I had a debate recently regarding whether conducting an Nmap scan through a 3rd party such as pentest-tools.net is considered active or passive. I argued that it is passive since there is no link between the scan and myself.

On the other hand, my friend argued that Shodan and Censys are considered passive which to me is the same as an external Nmap scan.

Is an external Nmap scan active or passive?

  • 1
    How are you defining "active" and "passive"? Is reading data from a MitM passive (you're not sending anything to the target) or active (you're actively monitoring the connection)?
    – Matthew
    Nov 27, 2017 at 16:19
  • I would consider a MitM to be active since you would have to carry out an arp spoof or similar to redirect the traffic to yourself. In this case it can be linked to you directly
    – user92592
    Nov 27, 2017 at 16:25
  • IMO, it's active, even if the target can't trace it back to you, they can (hopefully) see that they are being scanned. Plus you could argue in some scenario that pentest-tools.net may reveal your account information etc etc.
    – Arlix
    Nov 27, 2017 at 17:05
  • 10
    active != "can be traced to you", active is about committing an act that directly affects or interacts with the target. Shodan is also active, but you get the results after a time delay.
    – schroeder
    Nov 27, 2017 at 17:22

2 Answers 2


I tend to take a legal eye when I look that this (IANAL).

An NMAP scan of a target will always be active regardless of who performs the scan. Just because you shift the scanning responsibility to a third party doesn't change that fact.

You might be able to argue that you retrieved the scan data passively, but I would argue otherwise based on the post. From a legal stand point, it doesn't matter if you proxy the attack, if the attack as illegal it would just add another defendant. Would you consider C&C agents for something like a DDOS attack as passive? I sure as hell wouldn't.

It would however be different if you came across scan data on a third party site. You would have to prove that you didn't initiate the attack. From a legal perspective, you simply possessing scan data that was widely available (arguable), damning or not, would be different.


The first question to ask is, "Why does it matter?" What is the reason for needing to label something "active" or "passive"? If the answer is that your Rules of Engagement place some restriction on "active" measures, then you need to improve your rules of engagement to reduce ambiguity about that term.

The action of an Nmap scan is "active" in that it is causing observable effects to the target while it is going on. Shodan and Censys searches can be considered "passive" because they are showing you results of a scan that took place some time in the past; the scan itself was "active," but retrieving the results is "passive." From a legal standpoint, launching a scan via a 3rd party can still be linked back to you, because that 3rd party likely has logs of which addresses/browsers requested which scans.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .