1

I train on vulnerable boxes and during my recon phase, I use nmap to collect info on open ports.

I use the command nmap -sS [IP|URL] and no matter the machine, I get the result that port 554 - RTSP open.

But my mate used the same command and didn't get the same report (his results seems more accurate). Whether it's a Tryhackme machine or a Root-me one, I still get the result that port 554 is open.

I can't understand the scan. How can a basic training box have a RTSP port open?

enter image description here

enter image description here

Improve this question
1
  • 1
    As a side note, a CTF box has all kinds of ports open and lots of non-standard configurations. What is noteworthy is that that port is open for you and not others. That indicates the possibility of your environment affecting the scan.
    – schroeder ♦
    Mar 11, 2022 at 9:33

1 Answer 1

Reset to default
1

I suspect the scan is picking up an open port on your router. Try using the --reason and --traceroute options to see what reason the port is showing open, and where in the route it's detecting it.

Try isolating the scan to a single port, comparing a know remote service port and the "phantom" one.

You can see a detailed explanation for this issue and troubleshooting method here https://hackerific.net/2016/03/20/false-positive-tcp-ports/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .