Security scanner for computers and networks.

learn more… | top users | synonyms

88
votes
4answers
254k views

How to find live hosts on my network?

I am trying to find the live hosts on my network using nmap. I am scanning the network in Ubuntu using the command sudo nmap -sP 192.168.2.1/24. However, I am unable to find the live hosts. I just get ...
15
votes
2answers
2k views

Is it possible to identify who's behind a nmap -D scan?

Nmap's -D option stands for decoy, which means that the attacker can simulate that the attack is coming from multiple IPs, including attacker's IP. From the point of view of the victim, is it ...
14
votes
3answers
24k views

How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve ...
11
votes
4answers
3k views

Is my network being sniffed?

Is there any way to find out if someone who is connected to my network is sniffing packets? There is a way with nmap if his card is in promiscuous mode but what if it is passive?
10
votes
4answers
1k views

Filtered ports - What exactly filters them?

By the NMAP definition, unfiltered ports are the ones which cannot be determined to be open or closed since packet filtering prevents its probes from reaching the port. (ISBN 9780979958717 pag. 77) ...
9
votes
4answers
4k views

nmap showing unknown IPs on private network

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
8
votes
4answers
8k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
7
votes
2answers
748 views

How nmap guesses the operating system?

nmap has the capability to guess the operating system with the option -O. I was highly surprised that it can find the correct kernel or service pack. * How nmap guesses the operating system? * What ...
7
votes
6answers
3k views

How to bypass Nmap blockage?

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside? Also, does blocking nmap on a network provide any security? ...
7
votes
2answers
4k views

How does nmap do a zombie and decoy scan?

We're learning nmap in my ethical hacking class. We got showed how we can use nmap to perform a zombie scan: nmap -PN -sI zombieIP targetIP and decoy scan: nmap -p 135 -D decoyIP targetIP I ...
7
votes
1answer
2k views

How to use NMap to portscan a SonicWall that is blocking all attemtps?

It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
6
votes
3answers
1k views

What are the security issues of open ports?

What could be the threats of having the ports open, after performing a nmap scan and identifying the open ports? I already searched for some answers for this question, but couldn't find anything ...
6
votes
2answers
5k views

Scanning my network with NMAP

Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
6
votes
5answers
27k views

How to bypass tcpwrapped with nmap scan

I'd a scan task and I faced following result Host is up (0.032s latency). Scanned at 2012-10-25 16:06:38 AST for 856s PORT STATE SERVICE VERSION 1/tcp open tcpwrapped 3/tcp open ...
6
votes
3answers
774 views

How can I practice using nmap without scanning some real site or performing computer trespass?

I want to learn nmap and its various options. What can I do or setup in order to see examples of issues found by nmap - e.g., something with security holes on purpose.
6
votes
4answers
1k views

Trying to firewall ports 1863, 5190

I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need. But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further? ...
6
votes
1answer
596 views

Message signing disabled (dangerous, but default)

Over the last couple of years, I've developed a fairly keen interest in Penetration Testing & Information Security. Throughout this time, I've acquired (and accumulated) a range of different ...
6
votes
1answer
181 views

What is the purpose of using different DNS server in nmap?

nmap allows the use of different DNS servers (not local). What is the benefit of doing so?
5
votes
5answers
4k views

Nmap reporting almost every port as open

I have noticed during some assesments when doing a TCP port scan, Nmap will report almost every port as open for a machine. Using for example nmap -sS -PN -T4 target -p0-65535, over 20,000 ports will ...
5
votes
3answers
12k views

Why does an nmap -sT scan show ports filtered but -sS shows ports closed

What are possible reasons why an nmap -sT scan would show "ports filtered" but an identical nmap -sS scan shows "ports closed"? I understand that -sT is a full TCP Connect, which is easier to detect ...
5
votes
4answers
1k views

Persisting and comparing NMAP scans

Does anyone have any good recommendations on a good tool for persisting NMAP scans to database? It may be a tool for persisting or simply a java library for easy parsing of the nmap xml scan result ...
5
votes
2answers
910 views

Why would a stealth scan attract more attention than a connect scan?

I'm reading an Information Security book and am faced with the question: Why may nmap stealth scans(SYN) attract more attention than simple connect scans(TCP connect())? Why might it be?
5
votes
2answers
1k views

Detect what is running on an open port?

I have a wireless camera in my network. Running nmap on the camera, I discovered that the port 1010 is open but I could not find what it is used for. I looked in the administration pannel and did not ...
5
votes
1answer
7k views

How can I see traceroute details in NMAP?

I'm using NMAP for Network scan ; The output does not contain the full traceroute details. Can I view all intermediate routers/hosts using the NMAP GUI? A simple VPN connection IP traceroute... ...
5
votes
2answers
2k views

How can I use nmap to distinguish between a normal linux machine and an android device?

According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
5
votes
1answer
6k views

Nmap scan produces all “unknown”

I scanned both localhost, and the IP address of the LAN adapter, and this is the produced output. Starting Nmap 5.51 ( http://nmap.org ) at 2012-10-12 18:06 Eastern Daylight Time Skipping SYN Stealth ...
5
votes
1answer
518 views

Where can I use the TCP FIN scan?

For a coursework i've got to run the various port scans, i'm having trouble with the FIN scan though, I can't seem to find a system where I can try it, everywhere I try it all ports either come back ...
5
votes
5answers
2k views

Sharing Nmap scan results in a web page [closed]

Is there a tool that allow the sharing of nmap scan results ? I know nmap can produce XML and I can easily convert them in HTML. I would like to know if there is a tool with more features. For ...
4
votes
4answers
1k views

How to run nmap HTTP scripts on unusual ports

How can I make nmap run the HTTP-scripts on ports that are unusual for HTTP, say TCP port 123? On something like nmap -n --script="http* ..." -p123 target nmap does nothing except to check that port ...
4
votes
2answers
10k views

Could Nmap scan switches/routers

Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.
4
votes
4answers
2k views

How can I scan open ports without being traced back

I would like to scan open ports of a server. But as far as I know, when I try to scan the open ports with something like nmap in shell they would be able to trace me. Is there a way to secure this ...
4
votes
2answers
73 views

Stop Nmap scan and preserve XML output

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
4
votes
2answers
396 views

If nmap reports a port is open, does that ALSO mean a service is listening on the port?

I have a Thompson TG585v7 router/firewall whose firewall is configured to FORWARD several ports to a computer X54 within the LAN. These ports are in the range 1024 through to 2500 That X54 ...
4
votes
3answers
72 views

Nmap showing ISPs router's DNS port in addition to target's ports

Whenever I do nmap scans my ISP router DNS port like the following. This happens for every IP or target. $ nmap -T4 -A -v stackoverflow.com PORT STATE SERVICE VERSION 53/tcp open domain ...
4
votes
2answers
548 views

Determing live hosts past a restrictive firewall with nmap

Sometimes when I am doing an external security assesment, I run into hosts that have the following restrictions/configuration: All ICMP traffic is blocked An IDS or some device returns all ports as ...
4
votes
1answer
694 views

Is it possible to detect host-machine of my virtual-machines?

So basically I need to know is there any way to find a connection (or relation) between packets sent by my VMs and my host machine. In my lab I have lots of workstations, each running a VirtualBox ...
4
votes
2answers
109 views

When should I drop a packet with ICMP type 3, code 9 or 10, TCP RST, or TCP ACK?

This answer says there are a few ways of dealing with a blocked packet at a firewall: At each of these levels a 1st IP packet (and any other protocol packet as an ESP or AH packet) might receive ...
4
votes
1answer
622 views

Firewalk through a Firewall on our subnet

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram: (Skip to the bottom of the following explanation for a direct list of ...
4
votes
1answer
142 views

Is my router/modem compromised?

So I recently ran a port scan (just TCP) on my home router/modem (AT&T U-Verse) and found two peculiar ports that are open. Here is the scan output/results for nmap 192.168.1.254 -P0: Starting ...
3
votes
2answers
723 views

How to force nmap to check all the ports?

I heard that nmap scans for only 1000 most common ports while we do server scan. Is it possible to force nmap to check all the ports for scanning? If yes,How?
3
votes
5answers
5k views

Increase speed in nmap UDP scan?

How can I get nmap quicker in scanning UDP ports? This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
3
votes
2answers
4k views

nmap no ping returns host is active and all ports are filtered

I am trying to determine if hosts are up. For hosts where a ping fails, I run a nmap (6.40) Regular and/or Quick scan. For a subset of my hosts, the nmap response is "Host seems down". As a follow up ...
3
votes
4answers
2k views

Is there a nmap command to get the top # most common ports?

I understand nmap by default scans the top 1k 'most common' ports (-F reduces to 100) I understand it gets these 'most common' ports based on the nmap-services file, specifically the frequency (3rd ...
3
votes
1answer
156 views

nmap: why is it “silly” to combine OS finding option (-O) with bounce scan (-b)

If you run an Nmap FTP bounce scan with nmap -O -b, nmap will do the scan, but it says that the scan "seems silly" before it starts. Why would the scan be silly? It actually appears to report a ton ...
3
votes
2answers
645 views

Which ports are potential security risks for nmap?

I'm using nmap and I am having trouble finding which ports are dangerous and pose the greatest security risks. Which ports are potential security risks for nmap? I was thinking samba, telnet, vnc ...
3
votes
2answers
2k views

OS Fingerprinting for Android

Are traditional OS-fingerprinting techniques effective in identifying Android smartphones (OS version) on a network. From my research I found most Android network mappers can be only run from Android ...
3
votes
2answers
118 views

Deauth all users on AP except yourself

I am looking to create a small first project to further my self education into infosec. I will be putting this on my Github. My idea is to create a script that automates the process of deauthing all ...
3
votes
2answers
130 views

Router reboots when using Nmap

I hope this question is OK to ask here. When I scan a external IP-address with Nmap my router always reboots itself, sometimes I even have to manually restart it by using the power switch. The ...
3
votes
1answer
208 views

Use nmap correctly

I currently have a VPS in a data center, I asked the admin to open a port to install a ftp server. It opened port 3345, at first I tought the port is not forwarded correctly, because I ran nmap as ...
3
votes
2answers
318 views

Why does a nmap scan give different results depending on whether it's run from inside or outside a LAN

I am testing/setting up a Thompson TG585v7 router/firewall. Results when running nmap from a computer INSIDE the LAN $ sudo nmap -O 210.86.xxx.xxx Starting Nmap 6.40 ( http://nmap.org ) at ...