If nmap shows all ports are filtered or closed, what would be the next logical step to take to get more information?

Question

If nmap shows all ports are filtered or closed, what would be the next logical step to take?

Does that mean I would need to get physical access to the device? or is there any other ways to get information?

I'm trying to scan my own smartphone and all the ports are closed, and I did the same with my laptop and all the ports were filtered, so, I'm kind of stuck.

On the other hand, all the information I found on the Internet is relying on getting more results with different nmap scans.

Is there any other software, technique or anything to do that's not involving nmap?

Answer 1

Checking for open ports using nmap only does a comparably dumb check if services are directly accessible on the device. In the default setup it will only check a few ports and thus will not find any services running on unusual ports.

But even when checking all ports it will not find services restricted to specific source IP addresses or protected by port-knocking or otherwise magic packets or packet sequences. Access to these services does not require physical access to the machine, but it requires specific knowledge about the kind of protection used and also possible secrets involved - none of this is involved by just a dumb nmap.

And even if no services are accessible on the machine it does not mean that physical access is needed. There might be outgoing connections from the machine where the response from some external server gets processed on the machine. This is done when reading mail on the machine or browsing the web but also when checking for updates or other automatic actions. Injecting an unexpected response might allow an attacker to attack the system from inside. But again, this requires no physical access but knowledge of what the system is actually doing and lots of knowledge about potential vulnerabilities in the installed software, OS, social engineering to make the user install some software etc.

And there is more which does not involve physical access: there might for example be vulnerabilities in the Bluetooth or Wifi stack which can be used to attack the machine.

... what would be the next logical step to take?

Gain more knowledge about the system you are trying to attack, the installed software and its weaknesses, weaknesses of the end user etc. In a way it is like when you are trying to steal something: checking for open doors (nmap) is only a very simple step and very likely the doors are closed. But there might be weak locks, windows, gullible residents which open the door for you etc.

Answer 2

Not all devices are going to have ports open unless they are running some kind of services. Running exposed services is not really typical for most personal devices.

When targeting a system, you need to consider all inputs into said system. Open ports/services are just one such input into a system. Therefore, you would need to move on to something else besides remote attacks; perhaps the device calls out and the communications there can be intercepted or exploited, or maybe it is running a vulnerable Bluetooth stack. These are just examples, but the point is that it's not all about listening ports.

Answer 3

It is possible that the device is simply not exposing any open ports. Thus you are not finding anything, but... port scanning is an art. Nmap has many options and there are pitfalls too.

If you are stuck at this stage, you could try something else to gain a better understanding about the inner workings of your device. Assuming it's connected to your home wifi network, you could try to sniff the traffic flowing in and out. Look at the types of traffic (eg HTTP, DNS etc) and the destination ports. Then you can start making educated guesses about what kind of software is running on the device eg an embedded webserver or something else.

For example I have a managed switch and I have configured port mirroring so that all traffic flowing through a specific port is "copied" to another switch port, and from there I use a separate network card and Wireshark to analyze the traffic.

My suggestion would be to build a small lab, perhaps invest in some equipment like a managed switch that will make the job easier. You can also build your own. For example if you have a spare Raspberry PI you can build a wifi hotspot with hostapd and then you can sniff all that you want.

Learning how to use Wireshark will be a requirement. Shouldn't be too difficult. One of the first things to know is how to set up capture filters or display filters, so as to filter the traffic to a single known MAC address, and eliminate the "background noise".

Another suggestion: since you have physical access to the device you could enable debugging mode from USB, on an Android device you would use ADB. Root the device perhaps. Once you have console access you should be able to see what's going inside the device.

Answer 4

Depends on the type of scan.

A "classic" scan might yield 0 results,

but you can always try f.e. a x-mas scan or null-scan to force errors in the program handling the port.