I started to read a metasploit guide book so I set up 2 Machines in VirtualBox for pen testing (host - BT 5, the second - WinXP SP2). When Im trying to scan open ports with NMAP on the Windows machine, it appears that all ports are closed, even if I turn off the Firewall. Ive tried to open SMB port through network connection center but it also didn`t help. Why all the ports are closed and how can I open some of them (at least the most common - SMB, HTTP etc) ?

Edit: Both of the machines working on NAT (10.0.0.x) and accept ping from each other. I tried: nmap -sS -A WinIP (also tried -sN/-sT) In each scan the result was the same - all ports are closed.

Thanks in advance !

  • I think the output of nmap could be useful. Mar 2, 2013 at 15:17

5 Answers 5


Have you checked for any type of additional security or filtering tools which may be intercepting your connection requests? Firewall, proxies, and some Anti-malware suits may intercept your activity and block it since such tools will assume normal users do not run port scans. Try to run wireshark or another packet/frame capture tool on the BackTrack VM or on another virtualbox machine on the network, and see what's going on in the traffic, you may see responses being blocked, reset, etc.


The ports you mentioned are open for specific services and servers that run on the host. If you didn't setup any servers or services on your Windows XP SP2, then there is no reason for those ports to be open on your machine, also, there is of course no reason for NMap to return a scan results claiming they are open...

If you insist on using the VM you already configured I suggest you instal IIS from the "Turn Windows features on or off" menu in the "Add/Remove Programs" page in XPs Control Panel; or share some folder/device on the XP machine.

Another possibility instead of using a clean installation of Windows XP, is to try downloading and installing on a VM, an exploitable operating systems, preconfigured with various services and servers for practicing. E.g. Metasploitable, ICE and so on. (Check here for a more comprehensive list of vulnerable applications and OS*)

*Disclosure, the site I'm referring to managed by me.

  • vulnapps.com requires password to access, and there is no place to register. how can I get the list? Sep 25, 2015 at 14:58

The NMAP scan fails because even though the firewall is disabled, when the packet gets to the OS it has nothing to do with it, so it just drops it.

When you install a service on your computer it listens for certain packets on a particular port. If you were going to browse the internet on a machine, its not going to open port 80 (because web server run on port 80) but rather a port between 1023-65535.

If you were to install a webserver on your windows xp machine, it will listen for packets on port 80. NMAP should find the open port 80.


Did you try pinging from the Windows machine to the BT machine? Are the two NICs working in bridge mode? As a test, try to run a scan on the Windows machine as localhost and run "nmap -sV -vv". Try to use wireshark and see what it gets. If the Windows machine is generating any traffic It would be captured. By the way why use NAT just bridge it?

Try browse internet then scan window machine


NMAP scans on WIN machines must have (-sT -Pn)... nmap -sT -Pn 10.0.0.x

"You cannot generally scan your own machine from itself (using a loopback IP such as or any of its registered IP addresses). This is a Windows limitation that we haven't yet worked around. If you really want to do this, use a TCP connect scan without pinging (-sT -Pn) as that uses the high level socket API rather than sending raw packets."... see NMAP Site for more detials


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .