Questions tagged [nmap]
A robust and open source security tool for network discovery and security auditing.
1
vote
1answer
80 views
nmap privilege escalation - is still a risk?
There is a known and popular technique to leverage nmap for privilege escalation if the suid bit is set for nmap.
One can execute nmap in interactive mode and from there execute bash commands in the ...
-1
votes
0answers
37 views
Nmap scanner after a credential scan or before credential scan?
i'm developing a vulnerability management process, one phase of it is to validate scanner tools data. at the moment I'm doing automated discovery scan using Nessus (hosted in a server not accessible ...
3
votes
1answer
332 views
Ports Showing Closed/Filtered in Nmap Scans
hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other ...
0
votes
1answer
46 views
Scanning multiple hosts with Nmap's Default Accounts NSE script not producing the expected result
I'm utilizing Nmap's default account credential scanner. I've built a couple of my own fingerprints and I've tested that the fingerprints work when scanning one host at a time.
Example command line ...
0
votes
2answers
43 views
How can I check what scripts are in Nmap's default category (`--script=default`)?
I know that the -sC and -A options run the "default" category of scripts (--script=default):
https://nmap.org/book/nse-usage.html
I've searched the nmap script folder for a default sub-folder, but ...
0
votes
2answers
79 views
Open ports on my NetGear router
I ran an nmap scan on my home router and I am seeing a ton of open ports. Is this normal? How do I go about closing them?
$ nmap 192.168.1.1
Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-16 20:...
-1
votes
1answer
75 views
how to check if remote host is running LDAP server?
I am currently pen-testing a remote website (its mine)
I would like to know if its possible to test if the web-server is running LDAP server.
I tried Nmap with no luck(it lists every port from 1 to ...
0
votes
1answer
92 views
<hostscript> tag missing in nse output for http-drupal-enum script [closed]
I use the ruby NMAP::XML class to pick apart the nse output from large scans but it expects the script output to be embedded in hostscript tags.
I have just started using http-drupal-enum script (in ...
1
vote
0answers
25 views
Nmap showing different open ports every few seconds [duplicate]
I'm running Nmap on an Amazon Web Services EC2 instance but between runs just a couple seconds apart, I'm getting new results. Is this normal? I'm seeing open ports then they don't show.
I'm running ...
0
votes
0answers
23 views
Is there any Nmap command/script to identify certificate name mismatch and untrusted certificate?
I am using Nmap commands in my script for server validation. I know in Nmap there is the ssl-cert.nse script that retrieves details about the server certificate. I want one more step where I find ...
1
vote
0answers
42 views
nmap - No Ports Open [closed]
I bought a Tonbux Smart WiFi Plug WL-SC01 and I'm doing some hack tests on it for educational purposes. I used nmap to check for both UDP and TCP ports but both return that there are no open ports at ...
3
votes
1answer
145 views
NMAP results inconsistent
I'm doing a NMAP scan that runs continuously. For some reason the results are not consistent. Sometimes it detects all the connected devices of the local network and sometimes only some of them.
...
1
vote
1answer
53 views
Nmap / Qualys say 3DES is available, but OpenSSL fails to connect
Running a Qualys scan showed that the IP was vulnerable to a Sweet32 attack, here is the output:
TLSv1 WITH 64-BIT CBC CIPHERS IS SUPPORTED
DES-CBC3-SHA RSA RSA SHA1 3DES(168)...
0
votes
0answers
24 views
Finding how many filtered ports of a host that would be listed as “filtered” on Nmap
I just started working on nmap and was confused by this question. I'm unsure if I understood it correctly, so I appreciate your help with this.
Using Nmap, find how many ports are filtered in testphp....
2
votes
2answers
140 views
nmap - Difference between “Filtered” and “Admin-Prohibited”
I am a rather new user to nmap. By using some Google-Fu, I am still not able to ascertain what is the criteria used in order to distinguish "filtered" ports from "admin-prohibited" as they both seem ...
1
vote
2answers
143 views
Is there a way to see if an nMap scan in the background is progressing?
I have launched an nMap scan from an Ubuntu machine with the following parameters:
nmap -Pn -T3 -sS -sV -iL /home/tsouser/Desktop/Scope.txt --reason --top-ports 100 --max_rtt_timeout 200ms --...
0
votes
0answers
85 views
Why nmap password scanner completes in 10 seconds and doesn't give any result?
I'm completely new to nmap and I'm trying to brute force passwords on a target. A command that I'm trying is:
nmap -p 80 --unprivileged --script http-form-brute <target>
But instead of "...
1
vote
2answers
102 views
Should ports be visible to nmap?
I'm currently working on the firewall when I discovered that the firewall exposes a lot of ports outside of the internal network. I discovered this when setting up a new FTP server using a basic nmap ...
0
votes
0answers
117 views
Telnet output with nmap
I made a scan on a server with nmap with these options : nmap -sT -A -P0 and this is the output for the telnet port (23) :
PORT STATE SERVICE VERSION
23/tcp open telnet
| fingerprint-strings: ...
1
vote
2answers
91 views
Nmap simultaneous scanning
Quick Nmap question. If there are X amount of ports per machine to scan and I want to scan 2 machines at once (no more no less), is there any way of forcing nmap to always be scanning 2 different ...
0
votes
2answers
274 views
Do I have to block UDP ports when I launch my own server with a public IP?
I am trying to give better security to my Raspberry sever. When I installed UFW, I allowed just port 80/tcp and my own high port for SSH communication, and by default are all others ports "deny".
...
2
votes
2answers
73 views
What exactly does a default port scan look like? I am trying to run a default port scan without setting off the ids on my test network
What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.
0
votes
1answer
93 views
NMAP NSE script stopping after 900 seconds (15 minutes)
I am experimenting with ssh bruteforce over my home network using the ssh-brute nse script. I have a short list of usernames (just 12) but a long list of passwords (1M).
I can't seem to get the ssh-...
2
votes
2answers
335 views
Nmap not following redirect when using “http-title” script
I am trying to scan a bunch of IPs for their http-title.
Now the problem I have is that nmap pretty much never follows any redirects.
Usually the title I want is behind that redirect though.
For ...
3
votes
0answers
165 views
How can Nmap bypass Windows Server firewall rules?
I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
1
vote
1answer
222 views
NMAP reporting all ports open
I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between.
I tried the SYN scan, and when I check the traffic in WireShark I see ...
0
votes
3answers
173 views
Nmap scanning single port too fast? Shows as filtered?
I ran into an issue when trying to scan a single port on a single machine. I ran a range scan to find machines with port 25 open. Then I just arbitrarily chose one to work on. I scan that machine with ...
-1
votes
1answer
388 views
NMAP - Terminate/stop scan on finding open port
Is there any command on nmap or on some other tool which will stop scan and move on to a different IP on finding a single open port?
Need to perform this for host discovery on few assets which has ...
2
votes
1answer
197 views
Nmap --script-args usage?
I'm trying to use multiple Nmap --script-args at the same time.
$ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com
...
1
vote
2answers
167 views
How to find and ban some devices from my wifi using the command line? [closed]
I use Arch Linux. I just installed some packages such as nmap, netdiscover and others. It is a ubiquiti internet network, for the sharing of connection to several routers. There are about 7 routers ...
-1
votes
1answer
123 views
What is the Difference between TCP Syn discovery and TCP ACK discovery in NMAP?
when im using nmap for network discovery , i dont understand theses options
PS
PA
PU
n
when i use -PS or PA or PU ? and what is the difference between them ?
@ref:
https://nmap.org/book/man-host-...
-4
votes
1answer
160 views
VPN vs real IP address
Is it more secure to use a VPN that has open ports?
22/tcp open ssh
53/tcp open domain
80/tcp open http
110/tcp open pop3
443/tcp open https
500/tcp open isakmp
1723/tcp open pptp
4567/tcp ...
-1
votes
2answers
534 views
How to handle the virus on my router?
I believe my router is infected with a virus. If it is, it has been infected for a large period of time (perhaps a year or more). Though, I only started to consider it being a virus around a week ago.
...
2
votes
1answer
75 views
What port state to expect from Nmap when scanning ports that are open only to specific IP addresses
My firewall has a few ports open but traffic is only forwarded when coming from specific IP addresses (whitelisted).
When scanning these ports with nmap from a non whitelisted IP address, what state ...
0
votes
1answer
908 views
List of all available nmap script arguments
I need to do a scan, for example with http-sql-injection.nse
nmap script.
I already know that I should use --script-args to set arguments, but my question is not about it.
How can I look on the ...
0
votes
2answers
240 views
explain NMAP results
When I ran nmap -sn x.x.x.x/24 on a network behind Cisco ASA firewall I get 255 hosts up even though there are only three hosts on that subnet.
If I run nmap -T4 -F x.x.x.x/24 I get all 254 IP ...
2
votes
1answer
195 views
Use Splunk to run Nmap scan from remote host to potential attacker
When receiving internal attacks, I'd like to utilize Splunk alerts to trigger an Nmap scan against that attacking host from a remote machine; one other than the Splunk server.
Is there any API or ...
0
votes
2answers
115 views
Inconsistent list of hosts found by nmap pings from scan to scan - tcpdump shows ICMP echo replies did arrive
I'm running nmap periodically to monitor which hosts are in our server subnet:
rm list; for i in $(seq 1 254) ; do echo 10.10.10.$i >> list ; done
sudo nmap -oG - -PE -sn -iL list
Most of the ...
1
vote
2answers
125 views
nmap -sn through proxychains fails
Why I can not do the following with nmap?
proxychains nmap -A -v 10.185.11.0/24
Output:
ProxyChains-3.1 (http://proxychains.sf.net)
Starting Nmap 7.60 ( https://nmap.org ) at 2018-08-07 10:12 EEST
...
3
votes
0answers
4k views
What is RTTVAR in NMap? [closed]
I find a lot of sources explaining how to get rid of the following message:
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
But
What exactly is RTTVAR(Round Trip Time Variance)?
What is ...
0
votes
2answers
97 views
Verify whether the IP address is SQL Server
Is a network scan the only way to know if an IP address is a SQL server? How can I verify this 100%?
9
votes
3answers
542 views
What are some instant red flags when scanning an network with nmap
When doing an Nmap scan from an external network, what open ports should be an instant red flag?
For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
0
votes
1answer
1k views
What -sn -Pn does in Nmap?
-sn: It tells the nmap not to do any Port Scan.
-Pn: It tells the nmap not to do any Ping Scan.
Now when I use both together like this, nmap -sn -Pn host.com.
What I saw in the terminal is Nmap ...
0
votes
2answers
72 views
Internal IP's Probing to Unknown External IP's
I recently took a CEH class and they mentioned checking for internal IP's probing to External unknown IP's to determine an attack. What would be the best way to gather and analyze these types of ...
1
vote
1answer
159 views
nmap not showing closed ports
When I running the command
nmap -p 443 -iL ip.txt
It only shows IP addresses with open ports in the output, but does not show IP addresses with closed ports. How can I see the closed ports/IPs.
2
votes
3answers
1k views
NMAP to scan ip and ports from file
I want to scan IP and port from a file as below:
192.168.1.2 443
192.168.2.100 8443
192.168.3.99 80
192.168.4.11 443
How can I do that? I know there is option to take IP from a file using -iL but ...
1
vote
1answer
42 views
is -nU an option with nmap?
My coworkers seem to have -nU (no udp) as an option for their nmap scripts but I've never seen this in use and when I try to use this option with nmap, it does not work. I thought no udp was enabled ...
0
votes
2answers
1k views
No output from nmap script
I'm trying to use the nmap script ssl-dh-params to identify what specific 1024-bit Diffie-Hellman group a TLS server is using. However, the script is not giving me any output at all and I can't ...
3
votes
2answers
140 views
Nmap and it default scripts when I already know some of the information
I am a network guy and not a “hacker” or whatever the official term is these days.
I’ve been learning how to use nmap as I think it’s a great tool for just keeping the network secure.
The thing is ...
1
vote
1answer
240 views
Nmap HeartBleed script does not seem to work over non-standard ports
The Nmap script for HeartBleed (using Nmap v7.40) seems to work only over known ports. Whenever a non-standard port is used, the script does not report anything.
nmap -p 46000 --script ssl-heartbleed ...
