Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [network-scanners]

Programs that map out a network to figure out which computers and services are available to be exploited.

Filter by
Sorted by
Tagged with
1 vote
1 answer
325 views

Local Scans initiated from a VLAN Broadcast IP address

Just reviewing some logs and I am seeing local scans to several local IP addresses on port 137 within my network. The source IP however is the broadcast IP of the VLAN (.255). I have checked the ...
5 votes
3 answers
21k views

nmap not scanning for host

nmap keeps showing different and wrong results whenever I perform a scan to see how many hosts are up on my subnet. See the following scan reports. The first scan I made was not with superuser ...
1 vote
1 answer
594 views

Getting reverse shell from firewalled target

Suppose this scenario: You are already inside a corporate network. Suppose to find out a RCE in a X service. The machine that hosts that service is behind a network-based firewall, ingress rules and ...
9 votes
2 answers
18k views

/hnap1/ scans router compromised or worm?

Recently, I saw some strange entries on my local-only webserver. The thing is I don't know if the attack came from outside the network or from an infected machine. I have read up a little on the hnap ...
1 vote
3 answers
599 views

Port scanning against assets that are behind a WAF

I am trying to automate my recon process. For port scanning, I resolve subdomains to IPs then loop over those IPs with masscan. But is it worth it to port scan an asset that is hidden behind a web ...
1 vote
1 answer
2k views

Spytechphone - iPhone [closed]

When port scanning my iPhone I get an RST, ACK from 'Spytechphone' over port 8192, does anyone know what this port does? I can't find any useful information. [1] http://www.iana.org/assignments/...
0 votes
1 answer
396 views

Using an active or passive scan, can I detect all devices connected to or transmitting via a Wifi network?

I know that it's possible to do a passive scan on all channels to see if an access point sends a beacon. However, is it also possible to listen to general Wifi traffic on that channel and assemble a ...
0 votes
0 answers
26 views

Router getting several port scans and DOS a minute from foreign IPs. Should I be worried? [duplicate]

What Happened: I was looking at the logs in my router and saw that suddenly I started getting warnings about "port scan attacks" and "DDOS attempts" every few seconds from my ...
1 vote
1 answer
1k views

Nessus Denial of Service checks

What's the difference between the "Denial of Service" plugin family and other plugins with "DoS" in the Plugin Name but located in different families? Can those other plugins also cause DoSs during ...
1 vote
1 answer
328 views

How can I port scan my p2p device?

I have a device and I am trying to port scan it. I did the basic nmap -A -p0- 192.168.0.x but I am just getting 0/tcp filtered unknown so I don't think it is working. The device works on p2p so I am ...
13 votes
4 answers
1k views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks: Is the presence of wireless access points tested for by using a wireless analyzer at ...
1 vote
1 answer
687 views

Intensive 586 (ms-shuttle) port scan/exploit/hacking attempts

Recently i wanted to play a bit with TCP/UDP networking (and touch some custom HTTP server impl) on C# and found out that i'm getting requests from totally unknown dudes, such as this one: FROM: [::...
0 votes
0 answers
241 views

How to perform focused scan of public IP using nmap? [duplicate]

Scanning my router using the private IP address using nmap reveals the open ports: Obtaining the public IP address of the router can be achieved by executing the command: nslookup myip.opendns.com ...
1 vote
1 answer
270 views

nmap: no exact OS matches when adding the exact signature to nmap-os-db

I'm currently trying to learn Nmap -O (OS guess feature). I'm launching the following command: nmap -O 172.17.0.3 This command is generating the following fingerprint as output: No exact OS ...
0 votes
0 answers
169 views

NMAP same destination ip, different scanner interface, different result

I am trying to check the port status of a external IP using NMAP, I am getting different result on different interface to same destination (destination is a public IP). When NMAP tried from the ...
0 votes
1 answer
485 views

A single IP address hosts multiple domain at the same time. How do I scan a single domain using nmap or other tools?

Let's say an IP address hosts multiple domains, (example.com, example.net, example.org, etc.). How do I port scan a specific domain?
6 votes
1 answer
11k views

Scanning private IPs from outside network

Is it possible with Nmap (or other tool) to scan a range of private IPs (let's say 10.0.0.0/8) but being outside any private network (using those IPs) ?
-2 votes
2 answers
2k views

How do Hackers and Security Researchers Scan The Internet For Vulnerable Servers and Devices? [closed]

I would like to know how Security Researchers and hackers scan the internet to find vulnerable devices. For example in this article here, what sort of request/packets are those researchers sending to ...
1 vote
1 answer
642 views

How to confirm what service is running on a port identified by nmap?

Probing with nmap returns BlackICE on a couple of ports however it seems to be a really old tool according to these manuals. Starting Nmap 7.80 ( https://nmap.org ) at 2022-10-16 20:27 EDT Nmap scan ...
1 vote
1 answer
317 views

Does my ISP sees that I am using someone else's PPPoE username/password?

I want to ask that does my ISP will be able to see that I am using username/password of someone else on my dialup PPPoE.
0 votes
2 answers
216 views

Do email security scans that follow links replace digest params in URLs with invalid values?

Going through our application logs recently I noticed a number of instances of page requests where an invalid SHA512 digest param in a URL resulted in a 403. A couple aspects of these requests make me ...
0 votes
1 answer
372 views

Is there a way to identify whether "filtered" state in nmap output caused by a network or host-based firewall?

Is there a way to identify whether "filtered" state for a specific port in nmap output is caused by a network firewall or host-based firewall?
2 votes
1 answer
778 views

How do I find subnets on the network in order to scan them for hosts?

I'm new to Security and I'm doing INE's Penetration Testing Student Learning path. In the current lab, (Find the Secret Server) we have this setup: The exercise focuses on adding an entry to the ...
7 votes
4 answers
47k views

Could Nmap scan switches/routers

Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.
3 votes
1 answer
3k views

How to "Scan for hosts" only using ettercap CLI?

I've been looking for a command to "Scan for hosts" in the terminal with ettercap CLI. How can I scan the local subnet from the ettercap terminal? The graphical ettercap has the options (see below):...
16 votes
5 answers
285k views

Unknown MAC address connected to router

I found an unknown MAC address connected to my home router. How would I figure out what OS the IP or MAC address is running?
11 votes
2 answers
21k views

Stop Nmap scan and preserve XML output

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
1 vote
0 answers
134 views

How to evaluate a responsive but unknown network protocol?

I am studying CREST CPSA where the syllabus is listed here. There is a part of the syllabus which states I should know the Evaluation of responsive but unknown network applications. I find this ...
22 votes
7 answers
36k views

Nmap reporting almost every port as open

I have noticed during some assesments when doing a TCP port scan, Nmap will report almost every port as open for a machine. Using for example nmap -sS -PN -T4 target -p0-65535, over 20,000 ports will ...
13 votes
5 answers
36k views

Is there a nmap command to get the top # most common ports?

I understand nmap by default scans the top 1k 'most common' ports (-F reduces to 100) I understand it gets these 'most common' ports based on the nmap-services file, specifically the frequency (3rd ...
3 votes
3 answers
14k views

nmap detects opened port but can't connect with telnet

I've made an scan to one single IP with nmap and it reports that the port 65301 is opened, and even it detects that it's maybe the service pcanywhere. sudo nmap -p 65000-65535 -sV x.x.x.x Starting ...
1 vote
1 answer
1k views

What are the drawbacks of a stealthy port scan?

I read that port scanning services like nmap will conduct a "TCP Connect Scan". They'll attempt to make a TCP connection to each of the ports within the range provided. But because each of ...
4 votes
1 answer
1k views

What is the need for firewall to be in "stealth mode"?

There is a firewall deployment case called "transparent mode", when the firewall does its job without routing and having IPv4 addresses, i.e. it is invisible. "Stealth mode" is ...
2 votes
1 answer
2k views

Is ettercap detectable?

Is Ettercap detectable? It technically shouldn't be because it just reads the data it sees legally through network. Every other computer receives the exact same data, it just doesn't show the data to ...
0 votes
0 answers
135 views

How to find out what payloads are being uploaded when I am running a scan of remote website?

I have been running an Acunetix vulnerability scan of a remote website (containing 50 subdomains). I am not doing anything else on this system. However, my system is connected to a remote VPS via VPN, ...
1 vote
1 answer
388 views

Incorrect results via Nexpose, but displaying correct one with Nmap

We are scanning our network via Nexpose. Recently an asset was found vulnerable to Wannacry CVE 2017-0146 SMB Remote code execution vulnerability. However when i have tested it same through Nmap it ...
0 votes
0 answers
281 views

Router scanning ports on all connected devices

From time to time, my router starts to scan ports on all the connected devices. I have an internal RPi server which I restricted its access to the internet from the router. I checked the "/var/...
2 votes
4 answers
7k views

Number of bytes in a TLS handshake

How can I identify precisely the exact number of bytes the ClientHello and ServerHello in a TLS traffic needs? this is for traffic analysis purpose to capture the TLS bytes of interest (client hello ...
1 vote
2 answers
2k views

NMAP reporting all ports open

I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between. I tried the SYN scan, and when I check the traffic in WireShark I see ...
19 votes
1 answer
26k views

Nmap - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why Nmap decides to tell ...
1 vote
2 answers
140 views

Using Chrome on non-trusted macOS computer

So I'm using an untrusted computer but on a trusted network (my home). The operating-system + hardware are trusted but the Profiles, certificates & software installed in the system are not trusted....
5 votes
2 answers
5k views

Why can I ping a server, but nmap normal scan cannot see the host?

I am able to ping a server on an vpn. However, when I use a normal nmap scan it does not pickup on the host. Doing a scan with host discovery turned off (nmap -Pn host scan) does show the host. If I ...
4 votes
5 answers
12k views

Determining false positives when scanning for live hosts with Nmap

When doing a vulnerability assessment on a large network, it seems general practice to determine which hosts on the network are live. This can be done in various ways. From what I have read it is ...
0 votes
1 answer
1k views

How to check if my ports are exposed to the internet

[Crossposting from SO] I am trying to make a port scanner in Python and trying to list which all ports are accessible by anyone remotely. Using the socket.connect_ex package, I was able to check which ...
1 vote
1 answer
760 views

How do I find the IP address of a specific device on the local network? [closed]

I would like to learn how to find the private IP address of anyone connected to a network. This specific network has a firewall. The only info I have on it is that it blocks ICMP requests (I'm pretty ...
4 votes
2 answers
47k views

How to find list of IP address in a network with multiple subnets?

There are many subnets connected via a router in the same network. I need to find list of all IP address available in each different subnet. I am able to get the list of IP address available in the ...
6 votes
1 answer
4k views

Physical machines not detected when scanning from a VM

Some time back I asked about using metasploit on a virtual machine here. This question is a kind of 'part 2' of it. My testbed set up consists of 3 physical machines: A, B and C. Each of them have 1 ...
0 votes
1 answer
375 views

Can changing your IP address prevent an NMap attack?

If an nmap attacker started a port scan on my network, would changing my network IP address prevent/halt it?
0 votes
1 answer
120 views

Is using a server as bridge secure enough to protect the end data?

It comes to my mind a security problem that I would have accessing some data. My current problem is the following: There is a server in AWS London where you can access some data, by law, that data ...
4 votes
1 answer
2k views

Why do I need root privileges to send a raw packet from a UNIX machine?

I was recently reading through the nmap port scanning documentation and it points out that to perform a SYN scan (-sS) you require root privileges because an unprivileged user cannot send raw packets. ...

1
2 3 4 5
8