1

I would like to probe if a port is running socks or squid service, but nmap runs all service probes by default, can I change that?

Also from the debug output, there's a NSE script pre-scanning, can I disable that too?

P.S attached nmap command

nmap 58.250.87.87 -p 10080 -sV -A --version-intensity 8 -Pn -n -T4 --max-retries 0 -vvv --debug
Improve this question

2 Answers 2

Reset to default
3

The first thing to do is to remove -A from your command, since that implicitly requests scripts in the "default" category (being the equivalent of -sV -sC -O --traceroute.

Next, you will still have scripts in the "version" category running. These are specifically designed to enhance the -sV version scan by probing services that will not respond adequately to a single static probe. If you really need to turn these off, you can (since Nmap 6.49BETA1) set the script-intensity script argument to 0: --script-args script-intensity=0. This will prevent version-category scripts from running unless you select them by name.

Improve this answer
10
  • -sV works for me
    – daisy
    Dec 3, 2017 at 7:03
  • @bonsaiviking How about disable port-scanning only do version-detection? I prefer -sV without port-scanning first.
    – Ryan Chou
    Aug 15, 2018 at 6:28
  • @RyanChou Nmap doesn't work that way; the version detection engine only knows about the ports that port scan detected as open. However, you can limit your scan to only the ports you want to probe with the -p option. For instance, if you only want to fingerprint the HTTP server, use -p 80
    – bonsaiviking
    Aug 15, 2018 at 16:40
  • @bonsaiviking I knew that nmap doesn't work as I said. I have done more research on nmap manual and found nothing could limit nmap just do version-detecion phase only, while I prefer to do zmap port-scanning first and combine the port-open hosts to do version-detection with nmap. So it doesn't need to do port-scanning again. Is there any solution or improvements on it?
    – Ryan Chou
    Aug 15, 2018 at 17:37
  • @bonsaiviking Could version-detecion (-sV) provide an advance options to specify amount of Probes? like --probes GetRequest,SSLSessionReq it send the probes only by --probes <probes>.
    – Ryan Chou
    Aug 15, 2018 at 17:39
-1

From nmap help:

-sV: Probe open ports to determine service/version info
--version-intensity : Set from 0 (light) to 9 (try all probes)
--version-light: Limit to most likely probes (intensity 2)
--version-all: Try every single probe (intensity 9)
--version-trace: Show detailed version scan activity (for debugging)

From my understanding, you don't have the option to select which probes you want to execute. If I'm right, then the only option would be compiling nmap.

If you download the code, there is a file called: nmap-service-probes, which contains a list of regexp which are used to identify the services. I don't know how nmap uses this file, but I guess that if you remove any other than the ones you want, it will only search for those probes.

As of disabling "pre-scanning", take a look to the --disable-FEATURE argument of configure (in case you go on the way of compiling nmap). Not sure if that is useful but it may take you in some direction.

My recommendation is to wait and see if someone knows a way to achieve it without compiling it. If not, you have this option.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .