Does nmap port scan return the correct ports for the websites that don't allow direct IP access

Question

I am new to the field of penetration testing, and I'm currently testing an application, for learning purposes with their legit, written permit. When I did a nslookup for that site, it returned me an IP address. But accessing the web directly through that IP address, displayed a server default page which said, the page has been removed or site has moved. However, the site can be accessed via the domain name.

My question is, whether the port scan results generated by nmap returns the correct ports for that website? Or is that result, applied for all the websites hosted on that shared server? please correct me, if I'm wrong at any point.

Answer 1

nmap returns port information for an IP address, not a website.

When you connect to a web site, your browser sends a request that looks something like this:

GET / HTTP/1.1
Host: www.example.com

The web server software looks at the name provided in the "Host" field and will serve you a response from the appropriate virtual name-based container. So when you go to www.example.com, the server knows you want that site, and feeds it to you. However, if you go to 192.168.1.2, your request will look like this:

GET / HTTP/1.1
Host: 192.168.1.2

and the server sees that and says "I don't have a configuration for a name 192.168.1.2! I'm going to serve a response from the default virtual." And in your case, the default virtual is a default page that says "the page has been removed or the site has moved."

So that's why you see two different answers from the same web server depending on which name you use.

But that web server is listening to IP 192.168.1.2. When you scan that IP address with nmap, it will show that (say) port 80 and port 443. This is separate from the question of what multiple sites might be hosted on one of those ports; the port is open.