Questions tagged [nmap]
A robust and open source security tool for network discovery and security auditing.
534
questions
1
vote
0
answers
31
views
Is the Appearance of Numerous Open Ports in Network Scans a Misconfiguration, Security Strategy, or Bad Practice? [duplicate]
While scanning networks, I have often come across a large number of open ports, or that’s the result returned by various tools like Nmap, Masscan, etc. Of course, this is false information...
But I’m ...
- 11
0
votes
1
answer
47
views
Nmap --disable-arp-ping [duplicate]
I was wondering what the option --disable-arp-ping is for? I have been doing HTB and sometimes I see them using it but I do not really know what is the purpose of this option.
5
votes
2
answers
606
views
Why does NMAP's Http-Method-Tampering Mark a Server's 405 Code as Vulnerable?
I recently tested a custom server with the http method tamper script from NMAP. It reported the server as being vulnerable with the following output:
nmap -p 8000 -sV --script http-method-tamper 192....
- 236
2
votes
0
answers
66
views
Why is every port open on every scan i do [duplicate]
I have been hired to do some tests on networks but however everytime i do a scan every port is open. This is using nmap and homemade tools. This has been a ongoing problem. I created a script to check ...
- 39
1
vote
1
answer
286
views
nmap does not work through proxychains
Despite the already existing answers about this topic, I am still unable to use nmap through proxychains.
I would like to scan the port 80 of a machine I can connect using SSH. To do so, I enabled ...
- 133
0
votes
0
answers
547
views
How to perform focused scan of public IP using nmap? [duplicate]
Scanning my router using the private IP address using nmap reveals the open ports:
Obtaining the public IP address of the router can be achieved by executing the command:
nslookup myip.opendns.com ...
- 101
2
votes
2
answers
149
views
Attack surface when no incoming port is open [closed]
Let's assume that the only attack to be feared on a computer is one via the network in which the machine is embedded.
What options does an attacker have if the machine has no open incoming ports?
(For ...
- 21
0
votes
0
answers
91
views
Default nmap script execution when specifying --script banner
I have a subscription for a NSE scripts feed for nmap. There are some of those scripts which have the default category (among others)
I am running nmap in the following way
nmap --privileged -oX - -T3 ...
0
votes
0
answers
143
views
nmap scanning a slow host
Is there way how to enforce nmap waiting for replies longer (10 seconds)? I want to scan an embedded device which utilizes some sleep modes and it process packets from wi-fi module with very high ...
- 101
1
vote
0
answers
241
views
NMAP sending ARP request to destination IP instead of default gateway [closed]
I am doing an NMAP port scan to a remote IP present in a different subnet. NMAP initiates an ARP request first to the remote IP instead of the default gateway(even if the ARP entry is present in the ...
1
vote
1
answer
631
views
Vulnerability scanning on target Android device
Is there an nmap vulnerability scanning script (vuln, vulscan, nmap-vulners etc) for scanning target Android devices on the network?
If not, is there any specific scanning tool that scans for CVE on ...
- 41
1
vote
1
answer
415
views
Nmap recommendations for ICS scanning
ICS systems seem to have to be handled with care concerning network load. So my question is if you probably have any suggestions on how to configure nmap to scan as many machines as possible in ...
- 15
1
vote
0
answers
107
views
What tool can I use to verify the output from Nmap? [closed]
With OS detection enabled I noticed that the device fingerprints is running something entirely wrong. Is there another tool that I can use that can verify since something looks odd?
- 11
0
votes
1
answer
343
views
Nmap is returning different results when run on different source networks on the target same network
I am running a CODA4680 in bridge mode connected to my pfsense 1100 (and yes it is getting a true public ip). I set it up the standard way, didn't touch the rules.
I performed an NMAP scan from my ...
- 1
0
votes
1
answer
159
views
Reason ports are toggling between no-response and host unrechable for the SAME machine, why?
I'm trying to learn pentesting and one thing that triggers me for my workshop is :
I have an ip address where all reason's ports are no-response, the status for all ports are filtered but when I re-do ...
- 101
1
vote
1
answer
316
views
nmap: no exact OS matches when adding the exact signature to nmap-os-db
I'm currently trying to learn Nmap -O (OS guess feature).
I'm launching the following command: nmap -O 172.17.0.3
This command is generating the following fingerprint as output:
No exact OS ...
- 11
3
votes
2
answers
3k
views
nmap doesn't give service versions using -sV
Running the command
nmap -sV -T4 -A x.x.x.x
results in
5901/tcp open ssl/vnc-1?
|_ssl-date: TLS randomness does not represent time
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 503 ...
- 33
0
votes
1
answer
424
views
Is there a way to identify whether "filtered" state in nmap output caused by a network or host-based firewall?
Is there a way to identify whether "filtered" state for a specific port in nmap output is caused by a network firewall or host-based firewall?
- 180
2
votes
1
answer
1k
views
How do I find subnets on the network in order to scan them for hosts?
I'm new to Security and I'm doing INE's Penetration Testing Student Learning path. In the current lab, (Find the Secret Server) we have this setup:
The exercise focuses on adding an entry to the ...
- 121
2
votes
1
answer
2k
views
How to remotely check if SSL 3.0 is enabled on server?
I would like to remotely verify whether SSL 3.0 is running on several servers.
Previously, this command:
openssl s_client -connect example.com:443 -ssl3
Would have worked but now I am getting the ...
- 23
0
votes
0
answers
2k
views
Scan for open ports on subdomain
I am curently scanning for open ports on a subdomain. Say I have example.com and subdomain.example.com, but this subdomain can only be reached at port 8443. How can I scan for other potential open ...
- 1
1
vote
1
answer
754
views
How to confirm what service is running on a port identified by nmap?
Probing with nmap returns BlackICE on a couple of ports however it seems to be a really old tool according to these manuals.
Starting Nmap 7.80 ( https://nmap.org ) at 2022-10-16 20:27 EDT
Nmap scan ...
- 141
1
vote
1
answer
402
views
How can I port scan my p2p device?
I have a device and I am trying to port scan it. I did the basic
nmap -A -p0- 192.168.0.x
but I am just getting
0/tcp filtered unknown
so I don't think it is working. The device works on p2p so I am ...
1
vote
1
answer
264
views
Prevent Discovery of Port from NMAP scan using -Pn
Is there a way to prevent a port from being discovered by nmap? I found that port 1433 is still being flagged as "open" when using the following command:
nmap <ip_add> -Pn -p1433
or
...
- 11
0
votes
1
answer
3k
views
Why did Nmap not yield results when scanning a friend's public IP address? [duplicate]
I am trying to learn more about Nmap but it seems like it can only really give any information if you're actually connected to the network you're scanning on. For example, a friend and I gave each ...
- 13
0
votes
1
answer
234
views
What is the version of the scanned OS?
I've scanned a target with metasploit scanner/smb/smb_version and nmap -O.
smb_version: Windows 2016 Standard (build:14393)
Nmap: Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
What is ...
0
votes
0
answers
113
views
Does fragrouter work with OpenVPN?
My goal is to evade IDS/IPS detection and scan the target with nmap. If the scan is detected, the target seems to stop responding for 10s. I think that IP Fragmentation Attack is exactly what I need.
...
- 11
1
vote
0
answers
3k
views
SSLLabs' SSLTest vs. nmap ssl-enum-ciphers
Recently I conducted a SSL server test to assess the SSL configuration of my server. While the overall grade A+ was pretty good, it was found that the server supports several cipher suites that are ...
- 121
0
votes
1
answer
603
views
Nmap reports an open port as closed
I'm running an OpenVPN server and can use it normally; I know for a fact that the port is open. Running an Nmap scan on port 1194 (the one I'm using) says it is closed. What could be causing this ...
- 74
1
vote
1
answer
217
views
The server acts as a database server , but there is no open port regarding that why?
I've taken a pen-testing course and for the final certificate, I have to analyze a server and make a report regarding the vulnerabilities.
The server does multiple functionalities, It acts as a web ...
- 41
0
votes
1
answer
1k
views
How to interpret the output of nmap "vulners"
I am trying to judge the security of a web app and I have the sample output below from nmap. But I'm not really sure how to properly interpret it.
Is it merely a printout of all the CVEs for this ...
- 87
0
votes
0
answers
129
views
Stealth scan or -PS
I want to find out how -PS works for service discovery very well when there are the stealth scan options such as -sS, available in nmap.
I am currently testing nmap.scanme.org and I know there is a ...
0
votes
1
answer
22k
views
I am trying to exploit port 7000/tcp afs3-fileserver
I have been trying to exploit a cheap smart tv box that I have bought a while ago and after my nmap scan I found that port 7000/tcp was open but researching about the port gave back not much ...
- 1
2
votes
0
answers
2k
views
Check for allowed OpenVPN SSL/TLS cipher suites from the client-side
I would like to check cipher suites that the OpenVPN server accepts. I used nmap:
nmap -sU --script ssl-enum-ciphers -p 1194 <IP>
but the results are only:
Host is up (0.0033s latency).
PORT ...
- 1,363
0
votes
0
answers
102
views
nmap scanning Raspbian with strange results
I'm a high schooler in a CyberDefense Class and we are learning to PenTest.
I'm on Red Team and my teacher set up a system with Rasbian as the OS. When I run a scan on the computer scanning the Top ...
- 1
0
votes
0
answers
195
views
How to detect a firewall used
I was scanning a network with Nmap.
I'm looking for advanced commands for detecting firewalls.
6
votes
2
answers
14k
views
How do you scan multiple subnets using Nmap?
I'm looking to scan a network with multiple subnets. I'm looking for a way to shorten this to one command rather than entering each subnet. So let's say I'm try to scan 192.168.1.xx, 192.168.2.xx and ...
- 71
2
votes
1
answer
405
views
How are nmap arp pings implemented?
Nmap issues the raw ARP requests and handles retransmission and
timeout periods at its own discretion
The above is how nmap describes arp pings, but how is a layer 2 concept returned to the sender (...
- 23
2
votes
0
answers
143
views
How to evaluate a responsive but unknown network protocol?
I am studying CREST CPSA where the syllabus is listed here.
There is a part of the syllabus which states I should know the Evaluation of responsive but unknown network applications.
I find this ...
- 211
2
votes
0
answers
1k
views
Windows XP SP3 2002 is not vulnerable to MS08-067
Why is my VM not vulnerable to MS08-067?
There are similar question on stack exchange, yes, but they fail to specify all relevant information and so non receive a meaningful, thoughtful nor thorough ...
1
vote
1
answer
1k
views
Why when i nmap scan a machine i get the port 554 (RTSP) open?
I train on vulnerable boxes and during my recon phase, I use nmap to collect info on open ports.
I use the command nmap -sS [IP|URL] and no matter the machine, I get the result that port 554 - RTSP ...
- 11
1
vote
1
answer
1k
views
What are the drawbacks of a stealthy port scan?
I read that port scanning services like nmap will conduct a "TCP Connect Scan". They'll attempt to make a TCP connection to each of the ports within the range provided. But because each of ...
- 113
0
votes
1
answer
601
views
Nmap returns both, mysql and mariadb versions, how do I khow which one is actually running?
I ran nmap scan and output included following line:
3306/tcp open mysql MySQL 5.5.5-10.3.25-MariaDB-0+deb10u1
How do I know which one is actually running, MySQL or MariaDB?
- 129
3
votes
3
answers
524
views
What is the value of port knocking when I have strict firewall rules
I have specifically allowed three external machines to SSH into my server. All other traffic will be dropped. Using nmap from another machine, I am unable to see my server's SSH port and it shows ...
- 41
0
votes
0
answers
37
views
How to configure Snort 3 to detect nmap's port scanning? [duplicate]
How to configure snort 3 to detect nmap's port scanning? For instance I want to know that an external machine A is looking with nmap for open ports on my machine B.
Such a port scan can include all ...
- 101
0
votes
1
answer
281
views
ncrack ssl option
There is the following option in ncrack (from the man page):
Misc options:
ssl: enable SSL over this service
ssl (Enable/Disable SSL over service)
By enabling SSL, Ncrack will try to open a TCP ...
- 282
2
votes
1
answer
4k
views
difference between icmp ping scan and normal ping scan
I'm learning to use nmap on my kali linux and was testing out the various types of scans available in it.
-sn is for ping scan which basically prevents nmap from scanning all the ports (and probably ...
- 123
0
votes
1
answer
730
views
Fingerprinting Cisco ASA Device
I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host&...
- 3
1
vote
1
answer
3k
views
Blocking nginx from nmap version detection [duplicate]
Is there an efficient way to hide nginx from Nmap's Version Detection scan (nmap -sV)? The following is a sample result, we are trying to hide the nginx (reverse proxy) string.
PORT STATE SERVICE ...
- 13
2
votes
1
answer
285
views
does Nmap automatically use proxychains if configured?
I have configured my proxy chains in /etc/proxychains.conf. Then when just run nmap or even nc without the proxychains prefix, it automatically uses the proxy chains and routes the traffic through the ...
- 31