Questions tagged [nmap]
A robust and open source security tool for network discovery and security auditing.
531
questions
0
votes
0
answers
10
views
Nmap Scan 3 different private IP 1 target [closed]
If I scan a target from 3 private IPs on the same network having the same gateway, will the target computer see the traffic coming from 1 IP (the public IP of the gateway)?
0
votes
0
answers
21
views
nmap scanning a slow host
Is there way how to enforce nmap waiting for replies longer (10 seconds)? I want to scan an embedded device which utilizes some sleep modes and it process packets from wi-fi module with very high ...
- 101
0
votes
0
answers
51
views
NMAP same destination ip, different scanner interface, different result
I am trying to check the port status of a external IP using NMAP, I am getting different result on different interface to same destination (destination is a public IP).
When NMAP tried from the ...
1
vote
0
answers
32
views
NMAP sending ARP request to destination IP instead of default gateway [closed]
I am doing an NMAP port scan to a remote IP present in a different subnet. NMAP initiates an ARP request first to the remote IP instead of the default gateway(even if the ARP entry is present in the ...
0
votes
1
answer
94
views
Vulnerability scanning on target Android device
Is there an nmap vulnerability scanning script (vuln, vulscan, nmap-vulners etc) for scanning target Android devices on the network?
If not, is there any specific scanning tool that scans for CVE on ...
- 21
0
votes
0
answers
42
views
How to scan private IPs from the Internet [duplicate]
If we have any public IP and their private network IP, which command should we use to scan their private IP to find their vulnerabilities and open ports?
- 1
1
vote
1
answer
58
views
Nmap recommendations for ICS scanning
ICS systems seem to have to be handled with care concerning network load. So my question is if you probably have any suggestions on how to configure nmap to scan as many machines as possible in ...
- 15
0
votes
0
answers
66
views
Does NMAP detect SecurityOnion honeypots?
I'm installing SecurityOnion Intrusion Detection Honeypot. Does NMAP recognise it as CentOS7 or it might give a hint to the hacker that it is a security onion machine build?
Does SecurityOnion have ...
- 111
1
vote
0
answers
44
views
What tool can I use to verify the output from Nmap? [closed]
With OS detection enabled I noticed that the device fingerprints is running something entirely wrong. Is there another tool that I can use that can verify since something looks odd?
- 11
0
votes
1
answer
100
views
Nmap is returning different results when run on different source networks on the target same network
I am running a CODA4680 in bridge mode connected to my pfsense 1100 (and yes it is getting a true public ip). I set it up the standard way, didn't touch the rules.
I performed an NMAP scan from my ...
- 1
0
votes
1
answer
42
views
Reason ports are toggling between no-response and host unrechable for the SAME machine, why?
I'm trying to learn pentesting and one thing that triggers me for my workshop is :
I have an ip address where all reason's ports are no-response, the status for all ports are filtered but when I re-do ...
- 101
1
vote
1
answer
112
views
nmap: no exact OS matches when adding the exact signature to nmap-os-db
I'm currently trying to learn Nmap -O (OS guess feature).
I'm launching the following command: nmap -O 172.17.0.3
This command is generating the following fingerprint as output:
No exact OS ...
- 11
3
votes
2
answers
901
views
nmap doesn't give service versions using -sV
Running the command
nmap -sV -T4 -A x.x.x.x
results in
5901/tcp open ssl/vnc-1?
|_ssl-date: TLS randomness does not represent time
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 503 ...
- 33
0
votes
1
answer
152
views
Is there a way to identify whether "filtered" state in nmap output caused by a network or host-based firewall?
Is there a way to identify whether "filtered" state for a specific port in nmap output is caused by a network firewall or host-based firewall?
- 180
2
votes
1
answer
254
views
How do I find subnets on the network in order to scan them for hosts?
I'm new to Security and I'm doing INE's Penetration Testing Student Learning path. In the current lab, (Find the Secret Server) we have this setup:
The exercise focuses on adding an entry to the ...
- 121
0
votes
0
answers
18
views
Nmap scan using default script scan and version detection fail [duplicate]
I am running the following scan using -sC -sV on a target:
sudo nmap -sC -sV XX.XX.XX.XX
PORT STATE SERVICE VERSION
53/tcp open tcpwrapped
80/tcp open tcpwrapped
443/tcp open tcpwrapped
I ...
2
votes
1
answer
625
views
How to remotely check if SSL 3.0 is enabled on server?
I would like to remotely verify whether SSL 3.0 is running on several servers.
Previously, this command:
openssl s_client -connect example.com:443 -ssl3
Would have worked but now I am getting the ...
- 23
0
votes
0
answers
1k
views
Scan for open ports on subdomain
I am curently scanning for open ports on a subdomain. Say I have example.com and subdomain.example.com, but this subdomain can only be reached at port 8443. How can I scan for other potential open ...
- 1
1
vote
1
answer
228
views
How to confirm what service is running on a port identified by nmap?
Probing with nmap returns BlackICE on a couple of ports however it seems to be a really old tool according to these manuals.
Starting Nmap 7.80 ( https://nmap.org ) at 2022-10-16 20:27 EDT
Nmap scan ...
- 141
1
vote
1
answer
171
views
How can I port scan my p2p device?
I have a device and I am trying to port scan it. I did the basic
nmap -A -p0- 192.168.0.x
but I am just getting
0/tcp filtered unknown
so I don't think it is working. The device works on p2p so I am ...
1
vote
1
answer
137
views
Prevent Discovery of Port from NMAP scan using -Pn
Is there a way to prevent a port from being discovered by nmap? I found that port 1433 is still being flagged as "open" when using the following command:
nmap <ip_add> -Pn -p1433
or
...
- 11
0
votes
1
answer
902
views
Why did Nmap not yield results when scanning a friend's public IP address? [duplicate]
I am trying to learn more about Nmap but it seems like it can only really give any information if you're actually connected to the network you're scanning on. For example, a friend and I gave each ...
- 13
0
votes
1
answer
124
views
What is the version of the scanned OS?
I've scanned a target with metasploit scanner/smb/smb_version and nmap -O.
smb_version: Windows 2016 Standard (build:14393)
Nmap: Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
What is ...
0
votes
0
answers
55
views
Does fragrouter work with OpenVPN?
My goal is to evade IDS/IPS detection and scan the target with nmap. If the scan is detected, the target seems to stop responding for 10s. I think that IP Fragmentation Attack is exactly what I need.
...
- 11
1
vote
0
answers
1k
views
SSLLabs' SSLTest vs. nmap ssl-enum-ciphers
Recently I conducted a SSL server test to assess the SSL configuration of my server. While the overall grade A+ was pretty good, it was found that the server supports several cipher suites that are ...
- 121
0
votes
1
answer
226
views
Nmap reports an open port as closed
I'm running an OpenVPN server and can use it normally; I know for a fact that the port is open. Running an Nmap scan on port 1194 (the one I'm using) says it is closed. What could be causing this ...
- 64
1
vote
1
answer
90
views
The server acts as a database server , but there is no open port regarding that why?
I've taken a pen-testing course and for the final certificate, I have to analyze a server and make a report regarding the vulnerabilities.
The server does multiple functionalities, It acts as a web ...
- 31
0
votes
1
answer
611
views
How to interpret the output of nmap "vulners"
I am trying to judge the security of a web app and I have the sample output below from nmap. But I'm not really sure how to properly interpret it.
Is it merely a printout of all the CVEs for this ...
- 87
0
votes
0
answers
63
views
Stealth scan or -PS
I want to find out how -PS works for service discovery very well when there are the stealth scan options such as -sS, available in nmap.
I am currently testing nmap.scanme.org and I know there is a ...
0
votes
1
answer
10k
views
I am trying to exploit port 7000/tcp afs3-fileserver
I have been trying to exploit a cheap smart tv box that I have bought a while ago and after my nmap scan I found that port 7000/tcp was open but researching about the port gave back not much ...
- 1
2
votes
0
answers
663
views
Check for allowed OpenVPN SSL/TLS cipher suites from the client-side
I would like to check cipher suites that the OpenVPN server accepts. I used nmap:
nmap -sU --script ssl-enum-ciphers -p 1194 <IP>
but the results are only:
Host is up (0.0033s latency).
PORT ...
- 1,283
0
votes
0
answers
55
views
nmap scanning Raspbian with strange results
I'm a high schooler in a CyberDefense Class and we are learning to PenTest.
I'm on Red Team and my teacher set up a system with Rasbian as the OS. When I run a scan on the computer scanning the Top ...
- 1
0
votes
0
answers
94
views
How to detect a firewall used
I was scanning a network with Nmap.
I'm looking for advanced commands for detecting firewalls.
5
votes
2
answers
7k
views
How do you scan multiple subnets using Nmap?
I'm looking to scan a network with multiple subnets. I'm looking for a way to shorten this to one command rather than entering each subnet. So let's say I'm try to scan 192.168.1.xx, 192.168.2.xx and ...
- 61
2
votes
1
answer
198
views
How are nmap arp pings implemented?
Nmap issues the raw ARP requests and handles retransmission and
timeout periods at its own discretion
The above is how nmap describes arp pings, but how is a layer 2 concept returned to the sender (...
- 23
1
vote
0
answers
84
views
How to evaluate a responsive but unknown network protocol?
I am studying CREST CPSA where the syllabus is listed here.
There is a part of the syllabus which states I should know the Evaluation of responsive but unknown network applications.
I find this ...
- 181
2
votes
0
answers
717
views
Windows XP SP3 2002 is not vulnerable to MS08-067
Why is my VM not vulnerable to MS08-067?
There are similar question on stack exchange, yes, but they fail to specify all relevant information and so non receive a meaningful, thoughtful nor thorough ...
1
vote
1
answer
681
views
Why when i nmap scan a machine i get the port 554 (RTSP) open?
I train on vulnerable boxes and during my recon phase, I use nmap to collect info on open ports.
I use the command nmap -sS [IP|URL] and no matter the machine, I get the result that port 554 - RTSP ...
- 11
1
vote
1
answer
690
views
What are the drawbacks of a stealthy port scan?
I read that port scanning services like nmap will conduct a "TCP Connect Scan". They'll attempt to make a TCP connection to each of the ports within the range provided. But because each of ...
- 113
0
votes
1
answer
431
views
Nmap returns both, mysql and mariadb versions, how do I khow which one is actually running?
I ran nmap scan and output included following line:
3306/tcp open mysql MySQL 5.5.5-10.3.25-MariaDB-0+deb10u1
How do I know which one is actually running, MySQL or MariaDB?
- 119
3
votes
3
answers
250
views
What is the value of port knocking when I have strict firewall rules
I have specifically allowed three external machines to SSH into my server. All other traffic will be dropped. Using nmap from another machine, I am unable to see my server's SSH port and it shows ...
- 41
0
votes
0
answers
32
views
How to configure Snort 3 to detect nmap's port scanning? [duplicate]
How to configure snort 3 to detect nmap's port scanning? For instance I want to know that an external machine A is looking with nmap for open ports on my machine B.
Such a port scan can include all ...
- 101
0
votes
1
answer
190
views
ncrack ssl option
There is the following option in ncrack (from the man page):
Misc options:
ssl: enable SSL over this service
ssl (Enable/Disable SSL over service)
By enabling SSL, Ncrack will try to open a TCP ...
- 242
1
vote
1
answer
2k
views
difference between icmp ping scan and normal ping scan
I'm learning to use nmap on my kali linux and was testing out the various types of scans available in it.
-sn is for ping scan which basically prevents nmap from scanning all the ports (and probably ...
- 113
0
votes
1
answer
389
views
Fingerprinting Cisco ASA Device
I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host&...
- 3
0
votes
1
answer
2k
views
Blocking nginx from nmap version detection [duplicate]
Is there an efficient way to hide nginx from Nmap's Version Detection scan (nmap -sV)? The following is a sample result, we are trying to hide the nginx (reverse proxy) string.
PORT STATE SERVICE ...
- 3
0
votes
1
answer
193
views
does Nmap automatically use proxychains if configured?
I have configured my proxy chains in /etc/proxychains.conf. Then when just run nmap or even nc without the proxychains prefix, it automatically uses the proxy chains and routes the traffic through the ...
- 11
1
vote
3
answers
2k
views
Scanning a domain name
When we scan a domain name such as www.nmap.org,
Question 1: We are actually scanning the server that the website is hosted on, right?
Question 2: If there is another domain hosted on the same server, ...
- 41
0
votes
1
answer
7k
views
How to resolve hostnames with nmap to perform scans?
I went through old threads on this forum and tried --resolve-all but it doesn't seem to work.
If I use nmap -sn <hostname> It throws an error Failed to resolve <hostname>
If I use nmap -sn ...
- 1
1
vote
0
answers
539
views
False positives (port scanning) when using proxychains-ng with nmap [closed]
I get false positive ports that are marked open when using nmap with proxychains-ng (Using a proxy list that contains socks5 proxies). I've tried a couple of techniques to debug this strange behavior (...
- 11