3

If nmap shows all ports are filtered or closed, what would be the next logical step to take?

Does that mean I would need to get physical access to the device? or is there any other ways to get information?

I'm trying to scan my own smartphone and all the ports are closed, and I did the same with my laptop and all the ports were filtered, so, I'm kind of stuck.

On the other hand, all the information I found on the Internet is relying on getting more results with different nmap scans.

Is there any other software, technique or anything to do that's not involving nmap?

6
  • What is the commands that you ran ? It's possible that you missed something or that the devices simply had not open ports exposed.
    – Kate
    Sep 12, 2020 at 16:12
  • sudo nmap -sV -sC target_Ip, then also I tried the same with other ports ranges and with udp mode scan, other nmap commands and still get nothing, just closed and filtered ports, the thing is, if it weren't my own phone or laptop, what can I do to gather more information about the target?
    – Jhony cash
    Sep 12, 2020 at 16:57
  • Do you realize that by default nmap only scans the 1000 most "popular" ports out of 65536 ? This scan cannot be considered exhaustive. Review the manual and command line options. I would try first without running any scripts (the -sC option), or that will take a long time. Basic reconnaissance first, in-depth analysis later.
    – Kate
    Sep 12, 2020 at 17:08
  • Yeah I know about 1000 default ports, and I tried do others ranges, and It didn't work, and I also tried udp scans but nothing
    – Jhony cash
    Sep 12, 2020 at 17:29
  • What information do you want to get? What information are you looking for? What do you want to be able to do with the information?
    – schroeder
    Sep 13, 2020 at 11:18

4 Answers 4

6

Checking for open ports using nmap only does a comparably dumb check if services are directly accessible on the device. In the default setup it will only check a few ports and thus will not find any services running on unusual ports.

But even when checking all ports it will not find services restricted to specific source IP addresses or protected by port-knocking or otherwise magic packets or packet sequences. Access to these services does not require physical access to the machine, but it requires specific knowledge about the kind of protection used and also possible secrets involved - none of this is involved by just a dumb nmap.

And even if no services are accessible on the machine it does not mean that physical access is needed. There might be outgoing connections from the machine where the response from some external server gets processed on the machine. This is done when reading mail on the machine or browsing the web but also when checking for updates or other automatic actions. Injecting an unexpected response might allow an attacker to attack the system from inside. But again, this requires no physical access but knowledge of what the system is actually doing and lots of knowledge about potential vulnerabilities in the installed software, OS, social engineering to make the user install some software etc.

And there is more which does not involve physical access: there might for example be vulnerabilities in the Bluetooth or Wifi stack which can be used to attack the machine.

... what would be the next logical step to take?

Gain more knowledge about the system you are trying to attack, the installed software and its weaknesses, weaknesses of the end user etc. In a way it is like when you are trying to steal something: checking for open doors (nmap) is only a very simple step and very likely the doors are closed. But there might be weak locks, windows, gullible residents which open the door for you etc.

2
  • But that's the point, how can I get more information about the system if its almost unreachable?, which are the teqniques to do this? wireshark maybe?
    – Jhony cash
    Sep 12, 2020 at 14:12
  • 1
    @Jhonycash: There is no "gain information" for an arbitrary attack target. Wireshark is valuable to watch outgoing connections and maybe see incoming connections too (i.e. watch port knocking, magic packets, access from specific source IP) so it is surely a valuable tool to gain information - but not the only one. Reading documentation, reading about possible vulnerabilities with this kind of device, gaining information about the end user etc are also useful. It is more a wide exploration and not just a simple run of some tools. Sep 12, 2020 at 14:19
2

Not all devices are going to have ports open unless they are running some kind of services. Running exposed services is not really typical for most personal devices.

When targeting a system, you need to consider all inputs into said system. Open ports/services are just one such input into a system. Therefore, you would need to move on to something else besides remote attacks; perhaps the device calls out and the communications there can be intercepted or exploited, or maybe it is running a vulnerable Bluetooth stack. These are just examples, but the point is that it's not all about listening ports.

2
  • he said he tried scanning his smartphone, i assume at least port 80 not to be closed, ey?
    – clockw0rk
    Sep 15, 2020 at 12:42
  • @clockw0rk it would be very odd to see port 80 listening on a phone. Sep 15, 2020 at 20:33
1

It is possible that the device is simply not exposing any open ports. Thus you are not finding anything, but... port scanning is an art. Nmap has many options and there are pitfalls too.

If you are stuck at this stage, you could try something else to gain a better understanding about the inner workings of your device. Assuming it's connected to your home wifi network, you could try to sniff the traffic flowing in and out. Look at the types of traffic (eg HTTP, DNS etc) and the destination ports. Then you can start making educated guesses about what kind of software is running on the device eg an embedded webserver or something else.

For example I have a managed switch and I have configured port mirroring so that all traffic flowing through a specific port is "copied" to another switch port, and from there I use a separate network card and Wireshark to analyze the traffic.

My suggestion would be to build a small lab, perhaps invest in some equipment like a managed switch that will make the job easier. You can also build your own. For example if you have a spare Raspberry PI you can build a wifi hotspot with hostapd and then you can sniff all that you want.

Learning how to use Wireshark will be a requirement. Shouldn't be too difficult. One of the first things to know is how to set up capture filters or display filters, so as to filter the traffic to a single known MAC address, and eliminate the "background noise".

Another suggestion: since you have physical access to the device you could enable debugging mode from USB, on an Android device you would use ADB. Root the device perhaps. Once you have console access you should be able to see what's going inside the device.

0
0

Depends on the type of scan.

A "classic" scan might yield 0 results,

but you can always try f.e. a x-mas scan or null-scan to force errors in the program handling the port.

2
  • no man, didn't work, same results. all ports are closed
    – Jhony cash
    Sep 13, 2020 at 10:28
  • The typical purpose for those types of scans is for firewall evasion. Sep 15, 2020 at 20:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .