Questions tagged [nmap]
A robust and open source security tool for network discovery and security auditing.
440
questions
1
vote
4answers
111 views
Can I gain access by nmap?
I have a Debian machine with nginx 1.14.0 (Ubuntu), and I found an exploit, https://www.rapid7.com/db/modules/exploit/linux/http/nginx_chunked_size
But, is it possible to gain access by only nmap?
0
votes
1answer
70 views
Nmap loads on its own, scans addresses, with a different source address than my PC. How is this possible?
10 minutes after installing Nmap on a fresh install of windows, NMap loaded on its own and attempted to scan dozens of IP addresses around the globe. I never initiated the scan. Notice the source ...
0
votes
2answers
69 views
Nessus detect more open ports than nmap
I scan my site via namp , I only see 3 ports open.
nmap -sV {ip}
Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-25 09:42 EST ...
1
vote
1answer
78 views
Smart Lightbulb Using Common IRC port found in NMAP - anything to worry about?
UPDATE:
Looking at the product again, I don't think this even has built in Wi-Fi (it uses bluetooth for the connection).
I don't know what I am looking for here in Wireshark, but I added the host ...
1
vote
0answers
65 views
Is there an updated (non-Nmap) top 100 or top 1000 common ports list?
I know Nmap has nmap-services file which gives us the list of top 1000 ports/services found on the Internet. But this list seems to be outdated, as the Nmap top 1000 list doesn't include several ...
0
votes
1answer
72 views
nmap - how can I input a target to nmap from a file with the netmask attached?
I have a c program that gets the router IP and netmask and puts it into a text file in the format of 192.168.1.1/24. When I issue the nmap scan command with the target text file I get the unable to ...
0
votes
0answers
12 views
tcpwrapped ports in nmap [duplicate]
As part of a pentesting lab, my Kali is on a WAN and I have hosts behind a pfsense firewall. One of the steps is the list of open ports and services running on those ports. I am using nmap to do that (...
3
votes
1answer
157 views
Nmap giving different result between Mac OS scan and Linux (Kali) scan [closed]
I try to do a simple TCP scan on an Kubunt VM (is on VirtualBox), from two different OS.
From the Host (Mac OS system) and from a Kali Linux VM (tried VirtualBox and Parallels also).
Kali Linux (...
1
vote
0answers
156 views
Nmap Shows all ports are closed [closed]
I am facing a problem with Nmap while scanning metasploitable.
I am using two different PCs. One with Kali Linux by using USB boot and on other PC using Metasploitable running on VMWare. I have ...
1
vote
1answer
74 views
nmap's -sn flag works when a single target is specified, but, not when multiple targets are
When I specify an individual target,
>nmap -v3 -sn 172.18.188.209
I get the correct and expected nmap response
Starting Nmap 7.70 ( https://nmap.org ) at 2019-11-08 11:16 India Standard Time
...
0
votes
1answer
231 views
nmap: Same IP, different domain names, different results?
I'm scanning a network (whose name will not be stated). It has >1 IP addresses. When I tried scanning its subdomains, there are several subdomains that are translated to the same IP address but return ...
0
votes
1answer
194 views
Disabled Network Discovery for port 5357 but it still shows up as open in NMap scan
as mentioned in the title I have disabled Network Discovery for all of the 3 profiles yet when I run an NMap scan, the port comes up to be open. I have also run the command netstat -a -b to find the ...
0
votes
1answer
97 views
Nmap scan slow on some IP ranges [closed]
I'm a security newbie trying to scan a VPN in the range 10.0.0.0 - 10.0.15.254 using nmap on Kali Linux.
The routing table:
route -n
Kernel IP routing table
Destination Gateway Genmask ...
1
vote
0answers
56 views
Inbound rules for a port is configured and disabled yet an NMap scan shows that the port is opened
I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules.
As mentioned on the app, Inbound connections that do not match a rule are simply blocked.
For ...
0
votes
1answer
123 views
Firebase ports scanning using nmap
Purely for research purposes used nmap to check security of my application deployed to Firebase. However, there some questions which I can't understand:
Why Firebase has open so many ports? Something ...
2
votes
1answer
333 views
nmap scanning - What is the difference between -sP and -sn?
On the Nmap home page in my language, I can see -sP scan, but on the English version of the site, I can't see it. But I see -sn that looks very similar, I want to understand what's the difference.
0
votes
1answer
27 views
nmap xml file has only one row [closed]
I'm using Zenmap to discover some hosts. I save the scan as an nmap xml file. Then I import the xml file into excel to view the data.
There are thousands of rows of output in the Zenmap console, but ...
0
votes
1answer
104 views
Hardening against Nmap and other network scanners
It is possible to make Server respond with irrelevant data if it is scanned with Nmap? If yes, are there any examples of such SW?
0
votes
0answers
110 views
nmap gives different results in two shells on the same computer
I'm running kali and metasploitable2 in Virtualbox, and have them connected via the host-only networking mode. I can ping and ssh from kali to metasploitable, and have assigned the following IP ...
1
vote
0answers
135 views
NMAP not showing all live hosts
I have a live host on 192.168.0.151 on my local network. I know it's live since I've set it up with a static IP and also if pinged, I get a reply.
The weird thing is when I run nmap -sP 192.168.0....
0
votes
0answers
166 views
NMAP traceroute result
I am currently using the below command to find out to perform post-scan using information from the scan results to determine if i can use specific port (e.g. 113/tcp) to reach the target. But when i ...
0
votes
0answers
246 views
How to fingerprint Windows 10 reliably?
Recently, I have been practicing penetration testing and I have come to a standstill when trying to fingerprint the OS for a Windows 10 target with nmap.
For the most part, I'm not able to identify ...
2
votes
1answer
180 views
Why is scanning considered a pre-attack and not reconnaissance?
I am studying for a CEH certificate. I have a question about a simple quiz and a book that I am reading.
In the CEH book, it states that:
We can scan for a target using network tools (e.g. tarcert, ...
0
votes
1answer
121 views
Modified NMAP script: variable 'host' is not declared [closed]
I am modifying an nse script, ssl-cert.nse, which was already made for enumerating ssl certificates. I want to output the host ip and the port number in a line of the ssl certificate output. However, ...
0
votes
2answers
67 views
Test Hosts Available for NMAP Scanning? [closed]
Are there any known hosts online that make themselves available for port scanning in order to learn tools like NMAP? Thanks!
0
votes
1answer
203 views
What is the difference between probe and scan?
I'm struggling to understand the difference between probe and scan because they seem very similar. Does NMAP tool use probes and scans?
Could you give a practical example to make the theoretical ...
-1
votes
1answer
709 views
How to use Nmap as a port knocking client?
I want to use Nmap for port knocking on CTF machines, so I've read the manual for configuring it properly:
nmap <ip> -p <port1>,<port2>,... -r --max-retries 0 --max-parallelism 1
...
1
vote
1answer
620 views
nmap privilege escalation - is still a risk?
There is a known and popular technique to leverage nmap for privilege escalation if the suid bit is set for nmap.
One can execute nmap in interactive mode and from there execute bash commands in the ...
3
votes
1answer
1k views
Ports Showing Closed/Filtered in Nmap Scans
hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other ...
1
vote
1answer
264 views
Scanning multiple hosts with Nmap's Default Accounts NSE script not producing the expected result
I'm utilizing Nmap's default account credential scanner. I've built a couple of my own fingerprints and I've tested that the fingerprints work when scanning one host at a time.
Example command line ...
0
votes
2answers
169 views
How can I check what scripts are in Nmap's default category (`--script=default`)?
I know that the -sC and -A options run the "default" category of scripts (--script=default):
https://nmap.org/book/nse-usage.html
I've searched the nmap script folder for a default sub-folder, but ...
0
votes
2answers
573 views
Open ports on my NetGear router
I ran an nmap scan on my home router and I am seeing a ton of open ports. Is this normal? How do I go about closing them?
$ nmap 192.168.1.1
Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-16 20:...
-1
votes
1answer
418 views
how to check if remote host is running LDAP server?
I am currently pen-testing a remote website (its mine)
I would like to know if its possible to test if the web-server is running LDAP server.
I tried Nmap with no luck(it lists every port from 1 to ...
0
votes
1answer
100 views
<hostscript> tag missing in nse output for http-drupal-enum script [closed]
I use the ruby NMAP::XML class to pick apart the nse output from large scans but it expects the script output to be embedded in hostscript tags.
I have just started using http-drupal-enum script (in ...
1
vote
0answers
29 views
Nmap showing different open ports every few seconds [duplicate]
I'm running Nmap on an Amazon Web Services EC2 instance but between runs just a couple seconds apart, I'm getting new results. Is this normal? I'm seeing open ports then they don't show.
I'm running ...
0
votes
0answers
49 views
Is there any Nmap command/script to identify certificate name mismatch and untrusted certificate?
I am using Nmap commands in my script for server validation. I know in Nmap there is the ssl-cert.nse script that retrieves details about the server certificate. I want one more step where I find ...
1
vote
0answers
164 views
nmap - No Ports Open [closed]
I bought a Tonbux Smart WiFi Plug WL-SC01 and I'm doing some hack tests on it for educational purposes. I used nmap to check for both UDP and TCP ports but both return that there are no open ports at ...
3
votes
1answer
1k views
NMAP results inconsistent
I'm doing a NMAP scan that runs continuously. For some reason the results are not consistent. Sometimes it detects all the connected devices of the local network and sometimes only some of them.
...
1
vote
1answer
133 views
Nmap / Qualys say 3DES is available, but OpenSSL fails to connect
Running a Qualys scan showed that the IP was vulnerable to a Sweet32 attack, here is the output:
TLSv1 WITH 64-BIT CBC CIPHERS IS SUPPORTED
DES-CBC3-SHA RSA RSA SHA1 3DES(168)...
0
votes
1answer
51 views
Finding how many filtered ports of a host that would be listed as “filtered” on Nmap
I just started working on nmap and was confused by this question. I'm unsure if I understood it correctly, so I appreciate your help with this.
Using Nmap, find how many ports are filtered in testphp....
2
votes
2answers
515 views
nmap - Difference between “Filtered” and “Admin-Prohibited”
I am a rather new user to nmap. By using some Google-Fu, I am still not able to ascertain what is the criteria used in order to distinguish "filtered" ports from "admin-prohibited" as they both seem ...
1
vote
2answers
708 views
Is there a way to see if an nMap scan in the background is progressing?
I have launched an nMap scan from an Ubuntu machine with the following parameters:
nmap -Pn -T3 -sS -sV -iL /home/tsouser/Desktop/Scope.txt --reason --top-ports 100 --max_rtt_timeout 200ms --...
0
votes
0answers
344 views
Why nmap password scanner completes in 10 seconds and doesn't give any result?
I'm completely new to nmap and I'm trying to brute force passwords on a target. A command that I'm trying is:
nmap -p 80 --unprivileged --script http-form-brute <target>
But instead of "...
3
votes
2answers
287 views
Should ports be visible to nmap?
I'm currently working on the firewall when I discovered that the firewall exposes a lot of ports outside of the internal network. I discovered this when setting up a new FTP server using a basic nmap ...
1
vote
2answers
321 views
Nmap simultaneous scanning
Quick Nmap question. If there are X amount of ports per machine to scan and I want to scan 2 machines at once (no more no less), is there any way of forcing nmap to always be scanning 2 different ...
1
vote
2answers
590 views
Do I have to block UDP ports when I launch my own server with a public IP?
I am trying to give better security to my Raspberry sever. When I installed UFW, I allowed just port 80/tcp and my own high port for SSH communication, and by default are all others ports "deny".
...
2
votes
2answers
117 views
What exactly does a default port scan look like? I am trying to run a default port scan without setting off the ids on my test network
What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.
0
votes
1answer
345 views
NMAP NSE script stopping after 900 seconds (15 minutes)
I am experimenting with ssh bruteforce over my home network using the ssh-brute nse script. I have a short list of usernames (just 12) but a long list of passwords (1M).
I can't seem to get the ssh-...
3
votes
2answers
925 views
Nmap not following redirect when using “http-title” script
I am trying to scan a bunch of IPs for their http-title.
Now the problem I have is that nmap pretty much never follows any redirects.
Usually the title I want is behind that redirect though.
For ...
5
votes
1answer
269 views
How can Nmap bypass Windows Server firewall rules?
I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
