I want to find out how -PS works for service discovery very well when there are the stealth scan options such as -sS, available in nmap. I am currently testing nmap.scanme.org and I know there is a ...
predatororc's user avatar
0 votes
1 answer
16k views

I am trying to exploit port 7000/tcp afs3-fileserver

I have been trying to exploit a cheap smart tv box that I have bought a while ago and after my nmap scan I found that port 7000/tcp was open but researching about the port gave back not much ...
M4trix's user avatar
  • 1
0 votes
0 answers
80 views

nmap scanning Raspbian with strange results

I'm a high schooler in a CyberDefense Class and we are learning to PenTest. I'm on Red Team and my teacher set up a system with Rasbian as the OS. When I run a scan on the computer scanning the Top ...
Aaron908's user avatar
0 votes
0 answers
159 views

How to detect a firewall used

I was scanning a network with Nmap. I'm looking for advanced commands for detecting firewalls.
Imran Niaz's user avatar
0 votes
1 answer
244 views

does Nmap automatically use proxychains if configured?

I have configured my proxy chains in /etc/proxychains.conf. Then when just run nmap or even nc without the proxychains prefix, it automatically uses the proxy chains and routes the traffic through the ...
JackDVD's user avatar
  • 11
0 votes
0 answers
152 views

how to resolve initiating errors while running scripts with Rustscan Scripting Engine?

I wrote a one-liner shell script for rustscan which runs gobuster if port 80 is open. I have added the script to /home/$USER/.rustscan_scripts directory. The script looks like: #!/bin/bash #tags=[&...
Gaurav Purswani's user avatar
0 votes
1 answer
1k views

Can I elicit responses from "any remote host" on "all protocols" if I want to?

An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”. After some research, this is something that can be exploited. It is explained here that: By default, WSDAPI will listen ...
Freddy Nova's user avatar
0 votes
0 answers
479 views

metasploit: run nmap on compromised host

I have just compromised a computer(legal in my local environment) and want to run nmap from that host to see further inside the network. I know I can use metasploit modules like "auxillary/...
Mr Krisey's user avatar
0 votes
0 answers
477 views

Host not connected to my router shows up in a nmap scan

After scanning my local network with nmap, this host shows up listed as a nmap result but it is the only host that shows on nmap that is not listed as a client on my router list of connected devices. ...
Luis Vasconcellos's user avatar
0 votes
0 answers
245 views

Using nmap to detect realtime operating system

I would like to understand whether nmap can be used to detect the operating system type for realtime OS (Vxworks, threadx, free RTOS, etc.). Has anyone done similar work before? Or if you have any ...
j2eeuser's user avatar
0 votes
0 answers
741 views

How to fingerprint Windows 10 reliably?

Recently, I have been practicing penetration testing and I have come to a standstill when trying to fingerprint the OS for a Windows 10 target with nmap. For the most part, I'm not able to identify ...
rodney williams's user avatar
0 votes
0 answers
835 views

Why nmap password scanner completes in 10 seconds and doesn't give any result?

I'm completely new to nmap and I'm trying to brute force passwords on a target. A command that I'm trying is: nmap -p 80 --unprivileged --script http-form-brute <target> But instead of "...
ThisIsJohnCena's user avatar
0 votes
1 answer
4k views

NMAP - Terminate/stop scan on finding open port

Is there any command on nmap or on some other tool which will stop scan and move on to a different IP on finding a single open port? Need to perform this for host discovery on few assets which has ...
Rapt0r 's user avatar
0 votes
0 answers
755 views

What are all of these IPs addresses? Honeypots?

I was scanning my network (192.168.0.1-100) and I found many IP addresses that are not mine nor known, around 800 of them. I guess it has something to do with the ISP. After scanning the ips with nmap ...
Philippe Delteil's user avatar
0 votes
0 answers
4k views

How to enumerate DCE services on open port 135?

I did a vulnerability scan on a machine and found a DCE Services Enumeration vulnerability. This is described as: Distributed Computing Environment (DCE) services running on the remote host can be ...
123's user avatar
  • 235
0 votes
1 answer
122 views

Finding how many filtered ports of a host that would be listed as “filtered” on Nmap

I just started working on nmap and was confused by this question. I'm unsure if I understood it correctly, so I appreciate your help with this. Using Nmap, find how many ports are filtered in testphp....
KhoaiLangNuong's user avatar
0 votes
1 answer
2k views

Zenmap: Can't get hostnames for clients just IP addresses

I have run both a quick and intense scan on my network with Zenmap and I can't get the hostnames of the clients. If I do an ARP scan I get some hostnames and if I use Fing app on my iPhone, I can see ...
Irene Ant's user avatar
  • 669
-1 votes
1 answer
212 views

Strange behavior of Nmap

I do port scanning with Nmap when HotSpot Shield VPN is running; and I am receiving strange result - when HotSpot Shield is running, Nmap tells me that all of the ports are open and when HotSpot is ...
Farid Abdi's user avatar