0

I need to:

--resume <filename>:      Resume an aborted interrupted scan.

But I didn’t:

-oN/-oX/-oS/-oG <file>:   Output scan in normal, XML, s|<rIpt kIddi3,
                          and Grepable format, respectively, to the given filename.

Nor did I:

-oA <basename>:           Output in the three major formats at once.


So:

  • Can it be done?
  • What are my options?
  • Are there temporary logs etc.?
  • I think you are out of luck on this one if you didn't generate the files – schroeder Dec 4 '15 at 17:56
  • 1
    you'll miss a few ports, but if you don't care try stopping it with ^z – Some Linux Nerd Dec 4 '15 at 22:25
  • 1
    It doesn't help if nmap exits for some reason, but it's useful if you feel like pausing and returning to a scan later. It's actually bash functionality, not nmap's. – Some Linux Nerd Dec 7 '15 at 3:50
  • 1
    Oh right, it's the built in bash command "fg" or "bg" - the first sends it back to the foreground, the other backgrounds it. Really useful piece of bash functionality – Some Linux Nerd Dec 8 '15 at 21:47
  • 1
    @SomeLinuxNerd I love bash. – voices Dec 9 '15 at 3:49
2

You didn't reply when I answered this on IRC. Nmap does not make temporary logs, but Zenmap and Metasploit (and probably Armitage) automatically save XML output to a temp file for later parsing. Unfortunately, Nmap's --resume feature does not support resuming from XML (yet).

Some general observations that may help in the future:

  • Always save output. Get in the habit, because even though a results viewer or other tool may use the raw output to fill a database model, it will likely miss some information that you may want to use later.
  • Use a terminal multiplexer like GNU Screen or tmux to avoid losing long-running processes when your connection hiccups. Along those lines, check whether Armitage kept running your scan even when you disconnected.
  • Hey bonsaiviking, I didn't see your reply on IRC yet. Thanks for clearing this up. Armitage was halted immediately. I will have to either get in the habit of setting the output flags or using screen or tmux. So what format do you recommend? – voices Dec 5 '15 at 12:59
  • Actually, would you mind clarifying how using screen or tmux will help in this instance? Cheers, much appreciated. – voices Dec 5 '15 at 13:02
  • 1
    @tjt263 I always use -oA because then I can process output with my eyes (Normal), awk/grep (Grepable), or more advanced tools (XML). Using screen or tmux means your session keeps going when you lose connection. You just reconnect to it (screen -R, tmux attach). There are lots of other useful features, too, but this is one of the best. – bonsaiviking Dec 6 '15 at 4:48
  • I've used tmux before but; if the network connection is interrupted and the scan stops, will tmux still help? – voices Dec 6 '15 at 12:10
  • 1
    @tjt263 I see your problem. I was assuming it was only your connection to the scanner that was flaky, not the scanner's own connection. No, tmux will not help in that case. Just have to try to make your connection better. – bonsaiviking Dec 7 '15 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.