2

I'm trying to find out if it is possible to select a range from within the --top-ports when scanning with nmap. I'm performing scans which are progressive in nature, for example, scanning the top 100, then 1000 then 3647 TCP ports. However as the 2nd and 3rd scans are performed they repeat the scan on the previous top ports which were selected, therefore increasing the overall time of the scan performing a redundant scan.

My question, is there a way to select a range from within the --top-ports list for example:

--top-ports 1-100
--top-ports 101-1000
--top-ports 1001-3647

Therefore stopping the ports from being scanned twice?

  • ... why not just the normal -p 1-100 etc.? – schroeder Sep 29 '17 at 15:16
  • potentially relevant: security.stackexchange.com/questions/78618/… – schroeder Sep 29 '17 at 15:17
  • because the -top-ports list provide a way of getting a very high chance of finding all ports which are open by scanning a significantly lower number of ports. for example if you scan the first 3647 tcp ports from the --top-ports list you approach 100% chance of having found all open ports, likewise if you scan the first 1017 udp ports from the --top-ports lists again you have approaching 100% chance of having found all open ports. See page 25 of the following paper from Nmap: Scanning the Internet by Fyodor nmap.org/presentations/BHDC08/bhdc08-slides-fyodor.pdf – Mark A Sep 29 '17 at 17:24
  • You could do this by manually copying the top ports list to a file and use the -iL switch to read from that file. Its somewhat manual the first time but if you do this often then worth it. – Joe Sep 29 '17 at 20:58
  • I'd thought about doing this but couldn't find an option which could be used to import port lists. I thought the -iL option was to import lists of hosts and networks, from the nmap help: -iL <inputfilename>: Input from list of hosts/networks What is the syntax to import the ports? I've looked at the file which contains the port definitions and they are listed by port number with the statistical value in one of the columns. So I'm guessing it calculates the order when it runs the scan so changes to the values in the likelihood column are taken into account when nmap is updated. – Mark A Sep 29 '17 at 22:03
2

I don't think this is necessarily the best approach to network scanning, but there is a way to do it by excluding certain ports from scanning (requires Nmap 7.00 or newer).

  1. Extract the list of the top 100 ports: nmap -oG - -v --top-ports 100 | awk -F'[);]' '/Ports/{print $2}' > top-100
  2. Extract list of the top 1000 ports: nmap -oG - -v --top-ports 1000 | awk -F'[);]' '/Ports/{print $2}' > top-1000
  3. Scan, using --exclude-ports when needed:

    nmap --top-ports 100 <targets>
    nmap --top-ports 1000 --exclude-ports $(cat top-100) <targets>
    nmap --top-ports 3647 --exclude-ports $(cat top-1000) <targets>
    

This is for TCP. For UDP, use $4 instead of $2 in the awk command, and add -sU to all Nmap commands.

  • oh, you and your set math approach – schroeder Sep 30 '17 at 20:55
  • Could you explain why don't think this is necessarily the best approach to port scanning? – Mark A Oct 2 '17 at 14:02
  • @MarkA I've seen (and used) similar methods in pentesting where you want actionable results quickly and full results later. But three result sets doesn't seem to fit that requirement. And 3000+ ports is unlikely to be stealthy in any way, so not sure what the reason is for doing it this way. I guess it's more of a gut feeling than a hard rule, sorry. – bonsaiviking Oct 2 '17 at 16:34
  • The port ranges I gave was just an example, they mapped to ~73%, ~93% and →100%. Was about efficiency and not repeating scans which had already been performed. Stealth could be a consideration but as you say a using fewer ports, large networks, time available, limited bandwidth etc. Using the top ports list for me is a logical choice as they provide statistically higher quality results for significantly less scanning. Selecting the hosts 2nd/3rd scans would use some additional analysis, i.e. scan might target hosts with no obvious role from 1st scan. – Mark A Oct 5 '17 at 9:44
1

No, there is not.

You can find out the top ports from /usr/share/nmap/nmap-services then use the -p switch to slice and dice as many chunks you see fit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.