Questions tagged [nmap]
A robust and open source security tool for network discovery and security auditing.
491
questions
0
votes
1answer
39 views
ncrack ssl option
There is the following option in ncrack (from the man page):
Misc options:
ssl: enable SSL over this service
ssl (Enable/Disable SSL over service)
By enabling SSL, Ncrack will try to open a TCP ...
1
vote
1answer
138 views
difference between icmp ping scan and normal ping scan
I'm learning to use nmap on my kali linux and was testing out the various types of scans available in it.
-sn is for ping scan which basically prevents nmap from scanning all the ports (and probably ...
0
votes
1answer
50 views
Fingerprinting Cisco ASA Device
I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host&...
0
votes
1answer
82 views
Blocking nginx from nmap version detection [duplicate]
Is there an efficient way to hide nginx from Nmap's Version Detection scan (nmap -sV)? The following is a sample result, we are trying to hide the nginx (reverse proxy) string.
PORT STATE SERVICE ...
0
votes
1answer
48 views
does Nmap automatically use proxychains if configured?
I have configured my proxy chains in /etc/proxychains.conf. Then when just run nmap or even nc without the proxychains prefix, it automatically uses the proxy chains and routes the traffic through the ...
0
votes
3answers
92 views
Scanning a domain name
When we scan a domain name such as www.nmap.org,
Question 1: We are actually scanning the server that the website is hosted on, right?
Question 2: If there is another domain hosted on the same server, ...
0
votes
1answer
671 views
How to resolve hostnames with nmap to perform scans?
I went through old threads on this forum and tried --resolve-all but it doesn't seem to work.
If I use nmap -sn <hostname> It throws an error Failed to resolve <hostname>
If I use nmap -sn ...
1
vote
0answers
77 views
False positives (port scanning) when using proxychains-ng with nmap [closed]
I get false positive ports that are marked open when using nmap with proxychains-ng (Using a proxy list that contains socks5 proxies). I've tried a couple of techniques to debug this strange behavior (...
0
votes
1answer
104 views
Nmap Scan Shows Filtered Ports for VNC, RDP, SAMBA & SSH on iOS - is this normal?
I ran an nmap scan on my iPad’s IP address and the results showed the following ports listed below available in a filtered state. See screenshot for the actual terminal results.
SSH
Netbios-ssn
ms-...
0
votes
3answers
248 views
Nmap shows different results when connected to VPN [closed]
I am trying to determine why nmap would show different results when I am connected to a VPN service.
When I am connected to Nord VPN, it shows two additional ports which do not seem to be open.
No VPN
...
2
votes
2answers
253 views
Why can I ping a server, but nmap normal scan cannot see the host?
I am able to ping a server on an vpn. However, when I use a normal nmap scan it does not pickup on the host. Doing a scan with host discovery turned off (nmap -Pn host scan) does show the host.
If I ...
0
votes
1answer
79 views
DDOS interrupted by nmap?
I discovered one of my machines was under an ssh DDOS attack when I was looking at logs to find out why my disk was slow. The auth log was about 90M, which is kind of unusual for this machine.
I ran ...
0
votes
0answers
38 views
nmap -sn different results than - sL (-sL shows missing host from -sn)
Executing nmap -sn 192.168.2.1/24 gives all hosts but 1 (192.168.2.116 just won’t show).
ping 192.168.2.116 works flawlessly.
Nmap -sL 192.168.2.1/24 shows all hosts also the missing 192.168.2.116 ...
0
votes
1answer
183 views
nmap to read ports from a file
I found this question and tried the solution given (accepted)
Can nmap take a list of ports to scan from a file?
However, it didn't really work as expected.
$ cat ports.list
21
22
23
25
$
Instead of ...
-1
votes
1answer
258 views
What’s the point in using proxychains for an nmap scan when you could use Tor?
I always hear on YouTube and other places on the internet that Tor is the best option to stay anonymous. Tor is used by many activists, journalists etc. hiding from oppressive governments and so on. ...
1
vote
0answers
27 views
nmap can only scan specific host [closed]
Nmap keeps telling me no hosts are up when I am using scanning with an IP range
Ive tried using sudo and 192.168.0.1/16 and the same results shows
ermine-c@ubuntu:~/Desktop$ nmap -sn 192.168.1.1-255
...
1
vote
1answer
293 views
How do I find the IP address of a specific device on the local network? [closed]
I would like to learn how to find the private IP address of anyone connected to a network.
This specific network has a firewall. The only info I have on it is that it blocks ICMP requests (I'm pretty ...
0
votes
1answer
107 views
Can changing your IP address prevent an NMap attack?
If an nmap attacker started a port scan on my network, would changing my network IP address prevent/halt it?
0
votes
1answer
134 views
How to use custom headers with nmap?
I am trying a bbp program, and they allow requests only with some custom headers. So I was wondering if it is possible to add custom headers to nmap requests.
Things I tried:
I tried using burp proxy. ...
0
votes
0answers
38 views
how to resolve initiating errors while running scripts with Rustscan Scripting Engine?
I wrote a one-liner shell script for rustscan which runs gobuster if port 80 is open.
I have added the script to /home/$USER/.rustscan_scripts directory.
The script looks like:
#!/bin/bash
#tags=[&...
1
vote
0answers
90 views
Unable to ping scan my machine (but I can ping)
I need to perform an nmap scan on all of the (responding) IPs in an array of VLANs.
The command is nested in a PowerShell for loop and looks something like this:
nmap.exe -Pn -T4 -A -oG [FILE].txt -oX ...
1
vote
3answers
110 views
nmap giving different scan results based on scan type
A quick and dirty nmap scan (nmap -p 1-65535 hostname) lists many ports as open. However, a more involved scan (nmap -T4 -A -sS -sU hostname) does not list the same ports as open. Some report as open, ...
1
vote
0answers
58 views
How to determine if an IP is up or down [closed]
I have an IP who I was told is down.
If I try to ping this IP, I can't reach it but if I launch nmap with -Pn option, I obtain that the IP is UP and that the 1720 port is open.
Do you think nmap is ...
1
vote
1answer
254 views
Penetration test on a infotainment system platform [closed]
I am pentesting an infotainment platform that is still under development. I did a nmap scan (for all ports with option -p-) of the platform and found a few open ports.
111/tcp open rpcbind
3490/tcp ...
2
votes
1answer
346 views
scan forwarded ports with OpenVAS/GVM?
I'm currently learning about network security and came across a problem, maybe I'm just missing something obvious but I'll try to explain my environment:
I have a Kali Linux VM connected to the WAN ...
0
votes
1answer
255 views
Can I elicit responses from "any remote host" on "all protocols" if I want to?
An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”.
After some research, this is something that can be exploited.
It is explained here that:
By default, WSDAPI will listen ...
0
votes
0answers
31 views
socks5 nmap scan [duplicate]
Does nmap support the following (-sS -sV -sC -O ) with a scan using socks5 proxy and if it is not what is the best way to scan linux system through a windows system ?
0
votes
1answer
115 views
How to find the IP address of a CCTV camera connected to laptop via ethernet [closed]
I'm trying to get the IP address of a CCTV camera and so far had no luck.
The device it's a Hikvision DS-2CD2042WD-I
I have connected it to a PoE switch, which is then connected to my laptop(Ubuntu 18....
0
votes
1answer
36 views
Would adding `--data-string` to a UDP scan change the results?
I'm doing UDP scans on some internal servers and want to add a custom token (randomly generated string) to packets as much as possible in order to later filter out my scans from real non-testing ...
1
vote
1answer
1k views
netcat vs nmap for banner grabbing?
I am preparing for a security exam and a question I failed in a practice has the following:
A command line tool that can be used for banner grabbing is called:
A) tcpdump
B) netcat
C) nmap
D) ...
0
votes
0answers
135 views
metasploit: run nmap on compromised host
I have just compromised a computer(legal in my local environment) and want to run nmap from that host to see further inside the network. I know I can use metasploit modules like "auxillary/...
1
vote
1answer
102 views
Service changing port when scanned with nmap [closed]
While scanning a host with nmap I have discovered an unusual service. The service moves to another port everytime I perform an nmap-scan or try to curl it. I have not yet found any info about similar ...
1
vote
0answers
45 views
nmap -oG X.X.X.0-255 doesn't work and all my ports closed ( expected list of open ports ) [closed]
I'm running kali Linux on VirtualBox. I ran sudo ifconfig to get my IP and subnet mask (X.X.X.15 and 255.255.255.0 for eth0)
I tried the command nmap -oG X.X.X.0-255 -vv but I got
Read data files ...
0
votes
1answer
54 views
Are there reasons to match the target port/service protocol when doing a scan?
I am pushing my way through some beginner level security readings and exercises (ECSA 1 & 2) without much of a networking background. I happened upon an interesting suggestion or command: to use ...
0
votes
1answer
337 views
Why do syn scans not work over proxy set up through SSH's dynamic port forwarding?
I have set up dynamic port forwarding using SSH. Although nmap scans over proxychains return accurate results, a SYN scan does not.
2
votes
4answers
6k views
If nmap shows all ports are filtered or closed, what would be the next logical step to take to get more information?
If nmap shows all ports are filtered or closed, what would be the next logical step to take?
Does that mean I would need to get physical access to the device? or is there any other ways to get ...
0
votes
1answer
134 views
Does Nmap use only one of the DNS servers specified in the --dns-server flag per host?
When I'm scanning with Nmap, I make an effort to get proper hostnames associated with the target IPs. To do this, I scan UDP 53 on the targets to identify DNS servers and then run something like the ...
0
votes
3answers
542 views
Is there any alternative to nmap for UDP?
I know UDP Scan is very slow and there are a lots of parameters for nmap like, --max-retries etc.
But i want to speedly udp port scan. I tried a lots of programs but not speedly. Any alternative nmap ...
0
votes
1answer
96 views
open relay test discrepancy
nmap smtp open relay test shows (verbose mode):
smtp-open-relay: Server is an open relay (2/16 tests)
MAIL FROM:<antispam@[xxx.xxx.xx.xx]> -> RCPT TO:<relaytest%nmap.scanme.org@XHS5P>
...
1
vote
2answers
1k views
The security of an SMB port exposed to the internet
I have installed a Windows machine with update 1909 (build 18363.720 (March 2020) (On which I try to find vulnerabilities with nmap), which includes smb 3.1.1 with the latest fixed bugs. I created a ...
1
vote
2answers
147 views
How to configure a port as filtered on server
With nmap you can see a live system's or server's open, closed, and filtered ports.
But how do you make it show as filtered when it is currently shown as open?
0
votes
2answers
628 views
Nmap scanning with and without proxychains has different behaviour
I'm doing a nmap scan to my own machine to my own machine. First of all I set the port 333 to listen with this command sudo nc -lvnp 333
On the other terminal I run sudo nmap -O -sV -p 0-65535 IP ...
0
votes
0answers
218 views
Host not connected to my router shows up in a nmap scan
After scanning my local network with nmap, this host shows up listed as a nmap result but it is the only host that shows on nmap that is not listed as a client on my router list of connected devices.
...
1
vote
2answers
1k views
nmap script "smb-os-discovery.nse" does not output information about the host OS?
I was following this Lynda course.
https://www.linkedin.com/learning/ethical-hacking-enumeration/enumerating-smb-from-linux-episode-1
The instructor used this script to detect the OS of the target ...
-2
votes
1answer
185 views
I think I may have DoS'ed a website accidentally
I had recently started using the nmap --script vuln option and I did try it on my own local router IP, which then crashed and we had to restart (coincidence?).
Then today I wanted to try it again, ...
0
votes
1answer
62 views
What scripts does nmap Option -A use?
Can anyone answer which scripts are used when the -A flag is used?
The answers I've found all point to the generic -A: Enables OS detection and Version detection, Script scanning and Traceroute. help ...
0
votes
2answers
1k views
nmap host up but reason = no-response
I have a strange situation.
My scanning machine is on networkA and target is on networkB.
Those networks are managed by IP pools in cisco ASA.
When I nmap the target with -Pn -sS --reason, I get as ...
0
votes
1answer
101 views
what is the link between server certificate and cipher list advertised by server for nmap command?
Nmap out put for google.com.
ssl-enum-ciphers.
TLSv1.2:
ciphers:
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A.
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A.
...
0
votes
0answers
85 views
Using nmap to detect realtime operating system
I would like to understand whether nmap can be used to detect the operating system type for realtime OS (Vxworks, threadx, free RTOS, etc.).
Has anyone done similar work before? Or if you have any ...
1
vote
1answer
3k views
How to only display open ports
I'm very new to Nmap. I'm using Nmap to find open ports of an IP by this command:
nmap -v -Pn -p 1-100 "$ip" -oG -
Here is the output:
Host: IP
Ports:
6/closed/tcp/unknown
19/closed/tcp/chargen
20/...
