1

Me and my friend have access to a private enviroment, and we use Nmap to scan one domain and a www.

I get the following result:

======================================================================
                          INCORRECT SCANNING
======================================================================

nmap -sS -v www.site.com.br

Starting Nmap 7.31 ( https://nmap.org ) at 2017-01-02 13:45 EST
Initiating Ping Scan at 13:45
Scanning www.site.com.br (173.x.x.20) [4 ports]
Completed Ping Scan at 13:45, 0.20s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 13:45
Completed Parallel DNS resolution of 1 host. at 13:45, 0.45s elapsed
Initiating SYN Stealth Scan at 13:45
Scanning www.site.com.br (173.x.x.20) [1000 ports]
Discovered open port 22/tcp on 173.x.x.20
Discovered open port 53/tcp on 173.x.x.20
Discovered open port 21/tcp on 173.x.x.20
Discovered open port 554/tcp on 173.x.x.20
Discovered open port 111/tcp on 173.x.x.20
Discovered open port 80/tcp on 173.x.x.20
Discovered open port 7070/tcp on 173.x.x.20
Completed SYN Stealth Scan at 13:45, 6.73s elapsed (1000 total ports)
Nmap scan report for www.site.com.br (173.x.x.20)
Host is up (0.17s latency).
rDNS record for 173.x.x.20: 14.5d.2d.static.xlhost.com
Not shown: 990 closed ports
PORT     STATE    SERVICE
19/tcp   filtered chargen
21/tcp   open     ftp
22/tcp   open     ssh
25/tcp   filtered smtp
53/tcp   open     domain
80/tcp   open     http
111/tcp  open     rpcbind
554/tcp  open     rtsp
5555/tcp filtered freeciv
7070/tcp open     realserver

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 7.72 seconds
Raw packets sent: 1034 (45.472KB) | Rcvd: 1022 (40.896KB)

But my friend gets this:

======================================================================
                          CORRECT SCANNING
======================================================================

nmap -sS -v www.site.com.br

Starting Nmap 7.31 ( https://nmap.org ) at 2017-01-02 15:26 BRT
Initiating Ping Scan at 15:26
Scanning www.site.com.br (173.x.x.20) [4 ports]
Completed Ping Scan at 15:26, 0.21s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 15:26
Completed Parallel DNS resolution of 1 host. at 15:26, 0.01s elapsed
Initiating SYN Stealth Scan at 15:26
Scanning www.site.com.br (173.x.x.20) [1000 ports]
Discovered open port 80/tcp on 173.x.x.20
Discovered open port 111/tcp on 173.x.x.20
Discovered open port 22/tcp on 173.x.x.20
Discovered open port 21/tcp on 173.x.x.20
Discovered open port 53/tcp on 173.x.x.20
Completed SYN Stealth Scan at 15:26, 6.58s elapsed (1000 total ports)
Nmap scan report for www.site.com.br (173.x.x.20)
Host is up (0.17s latency).
rDNS record for 173.x.x.20: 14.x.x.x.x.com
Not shown: 991 closed ports
PORT     STATE    SERVICE
21/tcp   open     ftp
22/tcp   open     ssh
25/tcp   filtered smtp
53/tcp   open     domain
80/tcp   open     http
111/tcp  open     rpcbind
139/tcp  filtered netbios-ssn
445/tcp  filtered microsoft-ds
2301/tcp filtered compaqdiag

My results do not make sense, and his is correct. Why do we get different results, and how can I fix it?

  • 2
    You might be hitting different servers behind a load balancer - would explain the different ports open. – Matthew Jan 3 '17 at 19:16
  • You are not scanning from the same country, or at the same time. That's a lot of difference to account for. – schroeder Jan 3 '17 at 21:42
2

Let's focus just in the relevant data: port 554 and 7070 open in your scan.

There is 1h and 19 minutes (13:45 EST = 16:45 BRT) of difference between the scans, so maybe when you scanned the target, it had a RealServer running (ports 554 and 7070), and when your friend scanned it, it didn't have the RealServer running.

  • Hi, thanks for answer me. So, I don't think that only this can't be the problem, I do not has knowledge the enviroment infra and now me and 2 friends are trying and the second sent me a different open and filtered port scanning. I'm trying to understand because this scanning is the key to solve the Lab question that we are doing, so if something in my scanning was wrong I could fix it but its not that appear – MHenrique12 Jan 4 '17 at 14:50
  • @MHenrique12 I just scanned and got the same result like your friend and like Mirsad. You masked your friend's output but yours has the full rDNS, so we can look up the IP. Are you sure that always that you try to scan, you're getting the RealServer ports open? Because that doesn't make sense. if they were filtered, then maybe some country firewall might be in place as others said, but reporting open that means that really there is a service listening there, and I can confirm you there is not such service. Try both of you nmap -sS -p 554,7070 173.45.93.20 and compare results – yzT Jan 4 '17 at 17:36
  • My intention was not to mask more protect the site, as I did not know if it was allowed to post IPS I hid. But then I saw that one was missing one when the colleague posted the scan, I will do a scan now and I will post the result for comparison purposes – MHenrique12 Jan 4 '17 at 18:38
  • As you can see bellow, I did 2 scans, first with last config (sorry about 7.25BETA version) was necessary format my host and do not has oportunity to make backup. So, my friend's scan is the same configuration, then you can compare using the same Ip and configurations about web page. Now about firewalls, what you can suggest me? Because like I sayed my host use a kaspersky, and my windows firewall was disabled. – MHenrique12 Jan 4 '17 at 19:06
  • like @Ay0 suggest nmap -sS -p 554,7070 173.45.93.20 Starting Nmap 7.25BETA2 ( nmap.org ) at 2017-01-04 13:49 EST Nmap scan report for 14.5d.2d.static.xlhost.com (173.45.93.20) Host is up (0.13s latency). PORT STATE SERVICE 554/tcp open rtsp 7070/tcp open realserver Nmap done: 1 IP address (1 host up) scanned in 0.36 seconds – MHenrique12 Jan 4 '17 at 22:33
2

Probably country-based firewall rules. I've checked this rDNS record for 173.x.x.20: 14.5d.2d.static.xlhost.com, and from my country they have open only these ports:

21/tcp  open     ftp
22/tcp  open     ssh
53/tcp  open     domain
80/tcp  open     http
111/tcp open     rpcbind
  • Hey, so as I comment my kali works at vmware virtualization and my host have AV, at first moment I think that could be the problem then freeze him and did the same scanning, but the results not change. I tryed to make a clean Kali install, update and upgrade all, but the scann continue same thing. – MHenrique12 Jan 4 '17 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.