Questions tagged [nmap]

A robust and open source security tool for network discovery and security auditing.

Filter by
Sorted by
Tagged with
0 votes
0 answers
7 views

Exploit failed: NoMethodError undefined method `smtp_send_recv'

I was playing around with an old server (probably pre 2017) and I was running the following metasploit module: msf6 exploit(linux/smtp/exim4_dovecot_exec) However, after setting the LHOST (0.0.0.0), ...
user avatar
0 votes
0 answers
39 views

nmap scanning Raspbian with strange results

I'm a high schooler in a CyberDefense Class and we are learning to PenTest. I'm on Red Team and my teacher set up a system with Rasbian as the OS. When I run a scan on the computer scanning the Top ...
user avatar
0 votes
0 answers
36 views

How to detect a firewall used

I was scanning a network with Nmap. I'm looking for advanced commands for detecting firewalls.
user avatar
3 votes
2 answers
554 views

How do you scan multiple subnets using Nmap?

I'm looking to scan a network with multiple subnets. I'm looking for a way to shorten this to one command rather than entering each subnet. So let's say I'm try to scan 192.168.1.xx, 192.168.2.xx and ...
user avatar
0 votes
1 answer
34 views

nmap -p- command usage

I apologize if this is a very commonly asked question but I just need confirmation on something. I am going through my eJPT certification right now and I just want to know when I run nmap -p- <ip ...
user avatar
3 votes
1 answer
51 views

How are nmap arp pings implemented?

Nmap issues the raw ARP requests and handles retransmission and timeout periods at its own discretion The above is how nmap describes arp pings, but how is a layer 2 concept returned to the sender (...
user avatar
1 vote
0 answers
34 views

How to evaluate a responsive but unknown network protocol?

I am studying CREST CPSA where the syllabus is listed here. There is a part of the syllabus which states I should know the Evaluation of responsive but unknown network applications. I find this ...
user avatar
2 votes
0 answers
92 views

Windows XP SP3 2002 is not vulnerable to MS08-067

Why is my VM not vulnerable to MS08-067? There are similar question on stack exchange, yes, but they fail to specify all relevant information and so non receive a meaningful, thoughtful nor thorough ...
user avatar
0 votes
0 answers
21 views

Is NMAP UDP scanning for IPV6 fully supported and mature?

When I read the docs on nmap.org about UDP support for IPV6 on nmap site I notice that "UDP is not supported". I know that the syntax is there, but when I run a scan against a target that is ...
user avatar
1 vote
1 answer
101 views

Why when i nmap scan a machine i get the port 554 (RTSP) open?

I train on vulnerable boxes and during my recon phase, I use nmap to collect info on open ports. I use the command nmap -sS [IP|URL] and no matter the machine, I get the result that port 554 - RTSP ...
user avatar
1 vote
1 answer
97 views

What are the drawbacks of a stealthy port scan?

I read that port scanning services like nmap will conduct a "TCP Connect Scan". They'll attempt to make a TCP connection to each of the ports within the range provided. But because each of ...
user avatar
0 votes
1 answer
127 views

Nmap returns both, mysql and mariadb versions, how do I khow which one is actually running?

I ran nmap scan and output included following line: 3306/tcp open mysql MySQL 5.5.5-10.3.25-MariaDB-0+deb10u1 How do I know which one is actually running, MySQL or MariaDB?
user avatar
1 vote
2 answers
80 views

What is the value of port knocking when I have strict firewall rules

I have specifically allowed three external machines to SSH into my server. All other traffic will be dropped. Using nmap from another machine, I am unable to see my server's SSH port and it shows ...
user avatar
0 votes
0 answers
18 views

Bypass time limitation of OpenSSH when using Nmap [duplicate]

Terminal command: $ nmap 10.10.244.76 -p 22 --script ssh-brute \ --script-args userdb=trash.txt,passdb=rockyou.list,timeout=4s NSE: [ssh-brute] usernames: Time limit 15m00s exceeded. NSE: [ssh-...
user avatar
0 votes
0 answers
31 views

How to configure Snort 3 to detect nmap's port scanning? [duplicate]

How to configure snort 3 to detect nmap's port scanning? For instance I want to know that an external machine A is looking with nmap for open ports on my machine B. Such a port scan can include all ...
user avatar
  • 1
0 votes
1 answer
103 views

ncrack ssl option

There is the following option in ncrack (from the man page): Misc options: ssl: enable SSL over this service ssl (Enable/Disable SSL over service) By enabling SSL, Ncrack will try to open a TCP ...
user avatar
1 vote
1 answer
469 views

difference between icmp ping scan and normal ping scan

I'm learning to use nmap on my kali linux and was testing out the various types of scans available in it. -sn is for ping scan which basically prevents nmap from scanning all the ports (and probably ...
user avatar
0 votes
1 answer
127 views

Fingerprinting Cisco ASA Device

I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host&...
user avatar
  • 3
0 votes
1 answer
188 views

Blocking nginx from nmap version detection [duplicate]

Is there an efficient way to hide nginx from Nmap's Version Detection scan (nmap -sV)? The following is a sample result, we are trying to hide the nginx (reverse proxy) string. PORT STATE SERVICE ...
user avatar
1 vote
1 answer
111 views

does Nmap automatically use proxychains if configured?

I have configured my proxy chains in /etc/proxychains.conf. Then when just run nmap or even nc without the proxychains prefix, it automatically uses the proxy chains and routes the traffic through the ...
user avatar
  • 31
0 votes
3 answers
489 views

Scanning a domain name

When we scan a domain name such as www.nmap.org, Question 1: We are actually scanning the server that the website is hosted on, right? Question 2: If there is another domain hosted on the same server, ...
user avatar
0 votes
1 answer
2k views

How to resolve hostnames with nmap to perform scans?

I went through old threads on this forum and tried --resolve-all but it doesn't seem to work. If I use nmap -sn <hostname> It throws an error Failed to resolve <hostname> If I use nmap -sn ...
user avatar
  • 1
1 vote
0 answers
182 views

False positives (port scanning) when using proxychains-ng with nmap [closed]

I get false positive ports that are marked open when using nmap with proxychains-ng (Using a proxy list that contains socks5 proxies). I've tried a couple of techniques to debug this strange behavior (...
user avatar
0 votes
1 answer
371 views

Nmap Scan Shows Filtered Ports for VNC, RDP, SAMBA & SSH on iOS - is this normal?

I ran an nmap scan on my iPad’s IP address and the results showed the following ports listed below available in a filtered state. See screenshot for the actual terminal results. SSH Netbios-ssn ms-...
user avatar
0 votes
3 answers
790 views

Nmap shows different results when connected to VPN [closed]

I am trying to determine why nmap would show different results when I am connected to a VPN service. When I am connected to Nord VPN, it shows two additional ports which do not seem to be open. No VPN ...
user avatar
  • 101
3 votes
2 answers
727 views

Why can I ping a server, but nmap normal scan cannot see the host?

I am able to ping a server on an vpn. However, when I use a normal nmap scan it does not pickup on the host. Doing a scan with host discovery turned off (nmap -Pn host scan) does show the host. If I ...
user avatar
0 votes
1 answer
218 views

DDOS interrupted by nmap?

I discovered one of my machines was under an ssh DDOS attack when I was looking at logs to find out why my disk was slow. The auth log was about 90M, which is kind of unusual for this machine. I ran ...
user avatar
  • 109
0 votes
1 answer
443 views

nmap to read ports from a file

I found this question and tried the solution given (accepted) Can nmap take a list of ports to scan from a file? However, it didn't really work as expected. $ cat ports.list 21 22 23 25 $ Instead of ...
user avatar
  • 347
-1 votes
1 answer
478 views

What’s the point in using proxychains for an nmap scan when you could use Tor?

I always hear on YouTube and other places on the internet that Tor is the best option to stay anonymous. Tor is used by many activists, journalists etc. hiding from oppressive governments and so on. ...
user avatar
1 vote
0 answers
91 views

nmap can only scan specific host [closed]

Nmap keeps telling me no hosts are up when I am using scanning with an IP range Ive tried using sudo and 192.168.0.1/16 and the same results shows ermine-c@ubuntu:~/Desktop$ nmap -sn 192.168.1.1-255 ...
user avatar
  • 19
1 vote
1 answer
421 views

How do I find the IP address of a specific device on the local network? [closed]

I would like to learn how to find the private IP address of anyone connected to a network. This specific network has a firewall. The only info I have on it is that it blocks ICMP requests (I'm pretty ...
user avatar
0 votes
1 answer
178 views

Can changing your IP address prevent an NMap attack?

If an nmap attacker started a port scan on my network, would changing my network IP address prevent/halt it?
user avatar
0 votes
1 answer
321 views

How to use custom HTTP headers with nmap?

I am trying a bbp program, and they allow requests only with some custom headers. So I was wondering if it is possible to add custom headers to nmap requests. Things I tried: I tried using burp proxy. ...
user avatar
0 votes
0 answers
80 views

how to resolve initiating errors while running scripts with Rustscan Scripting Engine?

I wrote a one-liner shell script for rustscan which runs gobuster if port 80 is open. I have added the script to /home/$USER/.rustscan_scripts directory. The script looks like: #!/bin/bash #tags=[&...
user avatar
1 vote
0 answers
192 views

Unable to ping scan my machine (but I can ping)

I need to perform an nmap scan on all of the (responding) IPs in an array of VLANs. The command is nested in a PowerShell for loop and looks something like this: nmap.exe -Pn -T4 -A -oG [FILE].txt -oX ...
user avatar
  • 11
1 vote
3 answers
254 views

nmap giving different scan results based on scan type

A quick and dirty nmap scan (nmap -p 1-65535 hostname) lists many ports as open. However, a more involved scan (nmap -T4 -A -sS -sU hostname) does not list the same ports as open. Some report as open, ...
user avatar
1 vote
0 answers
106 views

How to determine if an IP is up or down [closed]

I have an IP who I was told is down. If I try to ping this IP, I can't reach it but if I launch nmap with -Pn option, I obtain that the IP is UP and that the 1720 port is open. Do you think nmap is ...
user avatar
  • 107
1 vote
1 answer
378 views

Penetration test on a infotainment system platform [closed]

I am pentesting an infotainment platform that is still under development. I did a nmap scan (for all ports with option -p-) of the platform and found a few open ports. 111/tcp open rpcbind 3490/tcp ...
user avatar
  • 111
2 votes
1 answer
598 views

scan forwarded ports with OpenVAS/GVM?

I'm currently learning about network security and came across a problem, maybe I'm just missing something obvious but I'll try to explain my environment: I have a Kali Linux VM connected to the WAN ...
user avatar
  • 23
0 votes
1 answer
388 views

Can I elicit responses from "any remote host" on "all protocols" if I want to?

An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”. After some research, this is something that can be exploited. It is explained here that: By default, WSDAPI will listen ...
user avatar
0 votes
0 answers
47 views

socks5 nmap scan [duplicate]

Does nmap support the following (-sS -sV -sC -O ) with a scan using socks5 proxy and if it is not what is the best way to scan linux system through a windows system ?
user avatar
  • 27
0 votes
1 answer
205 views

How to find the IP address of a CCTV camera connected to laptop via ethernet [closed]

I'm trying to get the IP address of a CCTV camera and so far had no luck. The device it's a Hikvision DS-2CD2042WD-I I have connected it to a PoE switch, which is then connected to my laptop(Ubuntu 18....
user avatar
  • 21
0 votes
1 answer
87 views

Would adding `--data-string` to a UDP scan change the results?

I'm doing UDP scans on some internal servers and want to add a custom token (randomly generated string) to packets as much as possible in order to later filter out my scans from real non-testing ...
user avatar
1 vote
1 answer
1k views

netcat vs nmap for banner grabbing?

I am preparing for a security exam and a question I failed in a practice has the following: A command line tool that can be used for banner grabbing is called: A) tcpdump B) netcat C) nmap D) ...
user avatar
0 votes
0 answers
226 views

metasploit: run nmap on compromised host

I have just compromised a computer(legal in my local environment) and want to run nmap from that host to see further inside the network. I know I can use metasploit modules like "auxillary/...
user avatar
1 vote
1 answer
163 views

Service changing port when scanned with nmap [closed]

While scanning a host with nmap I have discovered an unusual service. The service moves to another port everytime I perform an nmap-scan or try to curl it. I have not yet found any info about similar ...
user avatar
  • 11
1 vote
0 answers
94 views

nmap -oG X.X.X.0-255 doesn't work and all my ports closed ( expected list of open ports ) [closed]

I'm running kali Linux on VirtualBox. I ran sudo ifconfig to get my IP and subnet mask (X.X.X.15 and 255.255.255.0 for eth0) I tried the command nmap -oG X.X.X.0-255 -vv but I got Read data files ...
user avatar
0 votes
1 answer
89 views

Are there reasons to match the target port/service protocol when doing a scan?

I am pushing my way through some beginner level security readings and exercises (ECSA 1 & 2) without much of a networking background. I happened upon an interesting suggestion or command: to use ...
user avatar
0 votes
1 answer
667 views

Why do syn scans not work over proxy set up through SSH's dynamic port forwarding?

I have set up dynamic port forwarding using SSH. Although nmap scans over proxychains return accurate results, a SYN scan does not.
user avatar
3 votes
4 answers
9k views

If nmap shows all ports are filtered or closed, what would be the next logical step to take to get more information?

If nmap shows all ports are filtered or closed, what would be the next logical step to take? Does that mean I would need to get physical access to the device? or is there any other ways to get ...
user avatar

1
2 3 4 5
11