Security scanner for computers and networks.

learn more… | top users | synonyms

50
votes
3answers
121k views

How to find live hosts on my network?

I am trying to find the live hosts on my network using nmap. I am scanning the network in Ubuntu using the command sudo nmap -sP 192.168.2.1/24. However, i am unable to find the live hosts. I just get ...
15
votes
2answers
2k views

Is it possible to identify who's behind a nmap -D scan?

Nmap's -D option stands for decoy, which means that the attacker can simulate that the attack is coming from multiple IPs, including attacker's IP. From the point of view of the victim, is it ...
11
votes
4answers
2k views

Is my network being sniffed?

Is there any way to find out if someone who is connected to my network is sniffing packets? There is a way with nmap if his card is in promiscuous mode but what if it is passive?
9
votes
4answers
3k views

nmap showing unknown IPs on private network

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
8
votes
3answers
13k views

How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve ...
8
votes
4answers
6k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
7
votes
6answers
2k views

How to bypass Nmap blockage?

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside? Also, does blocking nmap on a network provide any security? ...
7
votes
2answers
448 views

How nmap guesses the operating system?

nmap has the capability to guess the operating system with the option -O. I was highly surprised that it can find the correct kernel or service pack. * How nmap guesses the operating system? * What ...
6
votes
3answers
1k views

What are the security issues of open ports?

What could be the threats of having the ports open, after performing a nmap scan and identifying the open ports? I already searched for some answers for this question, but couldn't find anything ...
6
votes
2answers
4k views

Scanning my network with NMAP

Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
6
votes
4answers
818 views

Trying to firewall ports 1863, 5190

I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need. But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further? ...
6
votes
2answers
2k views

How does nmap do a zombie and decoy scan?

We're learning nmap in my ethical hacking class. We got showed how we can use nmap to perform a zombie scan: nmap -PN -sI zombieIP targetIP and decoy scan: nmap -p 135 -D decoyIP targetIP I ...
5
votes
3answers
437 views

How can I practice using nmap without scanning some real site or performing computer trespass?

I want to learn nmap and its various options. What can I do or setup in order to see examples of issues found by nmap - e.g., something with security holes on purpose.
5
votes
4answers
1k views

Persisting and comparing NMAP scans

Does anyone have any good recommendations on a good tool for persisting NMAP scans to database? It may be a tool for persisting or simply a java library for easy parsing of the nmap xml scan result ...
5
votes
2answers
723 views

Why would a stealth scan attract more attention than a connect scan?

I'm reading an Information Security book and am faced with the question: Why may nmap stealth scans(SYN) attract more attention than simple connect scans(TCP connect())? Why might it be?
5
votes
1answer
4k views

How can I see traceroute details in NMAP?

I'm using NMAP for Network scan ; The output does not contain the full traceroute details. Can I view all intermediate routers/hosts using the NMAP GUI? A simple VPN connection IP traceroute... ...
5
votes
5answers
17k views

How to bypass tcpwrapped with nmap scan

I'd a scan task and I faced following result Host is up (0.032s latency). Scanned at 2012-10-25 16:06:38 AST for 856s PORT STATE SERVICE VERSION 1/tcp open tcpwrapped 3/tcp open ...
5
votes
2answers
1k views

How can I use nmap to distinguish between a normal linux machine and an android device?

According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
5
votes
1answer
2k views

How to use NMap to portscan a SonicWall that is blocking all attemtps?

It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
5
votes
1answer
276 views

Where can I use the TCP FIN scan?

For a coursework i've got to run the various port scans, i'm having trouble with the FIN scan though, I can't seem to find a system where I can try it, everywhere I try it all ports either come back ...
4
votes
3answers
7k views

Why does an nmap -sT scan show ports filtered but -sS shows ports closed

What are possible reasons why an nmap -sT scan would show "ports filtered" but an identical nmap -sS scan shows "ports closed"? I understand that -sT is a full TCP Connect, which is easier to detect ...
4
votes
4answers
1k views

How can I scan open ports without being traced back

I would like to scan open ports of a server. But as far as I know, when I try to scan the open ports with something like nmap in shell they would be able to trace me. Is there a way to secure this ...
4
votes
2answers
799 views

Detect what is running on an open port?

I have a wireless camera in my network. Running nmap on the camera, I discovered that the port 1010 is open but I could not find what it is used for. I looked in the administration pannel and did not ...
4
votes
1answer
4k views

Nmap scan produces all “unknown”

I scanned both localhost, and the IP address of the LAN adapter, and this is the produced output. Starting Nmap 5.51 ( http://nmap.org ) at 2012-10-12 18:06 Eastern Daylight Time Skipping SYN Stealth ...
4
votes
2answers
447 views

Determing live hosts past a restrictive firewall with nmap

Sometimes when I am doing an external security assesment, I run into hosts that have the following restrictions/configuration: All ICMP traffic is blocked An IDS or some device returns all ports as ...
4
votes
3answers
1k views

Sharing Nmap scan results in a web page

Is there a tool that allow the sharing of nmap scan results ? I know nmap can produce XML and I can easily convert them in HTML. I would like to know if there is a tool with more features. For ...
4
votes
1answer
503 views

Is it possible to detect host-machine of my virtual-machines?

So basically I need to know is there any way to find a connection (or relation) between packets sent by my VMs and my host machine. In my lab I have lots of workstations, each running a VirtualBox ...
4
votes
1answer
69 views

Firewalk through a Firewall on our subnet

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram: (Skip to the bottom of the following explanation for a direct list of ...
3
votes
5answers
2k views

Nmap reporting almost every port as open

I have noticed during some assesments when doing a TCP port scan, Nmap will report almost every port as open for a machine. Using for example nmap -sS -PN -T4 target -p0-65535, over 20,000 ports will ...
3
votes
1answer
131 views

nmap: why is it “silly” to combine OS finding option (-O) with bounce scan (-b)

If you run an Nmap FTP bounce scan with nmap -O -b, nmap will do the scan, but it says that the scan "seems silly" before it starts. Why would the scan be silly? It actually appears to report a ton ...
3
votes
2answers
441 views

Which ports are potential security risks for nmap?

I'm using nmap and I am having trouble finding which ports are dangerous and pose the greatest security risks. Which ports are potential security risks for nmap? I was thinking samba, telnet, vnc ...
3
votes
2answers
7k views

Could Nmap scan switches/routers

Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.
3
votes
3answers
317 views

Is there a nmap command to get the top # most common ports?

I understand nmap by default scans the top 1k 'most common' ports (-F reduces to 100) I understand it gets these 'most common' ports based on the nmap-services file, specifically the frequency (3rd ...
3
votes
2answers
1k views

OS Fingerprinting for Android

Are traditional OS-fingerprinting techniques effective in identifying Android smartphones (OS version) on a network. From my research I found most Android network mappers can be only run from Android ...
3
votes
1answer
142 views

Use nmap correctly

I currently have a VPS in a data center, I asked the admin to open a port to install a ftp server. It opened port 3345, at first I tought the port is not forwarded correctly, because I ran nmap as ...
3
votes
2answers
81 views

Why does a nmap scan give different results depending on whether it's run from inside or outside a LAN

I am testing/setting up a Thompson TG585v7 router/firewall. Results when running nmap from a computer INSIDE the LAN $ sudo nmap -O 210.86.xxx.xxx Starting Nmap 6.40 ( http://nmap.org ) at ...
3
votes
2answers
107 views

If nmap reports a port is open, does that ALSO mean a service is listening on the port?

I have a Thompson TG585v7 router/firewall whose firewall is configured to FORWARD several ports to a computer X54 within the LAN. These ports are in the range 1024 through to 2500 That X54 ...
3
votes
2answers
281 views

are there any services to test nmap

While playing with nmap, I have started to wonder: are there any ip addresses which were specifically made to learn how to use nmap. (As far as I understood I can not just scan any ip address, ...
3
votes
1answer
454 views

Scan All private subnets with NMAP [closed]

I have a managed switch on my network but I don't remember the subnet. How can I scan all the private network without changing my ip address : 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 Thanks for ...
3
votes
1answer
4k views

Scan multicast IP range on specific port using nmap

I'd like to scan a multicast IP range on a specific port using nmap. When I try to simply do a nmap -p 10000 239.35.0.0/16, it just responds with an error stating Strange error from connect ...
3
votes
2answers
1k views

Why do multiple IP Addresses in my local network point to the same computer?

I'm new to linux and nmap, and I am attempting to do a scan of my local network. Using nmap I find that there are 4 hosts on my network (10.0.2.2, 10.0.2.3, 10.0.2.4, 10.0.2.15). I am using VirtualBox ...
3
votes
1answer
134 views

Honeyd Isn't Detecting Loud Scans [closed]

I've got the Honeyd honeypot in one virtual machine (kali) and nmap in another (ubuntu), the config file looks like this: create default set default default tcp action closed set default default udp ...
2
votes
2answers
353 views

How to force nmap to check all the ports?

I heard that nmap scans for only 1000 most common ports while we do server scan. Is it possible to force nmap to check all the ports for scanning? If yes,How?
2
votes
5answers
771 views

OS fingerprinting: can I rely on the results?

Using nmap -O www.example.com I get: Running (JUST GUESSING): Microsoft Windows 7|2008 (90%) So I can say the target site is running Windows. Using xprobe2 -v www.example.com, I'm just astonished ...
2
votes
2answers
3k views

nmap no ping returns host is active and all ports are filtered

I am trying to determine if hosts are up. For hosts where a ping fails, I run a nmap (6.40) Regular and/or Quick scan. For a subset of my hosts, the nmap response is "Host seems down". As a follow up ...
2
votes
2answers
4k views

NMAP DNS Service Detection

I was looking out how NMAP identifies DNS services. After determining that port 53 is open it issues a standard query TXT version.bind to find out if BIND is running on the domain port. Then, I saw ...
2
votes
2answers
2k views

How to block network scans with pfsense?

I am using pfsense as firewall, and I would like to know how I can stop network scans from enumerating open services and ports. Thanks
2
votes
1answer
69 views

Optimal flags to specify when using nmap to guess the OS on remote devices?

Optimal flags to specify when using nmap to guess the OS on remote devices? I'm currently using the following: nmap --privileged -sS -sU -sY -sZ -O --osscan-guess -F -r 192.168.200.223 This seems ...
2
votes
1answer
906 views

Why are some ports reported as closed by nmap?

I was scanning a machine from inside the same LAN which is running and up to date Windows XP Home Edition which I suspect may be running some malware. The target machine has an up to date antivirus ...
2
votes
2answers
341 views

Why does NMAP scan list hosts as up? [closed]

When running an NMAP scan of my internal network (192.168.1.0/24) from my Mac, NMAP sees all hosts as live. It also believes there is a port 80 http service running on every IP when I do not have 254 ...