Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

A robust and open source security tool for network discovery and security auditing.

2
votes
1answer
40 views

Nmap --script-args usage?

I'm trying to use multiple Nmap --script-args at the same time. $ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com ...
1
vote
2answers
127 views

How to find and ban some devices from my wifi using the command line? [closed]

I use Arch Linux. I just installed some packages such as nmap, netdiscover and others. It is a ubiquiti internet network, for the sharing of connection to several routers. There are about 7 routers ...
-1
votes
1answer
39 views

What is the Difference between TCP Syn discovery and TCP ACK discovery in NMAP?

when im using nmap for network discovery , i dont understand theses options PS PA PU n when i use -PS or PA or PU ? and what is the difference between them ? @ref: https://nmap.org/book/man-host-...
0
votes
0answers
15 views

Zenmap -pf output

We smart host all our mail via a third party that archives and sanitises all our inbound and outbound mail. We recently had a spam attack, where the web portal to a users mailbox on this 3rd party ...
-4
votes
1answer
131 views

VPN vs real IP address

Is it more secure to use a VPN that has open ports? 22/tcp open ssh 53/tcp open domain 80/tcp open http 110/tcp open pop3 443/tcp open https 500/tcp open isakmp 1723/tcp open pptp 4567/tcp ...
-1
votes
2answers
225 views

How to handle the virus on my router?

I believe my router is infected with a virus. If it is, it has been infected for a large period of time (perhaps a year or more). Though, I only started to consider it being a virus around a week ago. ...
2
votes
1answer
64 views

What port state to expect from Nmap when scanning ports that are open only to specific IP addresses

My firewall has a few ports open but traffic is only forwarded when coming from specific IP addresses (whitelisted). When scanning these ports with nmap from a non whitelisted IP address, what state ...
0
votes
1answer
49 views

List of all available nmap script arguments

I need to do a scan, for example with http-sql-injection.nse nmap script. I already know that I should use --script-args to set arguments, but my question is not about it. How can I look on the ...
0
votes
2answers
86 views

explain NMAP results

When I ran nmap -sn x.x.x.x/24 on a network behind Cisco ASA firewall I get 255 hosts up even though there are only three hosts on that subnet. If I run nmap -T4 -F x.x.x.x/24 I get all 254 IP ...
0
votes
0answers
30 views

How can I perform nmap scanning on a Windows virtual box

I am trying to do an Nmap scan to a Windows 2016 Server virtual machine from my host Windows 10 machine. I want to see the open ports in the virtual Windows machine. There is no problem with the ...
2
votes
1answer
70 views

Use Splunk to run Nmap scan from remote host to potential attacker

When receiving internal attacks, I'd like to utilize Splunk alerts to trigger an Nmap scan against that attacking host from a remote machine; one other than the Splunk server. Is there any API or ...
0
votes
2answers
66 views

Inconsistent list of hosts found by nmap pings from scan to scan - tcpdump shows ICMP echo replies did arrive

I'm running nmap periodically to monitor which hosts are in our server subnet: rm list; for i in $(seq 1 254) ; do echo 10.10.10.$i >> list ; done sudo nmap -oG - -PE -sn -iL list Most of the ...
1
vote
2answers
54 views

nmap -sn through proxychains fails

Why I can not do the following with nmap? proxychains nmap -A -v 10.185.11.0/24 Output: ProxyChains-3.1 (http://proxychains.sf.net) Starting Nmap 7.60 ( https://nmap.org ) at 2018-08-07 10:12 EEST ...
2
votes
0answers
250 views

What is RTTVAR in NMap? [closed]

I find a lot of sources explaining how to get rid of the following message: RTTVAR has grown to over 2.3 seconds, decreasing to 2.0 But What exactly is RTTVAR(Round Trip Time Variance)? What is ...
0
votes
2answers
90 views

Verify whether the IP address is SQL Server

Is a network scan the only way to know if an IP address is a SQL server? How can I verify this 100%?
0
votes
0answers
18 views

NMAP multiple IP scanning (specifying ports for every ip) [duplicate]

I am using nmap for daily monitoring the network service and open ports status, i wrote a bash script that scans a range of ip and ndiff the output with previous scans, and make it as a daily cronjob. ...
0
votes
0answers
70 views

All smartphone ports filtered - how to scan smartphones on local Wifi?

I am using Nmap and scanning my smartphone (LG G5 - Android) on my local network and practicing trying to gain remote access into it. However, whenever I scan my cellphone, either all ports are closed ...
9
votes
3answers
433 views

What are some instant red flags when scanning an network with nmap

When doing an Nmap scan from an external network, what open ports should be an instant red flag? For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
0
votes
1answer
167 views

What -sn -Pn does in Nmap?

-sn: It tells the nmap not to do any Port Scan. -Pn: It tells the nmap not to do any Ping Scan. Now when I use both together like this, nmap -sn -Pn host.com. What I saw in the terminal is Nmap ...
0
votes
2answers
58 views

Internal IP's Probing to Unknown External IP's

I recently took a CEH class and they mentioned checking for internal IP's probing to External unknown IP's to determine an attack. What would be the best way to gather and analyze these types of ...
1
vote
1answer
85 views

nmap not showing closed ports

When I running the command nmap -p 443 -iL ip.txt It only shows IP addresses with open ports in the output, but does not show IP addresses with closed ports. How can I see the closed ports/IPs.
1
vote
3answers
173 views

NMAP to scan ip and ports from file

I want to scan IP and port from a file as below: 192.168.1.2 443 192.168.2.100 8443 192.168.3.99 80 192.168.4.11 443 How can I do that? I know there is option to take IP from a file using -iL but ...
1
vote
1answer
38 views

is -nU an option with nmap?

My coworkers seem to have -nU (no udp) as an option for their nmap scripts but I've never seen this in use and when I try to use this option with nmap, it does not work. I thought no udp was enabled ...
0
votes
2answers
190 views

No output from nmap script

I'm trying to use the nmap script ssl-dh-params to identify what specific 1024-bit Diffie-Hellman group a TLS server is using. However, the script is not giving me any output at all and I can't ...
0
votes
0answers
32 views

Nmap scan results different when specifying port

Does anyone know how this happened? I use nmap [ip address] The result shows port 21 is open. But when I use nmap -p 21 [ip address] the result shows port 21 is filtered.
3
votes
2answers
70 views

Nmap and it default scripts when I already know some of the information

I am a network guy and not a “hacker” or whatever the official term is these days. I’ve been learning how to use nmap as I think it’s a great tool for just keeping the network secure. The thing is ...
1
vote
1answer
95 views

Nmap HeartBleed script does not seem to work over non-standard ports

The Nmap script for HeartBleed (using Nmap v7.40) seems to work only over known ports. Whenever a non-standard port is used, the script does not report anything. nmap -p 46000 --script ssl-heartbleed ...
0
votes
0answers
123 views

What are all of these IPs addresses? Honeypots?

I was scanning my network (192.168.0.1-100) and I found many IP addresses that are not mine nor known, around 800 of them. I guess it has something to do with the ISP. After scanning the ips with nmap ...
1
vote
2answers
114 views

nmap finger print looks alot like shell code and not what's on nmap.org

my concern is the finger print at the end could someone please explain what it is, thanks (looks like a nop sled and buffer overflow ) bash >> nmap -sS -sU -T4 -A -v 192.168.50.1 Nmap scan report ...
-1
votes
2answers
197 views

Multiple Open ports on a server , is that safe? [closed]

Using nmap I try to scan a server as a result I get multiple open ports. For example when I try to scan domain.com as a result : 7/tcp open echo 9/tcp open discard 13/tcp open daytime 21/tcp ...
1
vote
2answers
358 views

Xmas Scan Versus FIN Scan

While studying Nmap, I came across different port scans. Out of these XMAS and FIN scan caught my interest. Though XMAS scan sends FIN, URG and RST flags, the response is the same as that of a FIN ...
0
votes
2answers
222 views

nmap traceroute shows only one hop regardless of target

I'm using Zenmap to map out the network topology of the company I'm working in. When I ran the following command to trace route how my system connects to the internet but Zenmap only shows me a single ...
1
vote
0answers
43 views

network ports are filtered strangely?

I have some Ubuntu servers deployed in VULTR Global Cloud and I have about 300 network ports each server. However, every server will be filtered in China suddenly (I can ping from China). I use nmap ...
-1
votes
1answer
79 views

What are some IDS/IPS that are able to detect stealth scans done in nmap today? [closed]

I was informed that these scans are no longer "stealth"
0
votes
1answer
154 views

Find out the IP or hostname of the firewall? [closed]

Is there a way to find the IP of the firewall which is blocking my access to an endpoint? I tried netcat / nmap but not much luck. I need some form of a tool which does a traceroute to the subnet or ...
3
votes
1answer
339 views

Clarifications regarding ciphers and Nmap scan

I'm running the below Nmap command to test the strength of the cipher suites I have used in my host nmap -sV --script ssl-enum-ciphers -p 443 <host> The Nmap doc says that Each ciphersuite is ...
1
vote
1answer
125 views

How to control the ciphersuites in nmap “ssl-enum-ciphers”

There is a script for enumerating the TLS versions and ciphersuites ofered by a server provided by nmap. See this link. Is there a way that allow me to specify the verisions and ciphersuites I want ...
1
vote
1answer
84 views

Why so many restransmissions on Nmap?

I executed the following code: sudo nmap -sT -Pn --max-parallelism 1 --max-retries 0 -p5481,10212,19999,2308,102 192.168.0.19 192.168.0.20 And when I analyzed the scan on Wireshark, I saw this: I ...
0
votes
0answers
56 views

Unable to run Metasploit scripts on a mysql server for authorized penetration testing

I am taking a course in penetration testing and I was provided with a virtual environment to pen test. I was provided with a vpn for my CC server and i am able to ping the host which was found to run ...
0
votes
1answer
107 views

Why I recived user-set on my Nmap analyze?

I executed this command: nmap -sn -n --scan-delay 1s --max-retries 0 -Pn --packet-trace --reason <IP> And I received this response: Host is up, received user-set. It seems that Nmap thinks ...
0
votes
1answer
118 views

Does nmap mtu scan really send crafted mtu size?

Since nmap is a well-known security tools, I guess this is the right section. I've been reading about nmap techniques here as part of my network security syllabus ... I've performed 2 scans ... one ...
1
vote
0answers
71 views

Why ever “trust” Nmap's reverse lookup for system hostname when doing host discovery?

Quick question. I was scanning a lab network with Nmap just doing host discovery to see what hosts were out there. I got a list of hosts, ips, hostnames, ports open, services, etc. Upon further ...
0
votes
2answers
69 views

How can I disable double request for detected port in Nmap?

When I execute this command: nmap -sT -p 5481,10212,19999,2308,102,502,20000,2000,44818,2222,47808,18246,910,912,1974,8086,8087,12397,12399,12401,20222,22202,46824,5002,802,27700,2869 --scan-delay 1s ...
0
votes
1answer
211 views

Modify Win OS banner to avoid OS detection

I would like to modify Win OS banner to defeat OS detection from scanning tools like Nmap for example. Although, I know that Nmap does not take into account just the banner to do OS detection.
4
votes
1answer
638 views

NMAP - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why NMAP decides to ...
5
votes
1answer
715 views

Connection to ports 2000 and 5060 successful despite filtering

I run my own (Ubuntu based) router and have iptables configured to drop all incoming packets by default. To my surprise, running an nmap scan (from the WAN side) shows two open ports related to VOIP: ...
0
votes
2answers
105 views

Nmap - Inconsistent Port Response

What could be the possible reason(s) of scanning a port and getting an open (syn-ack) response and then getting a closed (rst) response within a small timeframe. Starting Nmap 7.25BETA1 ( https://...
0
votes
1answer
183 views

ufw and nmap show different result in terms of open ports

I have set my firewall ufw / firewall rules as follows: Default: deny (incoming), allow (outgoing), disabled (routed) To Action From -- ...
0
votes
1answer
112 views

Different Nmap results on MacOS and Ubuntu 16.04

I did a Nmap scan with this command: nmap -sn -n --scan-delay 1s <ip range> -oG - In Ubuntu 16.04, with Nmap 7.01, I'm getting different results from each scan. In MacOS X 10.13.3, with Nmap ...
1
vote
1answer
318 views

Nmap scan for Operational Technology devices

I want to scan a range of network with nmap to discover hosts but I know that depending on the scan, it can affect the integrity of OT (Operational Technology) devices, industrial devices like PLCs (...