A robust and open source security tool for network discovery and security auditing.
2
votes
1answer
40 views
Nmap --script-args usage?
I'm trying to use multiple Nmap --script-args at the same time.
$ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com
...
1
vote
2answers
127 views
How to find and ban some devices from my wifi using the command line? [closed]
I use Arch Linux. I just installed some packages such as nmap, netdiscover and others. It is a ubiquiti internet network, for the sharing of connection to several routers. There are about 7 routers ...
-1
votes
1answer
39 views
What is the Difference between TCP Syn discovery and TCP ACK discovery in NMAP?
when im using nmap for network discovery , i dont understand theses options
PS
PA
PU
n
when i use -PS or PA or PU ? and what is the difference between them ?
@ref:
https://nmap.org/book/man-host-...
0
votes
0answers
15 views
Zenmap -pf output
We smart host all our mail via a third party that archives and sanitises all our inbound and outbound mail.
We recently had a spam attack, where the web portal to a users mailbox on this 3rd party ...
-4
votes
1answer
131 views
VPN vs real IP address
Is it more secure to use a VPN that has open ports?
22/tcp open ssh
53/tcp open domain
80/tcp open http
110/tcp open pop3
443/tcp open https
500/tcp open isakmp
1723/tcp open pptp
4567/tcp ...
-1
votes
2answers
225 views
How to handle the virus on my router?
I believe my router is infected with a virus. If it is, it has been infected for a large period of time (perhaps a year or more). Though, I only started to consider it being a virus around a week ago.
...
2
votes
1answer
64 views
What port state to expect from Nmap when scanning ports that are open only to specific IP addresses
My firewall has a few ports open but traffic is only forwarded when coming from specific IP addresses (whitelisted).
When scanning these ports with nmap from a non whitelisted IP address, what state ...
0
votes
1answer
49 views
List of all available nmap script arguments
I need to do a scan, for example with http-sql-injection.nse
nmap script.
I already know that I should use --script-args to set arguments, but my question is not about it.
How can I look on the ...
0
votes
2answers
86 views
explain NMAP results
When I ran nmap -sn x.x.x.x/24 on a network behind Cisco ASA firewall I get 255 hosts up even though there are only three hosts on that subnet.
If I run nmap -T4 -F x.x.x.x/24 I get all 254 IP ...
0
votes
0answers
30 views
How can I perform nmap scanning on a Windows virtual box
I am trying to do an Nmap scan to a Windows 2016 Server virtual machine from my host Windows 10 machine.
I want to see the open ports in the virtual Windows machine. There is no problem with the ...
2
votes
1answer
70 views
Use Splunk to run Nmap scan from remote host to potential attacker
When receiving internal attacks, I'd like to utilize Splunk alerts to trigger an Nmap scan against that attacking host from a remote machine; one other than the Splunk server.
Is there any API or ...
0
votes
2answers
66 views
Inconsistent list of hosts found by nmap pings from scan to scan - tcpdump shows ICMP echo replies did arrive
I'm running nmap periodically to monitor which hosts are in our server subnet:
rm list; for i in $(seq 1 254) ; do echo 10.10.10.$i >> list ; done
sudo nmap -oG - -PE -sn -iL list
Most of the ...
1
vote
2answers
54 views
nmap -sn through proxychains fails
Why I can not do the following with nmap?
proxychains nmap -A -v 10.185.11.0/24
Output:
ProxyChains-3.1 (http://proxychains.sf.net)
Starting Nmap 7.60 ( https://nmap.org ) at 2018-08-07 10:12 EEST
...
2
votes
0answers
250 views
What is RTTVAR in NMap? [closed]
I find a lot of sources explaining how to get rid of the following message:
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
But
What exactly is RTTVAR(Round Trip Time Variance)?
What is ...
0
votes
2answers
90 views
Verify whether the IP address is SQL Server
Is a network scan the only way to know if an IP address is a SQL server? How can I verify this 100%?
0
votes
0answers
18 views
NMAP multiple IP scanning (specifying ports for every ip) [duplicate]
I am using nmap for daily monitoring the network service and open ports status,
i wrote a bash script that scans a range of ip and ndiff the output with previous scans, and make it as a daily cronjob.
...
0
votes
0answers
70 views
All smartphone ports filtered - how to scan smartphones on local Wifi?
I am using Nmap and scanning my smartphone (LG G5 - Android) on my local network and practicing trying to gain remote access into it. However, whenever I scan my cellphone, either all ports are closed ...
9
votes
3answers
433 views
What are some instant red flags when scanning an network with nmap
When doing an Nmap scan from an external network, what open ports should be an instant red flag?
For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
0
votes
1answer
167 views
What -sn -Pn does in Nmap?
-sn: It tells the nmap not to do any Port Scan.
-Pn: It tells the nmap not to do any Ping Scan.
Now when I use both together like this, nmap -sn -Pn host.com.
What I saw in the terminal is Nmap ...
0
votes
2answers
58 views
Internal IP's Probing to Unknown External IP's
I recently took a CEH class and they mentioned checking for internal IP's probing to External unknown IP's to determine an attack. What would be the best way to gather and analyze these types of ...
1
vote
1answer
85 views
nmap not showing closed ports
When I running the command
nmap -p 443 -iL ip.txt
It only shows IP addresses with open ports in the output, but does not show IP addresses with closed ports. How can I see the closed ports/IPs.
1
vote
3answers
173 views
NMAP to scan ip and ports from file
I want to scan IP and port from a file as below:
192.168.1.2 443
192.168.2.100 8443
192.168.3.99 80
192.168.4.11 443
How can I do that? I know there is option to take IP from a file using -iL but ...
1
vote
1answer
38 views
is -nU an option with nmap?
My coworkers seem to have -nU (no udp) as an option for their nmap scripts but I've never seen this in use and when I try to use this option with nmap, it does not work. I thought no udp was enabled ...
0
votes
2answers
190 views
No output from nmap script
I'm trying to use the nmap script ssl-dh-params to identify what specific 1024-bit Diffie-Hellman group a TLS server is using. However, the script is not giving me any output at all and I can't ...
0
votes
0answers
32 views
Nmap scan results different when specifying port
Does anyone know how this happened?
I use nmap [ip address] The result shows port 21 is open.
But when I use nmap -p 21 [ip address] the result shows port 21 is filtered.
3
votes
2answers
70 views
Nmap and it default scripts when I already know some of the information
I am a network guy and not a “hacker” or whatever the official term is these days.
I’ve been learning how to use nmap as I think it’s a great tool for just keeping the network secure.
The thing is ...
1
vote
1answer
95 views
Nmap HeartBleed script does not seem to work over non-standard ports
The Nmap script for HeartBleed (using Nmap v7.40) seems to work only over known ports. Whenever a non-standard port is used, the script does not report anything.
nmap -p 46000 --script ssl-heartbleed ...
0
votes
0answers
123 views
What are all of these IPs addresses? Honeypots?
I was scanning my network (192.168.0.1-100) and I found many IP addresses that are not mine nor known, around 800 of them. I guess it has something to do with the ISP. After scanning the ips with nmap ...
1
vote
2answers
114 views
nmap finger print looks alot like shell code and not what's on nmap.org
my concern is the finger print at the end could someone please explain what it is, thanks (looks like a nop sled and buffer overflow )
bash >> nmap -sS -sU -T4 -A -v 192.168.50.1
Nmap scan report ...
-1
votes
2answers
197 views
Multiple Open ports on a server , is that safe? [closed]
Using nmap I try to scan a server as a result I get multiple open ports.
For example when I try to scan domain.com
as a result :
7/tcp open echo
9/tcp open discard
13/tcp open daytime
21/tcp ...
1
vote
2answers
358 views
Xmas Scan Versus FIN Scan
While studying Nmap, I came across different port scans. Out of these XMAS and FIN scan caught my interest. Though XMAS scan sends FIN, URG and RST flags, the response is the same as that of a FIN ...
0
votes
2answers
222 views
nmap traceroute shows only one hop regardless of target
I'm using Zenmap to map out the network topology of the company I'm working in. When I ran the following command to trace route how my system connects to the internet but Zenmap only shows me a single ...
1
vote
0answers
43 views
network ports are filtered strangely?
I have some Ubuntu servers deployed in VULTR Global Cloud and I have about 300 network ports each server.
However, every server will be filtered in China suddenly (I can ping from China). I use nmap ...
-1
votes
1answer
79 views
What are some IDS/IPS that are able to detect stealth scans done in nmap today? [closed]
I was informed that these scans are no longer "stealth"
0
votes
1answer
154 views
Find out the IP or hostname of the firewall? [closed]
Is there a way to find the IP of the firewall which is blocking my access to an endpoint?
I tried netcat / nmap but not much luck.
I need some form of a tool which does a traceroute to the subnet or ...
3
votes
1answer
339 views
Clarifications regarding ciphers and Nmap scan
I'm running the below Nmap command to test the strength of the cipher suites I have used in my host
nmap -sV --script ssl-enum-ciphers -p 443 <host>
The Nmap doc says that Each ciphersuite is ...
1
vote
1answer
125 views
How to control the ciphersuites in nmap “ssl-enum-ciphers”
There is a script for enumerating the TLS versions and ciphersuites ofered by a server provided by nmap. See this link.
Is there a way that allow me to specify the verisions and ciphersuites I want ...
1
vote
1answer
84 views
Why so many restransmissions on Nmap?
I executed the following code:
sudo nmap -sT -Pn --max-parallelism 1 --max-retries 0 -p5481,10212,19999,2308,102 192.168.0.19 192.168.0.20
And when I analyzed the scan on Wireshark, I saw this:
I ...
0
votes
0answers
56 views
Unable to run Metasploit scripts on a mysql server for authorized penetration testing
I am taking a course in penetration testing and I was provided with a virtual environment to pen test. I was provided with a vpn for my CC server and i am able to ping the host which was found to run ...
0
votes
1answer
107 views
Why I recived user-set on my Nmap analyze?
I executed this command:
nmap -sn -n --scan-delay 1s --max-retries 0 -Pn --packet-trace --reason <IP>
And I received this response:
Host is up, received user-set.
It seems that Nmap thinks ...
0
votes
1answer
118 views
Does nmap mtu scan really send crafted mtu size?
Since nmap is a well-known security tools, I guess this is the right section.
I've been reading about nmap techniques here as part of my network security syllabus ...
I've performed 2 scans ... one ...
1
vote
0answers
71 views
Why ever “trust” Nmap's reverse lookup for system hostname when doing host discovery?
Quick question. I was scanning a lab network with Nmap just doing host discovery to see what hosts were out there. I got a list of hosts, ips, hostnames, ports open, services, etc. Upon further ...
0
votes
2answers
69 views
How can I disable double request for detected port in Nmap?
When I execute this command:
nmap -sT -p 5481,10212,19999,2308,102,502,20000,2000,44818,2222,47808,18246,910,912,1974,8086,8087,12397,12399,12401,20222,22202,46824,5002,802,27700,2869 --scan-delay 1s ...
0
votes
1answer
211 views
Modify Win OS banner to avoid OS detection
I would like to modify Win OS banner to defeat OS detection from scanning tools like Nmap for example. Although, I know that Nmap does not take into account just the banner to do OS detection.
4
votes
1answer
638 views
NMAP - Closed vs Filtered
A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found).
I want to understand why NMAP decides to ...
5
votes
1answer
715 views
Connection to ports 2000 and 5060 successful despite filtering
I run my own (Ubuntu based) router and have iptables configured to drop all incoming packets by default. To my surprise, running an nmap scan (from the WAN side) shows two open ports related to VOIP:
...
0
votes
2answers
105 views
Nmap - Inconsistent Port Response
What could be the possible reason(s) of scanning a port and getting an open (syn-ack) response and then getting a closed (rst) response within a small timeframe.
Starting Nmap 7.25BETA1 ( https://...
0
votes
1answer
183 views
ufw and nmap show different result in terms of open ports
I have set my firewall ufw / firewall rules as follows:
Default: deny (incoming), allow (outgoing), disabled (routed)
To Action From
-- ...
0
votes
1answer
112 views
Different Nmap results on MacOS and Ubuntu 16.04
I did a Nmap scan with this command:
nmap -sn -n --scan-delay 1s <ip range> -oG -
In Ubuntu 16.04, with Nmap 7.01, I'm getting different results from each scan.
In MacOS X 10.13.3, with Nmap ...
1
vote
1answer
318 views
Nmap scan for Operational Technology devices
I want to scan a range of network with nmap to discover hosts but I know that depending on the scan, it can affect the integrity of OT (Operational Technology) devices, industrial devices like PLCs (...
