Questions tagged [nmap]
A robust and open source security tool for network discovery and security auditing.
1
vote
2answers
68 views
Should ports be visible to nmap?
I'm currently working on the firewall when I discovered that the firewall exposes a lot of ports outside of the internal network. I discovered this when setting up a new FTP server using a basic nmap ...
0
votes
0answers
33 views
Telnet output with nmap
I made a scan on a server with nmap with these options : nmap -sT -A -P0 and this is the output for the telnet port (23) :
PORT STATE SERVICE VERSION
23/tcp open telnet
| fingerprint-strings: ...
1
vote
2answers
79 views
Nmap simultaneous scanning
Quick Nmap question. If there are X amount of ports per machine to scan and I want to scan 2 machines at once (no more no less), is there any way of forcing nmap to always be scanning 2 different ...
0
votes
2answers
107 views
Do I have to block UDP ports when I launch my own server with a public IP?
I am trying to give better security to my Raspberry sever. When I installed UFW, I allowed just port 80/tcp and my own high port for SSH communication, and by default are all others ports "deny".
...
2
votes
2answers
56 views
What exactly does a default port scan look like? I am trying to run a default port scan without setting off the ids on my test network
What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.
0
votes
1answer
35 views
NMAP NSE script stopping after 900 seconds (15 minutes)
I am experimenting with ssh bruteforce over my home network using the ssh-brute nse script. I have a short list of usernames (just 12) but a long list of passwords (1M).
I can't seem to get the ssh-...
2
votes
2answers
156 views
Nmap not following redirect when using “http-title” script
I am trying to scan a bunch of IPs for their http-title.
Now the problem I have is that nmap pretty much never follows any redirects.
Usually the title I want is behind that redirect though.
For ...
3
votes
0answers
114 views
How can Nmap bypass Windows Server firewall rules?
I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
1
vote
1answer
140 views
NMAP reporting all ports open
I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between.
I tried the SYN scan, and when I check the traffic in WireShark I see ...
0
votes
3answers
82 views
Nmap scanning single port too fast? Shows as filtered?
I ran into an issue when trying to scan a single port on a single machine. I ran a range scan to find machines with port 25 open. Then I just arbitrarily chose one to work on. I scan that machine with ...
-1
votes
1answer
190 views
NMAP - Terminate/stop scan on finding open port
Is there any command on nmap or on some other tool which will stop scan and move on to a different IP on finding a single open port?
Need to perform this for host discovery on few assets which has ...
2
votes
1answer
119 views
Nmap --script-args usage?
I'm trying to use multiple Nmap --script-args at the same time.
$ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com
...
1
vote
2answers
142 views
How to find and ban some devices from my wifi using the command line? [closed]
I use Arch Linux. I just installed some packages such as nmap, netdiscover and others. It is a ubiquiti internet network, for the sharing of connection to several routers. There are about 7 routers ...
-1
votes
1answer
88 views
What is the Difference between TCP Syn discovery and TCP ACK discovery in NMAP?
when im using nmap for network discovery , i dont understand theses options
PS
PA
PU
n
when i use -PS or PA or PU ? and what is the difference between them ?
@ref:
https://nmap.org/book/man-host-...
-4
votes
1answer
152 views
VPN vs real IP address
Is it more secure to use a VPN that has open ports?
22/tcp open ssh
53/tcp open domain
80/tcp open http
110/tcp open pop3
443/tcp open https
500/tcp open isakmp
1723/tcp open pptp
4567/tcp ...
-1
votes
2answers
346 views
How to handle the virus on my router?
I believe my router is infected with a virus. If it is, it has been infected for a large period of time (perhaps a year or more). Though, I only started to consider it being a virus around a week ago.
...
2
votes
1answer
71 views
What port state to expect from Nmap when scanning ports that are open only to specific IP addresses
My firewall has a few ports open but traffic is only forwarded when coming from specific IP addresses (whitelisted).
When scanning these ports with nmap from a non whitelisted IP address, what state ...
0
votes
1answer
226 views
List of all available nmap script arguments
I need to do a scan, for example with http-sql-injection.nse
nmap script.
I already know that I should use --script-args to set arguments, but my question is not about it.
How can I look on the ...
0
votes
2answers
117 views
explain NMAP results
When I ran nmap -sn x.x.x.x/24 on a network behind Cisco ASA firewall I get 255 hosts up even though there are only three hosts on that subnet.
If I run nmap -T4 -F x.x.x.x/24 I get all 254 IP ...
2
votes
1answer
133 views
Use Splunk to run Nmap scan from remote host to potential attacker
When receiving internal attacks, I'd like to utilize Splunk alerts to trigger an Nmap scan against that attacking host from a remote machine; one other than the Splunk server.
Is there any API or ...
0
votes
2answers
86 views
Inconsistent list of hosts found by nmap pings from scan to scan - tcpdump shows ICMP echo replies did arrive
I'm running nmap periodically to monitor which hosts are in our server subnet:
rm list; for i in $(seq 1 254) ; do echo 10.10.10.$i >> list ; done
sudo nmap -oG - -PE -sn -iL list
Most of the ...
1
vote
2answers
76 views
nmap -sn through proxychains fails
Why I can not do the following with nmap?
proxychains nmap -A -v 10.185.11.0/24
Output:
ProxyChains-3.1 (http://proxychains.sf.net)
Starting Nmap 7.60 ( https://nmap.org ) at 2018-08-07 10:12 EEST
...
3
votes
0answers
2k views
What is RTTVAR in NMap? [closed]
I find a lot of sources explaining how to get rid of the following message:
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
But
What exactly is RTTVAR(Round Trip Time Variance)?
What is ...
0
votes
2answers
96 views
Verify whether the IP address is SQL Server
Is a network scan the only way to know if an IP address is a SQL server? How can I verify this 100%?
0
votes
0answers
18 views
NMAP multiple IP scanning (specifying ports for every ip) [duplicate]
I am using nmap for daily monitoring the network service and open ports status,
i wrote a bash script that scans a range of ip and ndiff the output with previous scans, and make it as a daily cronjob.
...
0
votes
0answers
82 views
All smartphone ports filtered - how to scan smartphones on local Wifi?
I am using Nmap and scanning my smartphone (LG G5 - Android) on my local network and practicing trying to gain remote access into it. However, whenever I scan my cellphone, either all ports are closed ...
9
votes
3answers
496 views
What are some instant red flags when scanning an network with nmap
When doing an Nmap scan from an external network, what open ports should be an instant red flag?
For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
0
votes
1answer
632 views
What -sn -Pn does in Nmap?
-sn: It tells the nmap not to do any Port Scan.
-Pn: It tells the nmap not to do any Ping Scan.
Now when I use both together like this, nmap -sn -Pn host.com.
What I saw in the terminal is Nmap ...
0
votes
2answers
63 views
Internal IP's Probing to Unknown External IP's
I recently took a CEH class and they mentioned checking for internal IP's probing to External unknown IP's to determine an attack. What would be the best way to gather and analyze these types of ...
1
vote
1answer
99 views
nmap not showing closed ports
When I running the command
nmap -p 443 -iL ip.txt
It only shows IP addresses with open ports in the output, but does not show IP addresses with closed ports. How can I see the closed ports/IPs.
1
vote
3answers
627 views
NMAP to scan ip and ports from file
I want to scan IP and port from a file as below:
192.168.1.2 443
192.168.2.100 8443
192.168.3.99 80
192.168.4.11 443
How can I do that? I know there is option to take IP from a file using -iL but ...
1
vote
1answer
41 views
is -nU an option with nmap?
My coworkers seem to have -nU (no udp) as an option for their nmap scripts but I've never seen this in use and when I try to use this option with nmap, it does not work. I thought no udp was enabled ...
0
votes
2answers
577 views
No output from nmap script
I'm trying to use the nmap script ssl-dh-params to identify what specific 1024-bit Diffie-Hellman group a TLS server is using. However, the script is not giving me any output at all and I can't ...
0
votes
0answers
33 views
Nmap scan results different when specifying port
Does anyone know how this happened?
I use nmap [ip address] The result shows port 21 is open.
But when I use nmap -p 21 [ip address] the result shows port 21 is filtered.
3
votes
2answers
96 views
Nmap and it default scripts when I already know some of the information
I am a network guy and not a “hacker” or whatever the official term is these days.
I’ve been learning how to use nmap as I think it’s a great tool for just keeping the network secure.
The thing is ...
1
vote
1answer
161 views
Nmap HeartBleed script does not seem to work over non-standard ports
The Nmap script for HeartBleed (using Nmap v7.40) seems to work only over known ports. Whenever a non-standard port is used, the script does not report anything.
nmap -p 46000 --script ssl-heartbleed ...
0
votes
0answers
168 views
What are all of these IPs addresses? Honeypots?
I was scanning my network (192.168.0.1-100) and I found many IP addresses that are not mine nor known, around 800 of them. I guess it has something to do with the ISP. After scanning the ips with nmap ...
1
vote
2answers
197 views
nmap finger print looks alot like shell code and not what's on nmap.org
my concern is the finger print at the end could someone please explain what it is, thanks (looks like a nop sled and buffer overflow )
bash >> nmap -sS -sU -T4 -A -v 192.168.50.1
Nmap scan report ...
0
votes
2answers
350 views
Multiple Open ports on a server, is that safe? [closed]
Using nmap I try to scan a server as a result I get multiple open ports.
For example when I try to scan domain.com as a result:
7/tcp open echo
9/tcp open discard
13/tcp open daytime
21/tcp filtered ...
1
vote
2answers
864 views
Xmas Scan Versus FIN Scan
While studying Nmap, I came across different port scans. Out of these XMAS and FIN scan caught my interest. Though XMAS scan sends FIN, URG and RST flags, the response is the same as that of a FIN ...
0
votes
2answers
749 views
nmap traceroute shows only one hop regardless of target
I'm using Zenmap to map out the network topology of the company I'm working in. When I ran the following command to trace route how my system connects to the internet but Zenmap only shows me a single ...
1
vote
0answers
46 views
network ports are filtered strangely?
I have some Ubuntu servers deployed in VULTR Global Cloud and I have about 300 network ports each server.
However, every server will be filtered in China suddenly (I can ping from China). I use nmap ...
-1
votes
1answer
129 views
What are some IDS/IPS that are able to detect stealth scans done in nmap today? [closed]
I was informed that these scans are no longer "stealth"
0
votes
1answer
164 views
Find out the IP or hostname of the firewall? [closed]
Is there a way to find the IP of the firewall which is blocking my access to an endpoint?
I tried netcat / nmap but not much luck.
I need some form of a tool which does a traceroute to the subnet or ...
3
votes
1answer
739 views
Clarifications regarding ciphers and Nmap scan
I'm running the below Nmap command to test the strength of the cipher suites I have used in my host
nmap -sV --script ssl-enum-ciphers -p 443 <host>
The Nmap doc says that Each ciphersuite is ...
1
vote
1answer
452 views
How to control the ciphersuites in nmap “ssl-enum-ciphers”
There is a script for enumerating the TLS versions and ciphersuites ofered by a server provided by nmap. See this link.
Is there a way that allow me to specify the verisions and ciphersuites I want ...
1
vote
1answer
91 views
Why so many restransmissions on Nmap?
I executed the following code:
sudo nmap -sT -Pn --max-parallelism 1 --max-retries 0 -p5481,10212,19999,2308,102 192.168.0.19 192.168.0.20
And when I analyzed the scan on Wireshark, I saw this:
I ...
0
votes
0answers
84 views
Unable to run Metasploit scripts on a mysql server for authorized penetration testing
I am taking a course in penetration testing and I was provided with a virtual environment to pen test. I was provided with a vpn for my CC server and i am able to ping the host which was found to run ...
0
votes
1answer
197 views
Why I recived user-set on my Nmap analyze?
I executed this command:
nmap -sn -n --scan-delay 1s --max-retries 0 -Pn --packet-trace --reason <IP>
And I received this response:
Host is up, received user-set.
It seems that Nmap thinks ...
0
votes
1answer
201 views
Does nmap mtu scan really send crafted mtu size?
Since nmap is a well-known security tools, I guess this is the right section.
I've been reading about nmap techniques here as part of my network security syllabus ...
I've performed 2 scans ... one ...
