Questions tagged [nmap]
A robust and open source security tool for network discovery and security auditing.
504
questions
0
votes
0
answers
7
views
Exploit failed: NoMethodError undefined method `smtp_send_recv'
I was playing around with an old server (probably pre 2017) and I was running the following metasploit module: msf6 exploit(linux/smtp/exim4_dovecot_exec)
However, after setting the LHOST (0.0.0.0), ...
0
votes
0
answers
39
views
nmap scanning Raspbian with strange results
I'm a high schooler in a CyberDefense Class and we are learning to PenTest.
I'm on Red Team and my teacher set up a system with Rasbian as the OS. When I run a scan on the computer scanning the Top ...
- 1
0
votes
0
answers
36
views
How to detect a firewall used
I was scanning a network with Nmap.
I'm looking for advanced commands for detecting firewalls.
3
votes
2
answers
554
views
How do you scan multiple subnets using Nmap?
I'm looking to scan a network with multiple subnets. I'm looking for a way to shorten this to one command rather than entering each subnet. So let's say I'm try to scan 192.168.1.xx, 192.168.2.xx and ...
- 41
0
votes
1
answer
34
views
nmap -p- command usage
I apologize if this is a very commonly asked question but I just need confirmation on something. I am going through my eJPT certification right now and I just want to know when I run nmap -p- <ip ...
- 1
3
votes
1
answer
51
views
How are nmap arp pings implemented?
Nmap issues the raw ARP requests and handles retransmission and
timeout periods at its own discretion
The above is how nmap describes arp pings, but how is a layer 2 concept returned to the sender (...
- 33
1
vote
0
answers
34
views
How to evaluate a responsive but unknown network protocol?
I am studying CREST CPSA where the syllabus is listed here.
There is a part of the syllabus which states I should know the Evaluation of responsive but unknown network applications.
I find this ...
- 327
2
votes
0
answers
92
views
Windows XP SP3 2002 is not vulnerable to MS08-067
Why is my VM not vulnerable to MS08-067?
There are similar question on stack exchange, yes, but they fail to specify all relevant information and so non receive a meaningful, thoughtful nor thorough ...
0
votes
0
answers
21
views
Is NMAP UDP scanning for IPV6 fully supported and mature?
When I read the docs on nmap.org about UDP support for IPV6 on nmap site I notice that "UDP is not supported". I know that the syntax is there, but when I run a scan against a target that is ...
- 375
1
vote
1
answer
101
views
Why when i nmap scan a machine i get the port 554 (RTSP) open?
I train on vulnerable boxes and during my recon phase, I use nmap to collect info on open ports.
I use the command nmap -sS [IP|URL] and no matter the machine, I get the result that port 554 - RTSP ...
- 11
1
vote
1
answer
97
views
What are the drawbacks of a stealthy port scan?
I read that port scanning services like nmap will conduct a "TCP Connect Scan". They'll attempt to make a TCP connection to each of the ports within the range provided. But because each of ...
- 13
0
votes
1
answer
127
views
Nmap returns both, mysql and mariadb versions, how do I khow which one is actually running?
I ran nmap scan and output included following line:
3306/tcp open mysql MySQL 5.5.5-10.3.25-MariaDB-0+deb10u1
How do I know which one is actually running, MySQL or MariaDB?
1
vote
2
answers
80
views
What is the value of port knocking when I have strict firewall rules
I have specifically allowed three external machines to SSH into my server. All other traffic will be dropped. Using nmap from another machine, I am unable to see my server's SSH port and it shows ...
- 21
0
votes
0
answers
18
views
Bypass time limitation of OpenSSH when using Nmap [duplicate]
Terminal command:
$ nmap 10.10.244.76 -p 22 --script ssh-brute \
--script-args userdb=trash.txt,passdb=rockyou.list,timeout=4s
NSE: [ssh-brute] usernames: Time limit 15m00s exceeded.
NSE: [ssh-...
0
votes
0
answers
31
views
How to configure Snort 3 to detect nmap's port scanning? [duplicate]
How to configure snort 3 to detect nmap's port scanning? For instance I want to know that an external machine A is looking with nmap for open ports on my machine B.
Such a port scan can include all ...
- 1
0
votes
1
answer
103
views
ncrack ssl option
There is the following option in ncrack (from the man page):
Misc options:
ssl: enable SSL over this service
ssl (Enable/Disable SSL over service)
By enabling SSL, Ncrack will try to open a TCP ...
- 210
1
vote
1
answer
469
views
difference between icmp ping scan and normal ping scan
I'm learning to use nmap on my kali linux and was testing out the various types of scans available in it.
-sn is for ping scan which basically prevents nmap from scanning all the ports (and probably ...
- 13
0
votes
1
answer
127
views
Fingerprinting Cisco ASA Device
I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host&...
- 3
0
votes
1
answer
188
views
Blocking nginx from nmap version detection [duplicate]
Is there an efficient way to hide nginx from Nmap's Version Detection scan (nmap -sV)? The following is a sample result, we are trying to hide the nginx (reverse proxy) string.
PORT STATE SERVICE ...
- 3
1
vote
1
answer
111
views
does Nmap automatically use proxychains if configured?
I have configured my proxy chains in /etc/proxychains.conf. Then when just run nmap or even nc without the proxychains prefix, it automatically uses the proxy chains and routes the traffic through the ...
- 31
0
votes
3
answers
489
views
Scanning a domain name
When we scan a domain name such as www.nmap.org,
Question 1: We are actually scanning the server that the website is hosted on, right?
Question 2: If there is another domain hosted on the same server, ...
0
votes
1
answer
2k
views
How to resolve hostnames with nmap to perform scans?
I went through old threads on this forum and tried --resolve-all but it doesn't seem to work.
If I use nmap -sn <hostname> It throws an error Failed to resolve <hostname>
If I use nmap -sn ...
- 1
1
vote
0
answers
182
views
False positives (port scanning) when using proxychains-ng with nmap [closed]
I get false positive ports that are marked open when using nmap with proxychains-ng (Using a proxy list that contains socks5 proxies). I've tried a couple of techniques to debug this strange behavior (...
- 11
0
votes
1
answer
371
views
Nmap Scan Shows Filtered Ports for VNC, RDP, SAMBA & SSH on iOS - is this normal?
I ran an nmap scan on my iPad’s IP address and the results showed the following ports listed below available in a filtered state. See screenshot for the actual terminal results.
SSH
Netbios-ssn
ms-...
0
votes
3
answers
790
views
Nmap shows different results when connected to VPN [closed]
I am trying to determine why nmap would show different results when I am connected to a VPN service.
When I am connected to Nord VPN, it shows two additional ports which do not seem to be open.
No VPN
...
- 101
3
votes
2
answers
727
views
Why can I ping a server, but nmap normal scan cannot see the host?
I am able to ping a server on an vpn. However, when I use a normal nmap scan it does not pickup on the host. Doing a scan with host discovery turned off (nmap -Pn host scan) does show the host.
If I ...
- 133
0
votes
1
answer
218
views
DDOS interrupted by nmap?
I discovered one of my machines was under an ssh DDOS attack when I was looking at logs to find out why my disk was slow. The auth log was about 90M, which is kind of unusual for this machine.
I ran ...
- 109
0
votes
1
answer
443
views
nmap to read ports from a file
I found this question and tried the solution given (accepted)
Can nmap take a list of ports to scan from a file?
However, it didn't really work as expected.
$ cat ports.list
21
22
23
25
$
Instead of ...
- 347
-1
votes
1
answer
478
views
What’s the point in using proxychains for an nmap scan when you could use Tor?
I always hear on YouTube and other places on the internet that Tor is the best option to stay anonymous. Tor is used by many activists, journalists etc. hiding from oppressive governments and so on. ...
1
vote
0
answers
91
views
nmap can only scan specific host [closed]
Nmap keeps telling me no hosts are up when I am using scanning with an IP range
Ive tried using sudo and 192.168.0.1/16 and the same results shows
ermine-c@ubuntu:~/Desktop$ nmap -sn 192.168.1.1-255
...
- 19
1
vote
1
answer
421
views
How do I find the IP address of a specific device on the local network? [closed]
I would like to learn how to find the private IP address of anyone connected to a network.
This specific network has a firewall. The only info I have on it is that it blocks ICMP requests (I'm pretty ...
- 151
0
votes
1
answer
178
views
Can changing your IP address prevent an NMap attack?
If an nmap attacker started a port scan on my network, would changing my network IP address prevent/halt it?
0
votes
1
answer
321
views
How to use custom HTTP headers with nmap?
I am trying a bbp program, and they allow requests only with some custom headers. So I was wondering if it is possible to add custom headers to nmap requests.
Things I tried:
I tried using burp proxy. ...
- 217
0
votes
0
answers
80
views
how to resolve initiating errors while running scripts with Rustscan Scripting Engine?
I wrote a one-liner shell script for rustscan which runs gobuster if port 80 is open.
I have added the script to /home/$USER/.rustscan_scripts directory.
The script looks like:
#!/bin/bash
#tags=[&...
1
vote
0
answers
192
views
Unable to ping scan my machine (but I can ping)
I need to perform an nmap scan on all of the (responding) IPs in an array of VLANs.
The command is nested in a PowerShell for loop and looks something like this:
nmap.exe -Pn -T4 -A -oG [FILE].txt -oX ...
- 11
1
vote
3
answers
254
views
nmap giving different scan results based on scan type
A quick and dirty nmap scan (nmap -p 1-65535 hostname) lists many ports as open. However, a more involved scan (nmap -T4 -A -sS -sU hostname) does not list the same ports as open. Some report as open, ...
- 13
1
vote
0
answers
106
views
How to determine if an IP is up or down [closed]
I have an IP who I was told is down.
If I try to ping this IP, I can't reach it but if I launch nmap with -Pn option, I obtain that the IP is UP and that the 1720 port is open.
Do you think nmap is ...
- 107
1
vote
1
answer
378
views
Penetration test on a infotainment system platform [closed]
I am pentesting an infotainment platform that is still under development. I did a nmap scan (for all ports with option -p-) of the platform and found a few open ports.
111/tcp open rpcbind
3490/tcp ...
- 111
2
votes
1
answer
598
views
scan forwarded ports with OpenVAS/GVM?
I'm currently learning about network security and came across a problem, maybe I'm just missing something obvious but I'll try to explain my environment:
I have a Kali Linux VM connected to the WAN ...
- 23
0
votes
1
answer
388
views
Can I elicit responses from "any remote host" on "all protocols" if I want to?
An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”.
After some research, this is something that can be exploited.
It is explained here that:
By default, WSDAPI will listen ...
- 11
0
votes
0
answers
47
views
socks5 nmap scan [duplicate]
Does nmap support the following (-sS -sV -sC -O ) with a scan using socks5 proxy and if it is not what is the best way to scan linux system through a windows system ?
- 27
0
votes
1
answer
205
views
How to find the IP address of a CCTV camera connected to laptop via ethernet [closed]
I'm trying to get the IP address of a CCTV camera and so far had no luck.
The device it's a Hikvision DS-2CD2042WD-I
I have connected it to a PoE switch, which is then connected to my laptop(Ubuntu 18....
- 21
0
votes
1
answer
87
views
Would adding `--data-string` to a UDP scan change the results?
I'm doing UDP scans on some internal servers and want to add a custom token (randomly generated string) to packets as much as possible in order to later filter out my scans from real non-testing ...
- 3,502
1
vote
1
answer
1k
views
netcat vs nmap for banner grabbing?
I am preparing for a security exam and a question I failed in a practice has the following:
A command line tool that can be used for banner grabbing is called:
A) tcpdump
B) netcat
C) nmap
D) ...
- 13
0
votes
0
answers
226
views
metasploit: run nmap on compromised host
I have just compromised a computer(legal in my local environment) and want to run nmap from that host to see further inside the network. I know I can use metasploit modules like "auxillary/...
1
vote
1
answer
163
views
Service changing port when scanned with nmap [closed]
While scanning a host with nmap I have discovered an unusual service. The service moves to another port everytime I perform an nmap-scan or try to curl it. I have not yet found any info about similar ...
- 11
1
vote
0
answers
94
views
nmap -oG X.X.X.0-255 doesn't work and all my ports closed ( expected list of open ports ) [closed]
I'm running kali Linux on VirtualBox. I ran sudo ifconfig to get my IP and subnet mask (X.X.X.15 and 255.255.255.0 for eth0)
I tried the command nmap -oG X.X.X.0-255 -vv but I got
Read data files ...
0
votes
1
answer
89
views
Are there reasons to match the target port/service protocol when doing a scan?
I am pushing my way through some beginner level security readings and exercises (ECSA 1 & 2) without much of a networking background. I happened upon an interesting suggestion or command: to use ...
- 103
0
votes
1
answer
667
views
Why do syn scans not work over proxy set up through SSH's dynamic port forwarding?
I have set up dynamic port forwarding using SSH. Although nmap scans over proxychains return accurate results, a SYN scan does not.
3
votes
4
answers
9k
views
If nmap shows all ports are filtered or closed, what would be the next logical step to take to get more information?
If nmap shows all ports are filtered or closed, what would be the next logical step to take?
Does that mean I would need to get physical access to the device? or is there any other ways to get ...
- 39