Questions tagged [nmap]
A robust and open source security tool for network discovery and security auditing.
434
questions
-2
votes
0answers
35 views
NMAP makes the network unreachable [on hold]
While doing a SYN or TCP scan using Nmap, websites and the internet basically stops being reachable for a lengthy period of times, on all different devices for everyone. Is there a reason for this?
0
votes
1answer
62 views
nmap: Same IP, different domain names, different results?
I'm scanning a network (whose name will not be stated). It has >1 IP addresses. When I tried scanning its subdomains, there are several subdomains that are translated to the same IP address but return ...
-1
votes
0answers
48 views
NMAP to brute mssql from file (host:port format)
I want to brute mssql (Microsoft SQL Server) from a file as below:
192.168.1.8:14333
192.168.1.25:32070
192.168.2.74:14322
192.168.2.244:16001
192.168.4.5:17001
192.168.7.14:14535
....
How can I do ...
0
votes
0answers
21 views
Determining operating system of the host using python-nmap [migrated]
Until Python 3.4 you were able to determine target's operating system with
Python as follows:
import nmap
nm = nmap.PortScanner()
scanner = nm.scan(IP, port, arguments='-O')
print(scanner['scan'][IP]...
0
votes
1answer
57 views
Disabled Network Discovery for port 5357 but it still shows up as open in NMap scan
as mentioned in the title I have disabled Network Discovery for all of the 3 profiles yet when I run an NMap scan, the port comes up to be open. I have also run the command netstat -a -b to find the ...
0
votes
1answer
75 views
Nmap scan slow on some IP ranges [closed]
I'm a security newbie trying to scan a VPN in the range 10.0.0.0 - 10.0.15.254 using nmap on Kali Linux.
The routing table:
route -n
Kernel IP routing table
Destination Gateway Genmask ...
1
vote
0answers
46 views
Inbound rules for a port is configured and disabled yet an NMap scan shows that the port is opened
I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules.
As mentioned on the app, Inbound connections that do not match a rule are simply blocked.
For ...
0
votes
1answer
89 views
Firebase ports scanning using nmap
Purely for research purposes used nmap to check security of my application deployed to Firebase. However, there some questions which I can't understand:
Why Firebase has open so many ports? Something ...
2
votes
1answer
102 views
nmap scanning - What is the difference between -sP and -sn?
On the Nmap home page in my language, I can see -sP scan, but on the English version of the site, I can't see it. But I see -sn that looks very similar, I want to understand what's the difference.
0
votes
1answer
25 views
nmap xml file has only one row [closed]
I'm using Zenmap to discover some hosts. I save the scan as an nmap xml file. Then I import the xml file into excel to view the data.
There are thousands of rows of output in the Zenmap console, but ...
0
votes
1answer
84 views
Hardening against Nmap and other network scanners
It is possible to make Server respond with irrelevant data if it is scanned with Nmap? If yes, are there any examples of such SW?
0
votes
0answers
68 views
nmap gives different results in two shells on the same computer
I'm running kali and metasploitable2 in Virtualbox, and have them connected via the host-only networking mode. I can ping and ssh from kali to metasploitable, and have assigned the following IP ...
1
vote
0answers
88 views
NMAP not showing all live hosts
I have a live host on 192.168.0.151 on my local network. I know it's live since I've set it up with a static IP and also if pinged, I get a reply.
The weird thing is when I run nmap -sP 192.168.0....
0
votes
0answers
107 views
NMAP traceroute result
I am currently using the below command to find out to perform post-scan using information from the scan results to determine if i can use specific port (e.g. 113/tcp) to reach the target. But when i ...
0
votes
0answers
150 views
How to fingerprint Windows 10 reliably?
Recently, I have been practicing penetration testing and I have come to a standstill when trying to fingerprint the OS for a Windows 10 target with nmap.
For the most part, I'm not able to identify ...
2
votes
1answer
148 views
Why is scanning considered a pre-attack and not reconnaissance?
I am studying for a CEH certificate. I have a question about a simple quiz and a book that I am reading.
In the CEH book, it states that:
We can scan for a target using network tools (e.g. tarcert, ...
0
votes
1answer
96 views
Modified NMAP script: variable 'host' is not declared [closed]
I am modifying an nse script, ssl-cert.nse, which was already made for enumerating ssl certificates. I want to output the host ip and the port number in a line of the ssl certificate output. However, ...
0
votes
2answers
56 views
Test Hosts Available for NMAP Scanning? [closed]
Are there any known hosts online that make themselves available for port scanning in order to learn tools like NMAP? Thanks!
0
votes
1answer
107 views
What is the difference between probe and scan?
I'm struggling to understand the difference between probe and scan because they seem very similar. Does NMAP tool use probes and scans?
Could you give a practical example to make the theoretical ...
-1
votes
1answer
231 views
How to use Nmap as a port knocking client?
I want to use Nmap for port knocking on CTF machines, so I've read the manual for configuring it properly:
nmap <ip> -p <port1>,<port2>,... -r --max-retries 0 --max-parallelism 1
...
1
vote
1answer
372 views
nmap privilege escalation - is still a risk?
There is a known and popular technique to leverage nmap for privilege escalation if the suid bit is set for nmap.
One can execute nmap in interactive mode and from there execute bash commands in the ...
3
votes
1answer
790 views
Ports Showing Closed/Filtered in Nmap Scans
hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other ...
1
vote
1answer
185 views
Scanning multiple hosts with Nmap's Default Accounts NSE script not producing the expected result
I'm utilizing Nmap's default account credential scanner. I've built a couple of my own fingerprints and I've tested that the fingerprints work when scanning one host at a time.
Example command line ...
0
votes
2answers
106 views
How can I check what scripts are in Nmap's default category (`--script=default`)?
I know that the -sC and -A options run the "default" category of scripts (--script=default):
https://nmap.org/book/nse-usage.html
I've searched the nmap script folder for a default sub-folder, but ...
0
votes
2answers
292 views
Open ports on my NetGear router
I ran an nmap scan on my home router and I am seeing a ton of open ports. Is this normal? How do I go about closing them?
$ nmap 192.168.1.1
Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-16 20:...
-1
votes
1answer
233 views
how to check if remote host is running LDAP server?
I am currently pen-testing a remote website (its mine)
I would like to know if its possible to test if the web-server is running LDAP server.
I tried Nmap with no luck(it lists every port from 1 to ...
0
votes
1answer
98 views
<hostscript> tag missing in nse output for http-drupal-enum script [closed]
I use the ruby NMAP::XML class to pick apart the nse output from large scans but it expects the script output to be embedded in hostscript tags.
I have just started using http-drupal-enum script (in ...
1
vote
0answers
27 views
Nmap showing different open ports every few seconds [duplicate]
I'm running Nmap on an Amazon Web Services EC2 instance but between runs just a couple seconds apart, I'm getting new results. Is this normal? I'm seeing open ports then they don't show.
I'm running ...
0
votes
0answers
36 views
Is there any Nmap command/script to identify certificate name mismatch and untrusted certificate?
I am using Nmap commands in my script for server validation. I know in Nmap there is the ssl-cert.nse script that retrieves details about the server certificate. I want one more step where I find ...
1
vote
0answers
118 views
nmap - No Ports Open [closed]
I bought a Tonbux Smart WiFi Plug WL-SC01 and I'm doing some hack tests on it for educational purposes. I used nmap to check for both UDP and TCP ports but both return that there are no open ports at ...
3
votes
1answer
751 views
NMAP results inconsistent
I'm doing a NMAP scan that runs continuously. For some reason the results are not consistent. Sometimes it detects all the connected devices of the local network and sometimes only some of them.
...
1
vote
1answer
104 views
Nmap / Qualys say 3DES is available, but OpenSSL fails to connect
Running a Qualys scan showed that the IP was vulnerable to a Sweet32 attack, here is the output:
TLSv1 WITH 64-BIT CBC CIPHERS IS SUPPORTED
DES-CBC3-SHA RSA RSA SHA1 3DES(168)...
0
votes
1answer
51 views
Finding how many filtered ports of a host that would be listed as “filtered” on Nmap
I just started working on nmap and was confused by this question. I'm unsure if I understood it correctly, so I appreciate your help with this.
Using Nmap, find how many ports are filtered in testphp....
2
votes
2answers
347 views
nmap - Difference between “Filtered” and “Admin-Prohibited”
I am a rather new user to nmap. By using some Google-Fu, I am still not able to ascertain what is the criteria used in order to distinguish "filtered" ports from "admin-prohibited" as they both seem ...
1
vote
2answers
420 views
Is there a way to see if an nMap scan in the background is progressing?
I have launched an nMap scan from an Ubuntu machine with the following parameters:
nmap -Pn -T3 -sS -sV -iL /home/tsouser/Desktop/Scope.txt --reason --top-ports 100 --max_rtt_timeout 200ms --...
0
votes
0answers
200 views
Why nmap password scanner completes in 10 seconds and doesn't give any result?
I'm completely new to nmap and I'm trying to brute force passwords on a target. A command that I'm trying is:
nmap -p 80 --unprivileged --script http-form-brute <target>
But instead of "...
2
votes
2answers
190 views
Should ports be visible to nmap?
I'm currently working on the firewall when I discovered that the firewall exposes a lot of ports outside of the internal network. I discovered this when setting up a new FTP server using a basic nmap ...
0
votes
0answers
272 views
Telnet output with nmap
I made a scan on a server with nmap with these options : nmap -sT -A -P0 and this is the output for the telnet port (23) :
PORT STATE SERVICE VERSION
23/tcp open telnet
| fingerprint-strings: ...
1
vote
2answers
151 views
Nmap simultaneous scanning
Quick Nmap question. If there are X amount of ports per machine to scan and I want to scan 2 machines at once (no more no less), is there any way of forcing nmap to always be scanning 2 different ...
1
vote
2answers
527 views
Do I have to block UDP ports when I launch my own server with a public IP?
I am trying to give better security to my Raspberry sever. When I installed UFW, I allowed just port 80/tcp and my own high port for SSH communication, and by default are all others ports "deny".
...
2
votes
2answers
100 views
What exactly does a default port scan look like? I am trying to run a default port scan without setting off the ids on my test network
What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.
0
votes
1answer
231 views
NMAP NSE script stopping after 900 seconds (15 minutes)
I am experimenting with ssh bruteforce over my home network using the ssh-brute nse script. I have a short list of usernames (just 12) but a long list of passwords (1M).
I can't seem to get the ssh-...
2
votes
2answers
697 views
Nmap not following redirect when using “http-title” script
I am trying to scan a bunch of IPs for their http-title.
Now the problem I have is that nmap pretty much never follows any redirects.
Usually the title I want is behind that redirect though.
For ...
3
votes
1answer
226 views
How can Nmap bypass Windows Server firewall rules?
I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
1
vote
1answer
351 views
NMAP reporting all ports open
I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between.
I tried the SYN scan, and when I check the traffic in WireShark I see ...
1
vote
3answers
309 views
Nmap scanning single port too fast? Shows as filtered?
I ran into an issue when trying to scan a single port on a single machine. I ran a range scan to find machines with port 25 open. Then I just arbitrarily chose one to work on. I scan that machine with ...
-1
votes
1answer
699 views
NMAP - Terminate/stop scan on finding open port
Is there any command on nmap or on some other tool which will stop scan and move on to a different IP on finding a single open port?
Need to perform this for host discovery on few assets which has ...
2
votes
1answer
334 views
Nmap --script-args usage?
I'm trying to use multiple Nmap --script-args at the same time.
$ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com
...
1
vote
2answers
230 views
How to find and ban some devices from my wifi using the command line? [closed]
I use Arch Linux. I just installed some packages such as nmap, netdiscover and others. It is a ubiquiti internet network, for the sharing of connection to several routers. There are about 7 routers ...
-1
votes
1answer
175 views
What is the Difference between TCP Syn discovery and TCP ACK discovery in NMAP?
when im using nmap for network discovery , i dont understand theses options
PS
PA
PU
n
when i use -PS or PA or PU ? and what is the difference between them ?
@ref:
https://nmap.org/book/man-host-...
