Questions tagged [nmap]
A robust and open source security tool for network discovery and security auditing.
0
votes
2answers
60 views
Do I have to block UDP ports when I launch my own server with a public IP?
I am trying to give better security to my Raspberry sever. When I installed UFW, I allowed just port 80/tcp and my own high port for SSH communication, and by default are all others ports "deny".
...
-1
votes
0answers
56 views
Using Nmap For Penetration Testing [closed]
I have two virtual machines installed on a Windows 10 host machine: Windows 7 VM and Kali Linux VM.
From Kali Linux I want to scan my Windows 7 machine using Nmap. However, I can not see open ports ...
0
votes
0answers
23 views
Nmap : Run a scan in an IPv4 shared address space (100.x.x.x)
I'm connected with a wifi hotspot provided by a mobile service provider. My private ip (ifconfig) is 100.76.164.44/23
Wikipedia says about the 100.x.x.x range :
Shared address space for ...
2
votes
2answers
44 views
What exactly does a default port scan look like? I am trying to run a default port scan without setting off the ids on my test network
What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.
0
votes
1answer
26 views
NMAP NSE script stopping after 900 seconds (15 minutes)
I am experimenting with ssh bruteforce over my home network using the ssh-brute nse script. I have a short list of usernames (just 12) but a long list of passwords (1M).
I can't seem to get the ssh-...
2
votes
2answers
63 views
Nmap not following redirect when using “http-title” script
I am trying to scan a bunch of IPs for their http-title.
Now the problem I have is that nmap pretty much never follows any redirects.
Usually the title I want is behind that redirect though.
For ...
3
votes
0answers
79 views
How can Nmap bypass Windows Server firewall rules?
I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
1
vote
1answer
78 views
NMAP reporting all ports open
I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between.
I tried the SYN scan, and when I check the traffic in WireShark I see ...
0
votes
3answers
55 views
Nmap scanning single port too fast? Shows as filtered?
I ran into an issue when trying to scan a single port on a single machine. I ran a range scan to find machines with port 25 open. Then I just arbitrarily chose one to work on. I scan that machine with ...
-1
votes
1answer
117 views
NMAP - Terminate/stop scan on finding open port
Is there any command on nmap or on some other tool which will stop scan and move on to a different IP on finding a single open port?
Need to perform this for host discovery on few assets which has ...
2
votes
1answer
91 views
Nmap --script-args usage?
I'm trying to use multiple Nmap --script-args at the same time.
$ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com
...
1
vote
2answers
137 views
How to find and ban some devices from my wifi using the command line? [closed]
I use Arch Linux. I just installed some packages such as nmap, netdiscover and others. It is a ubiquiti internet network, for the sharing of connection to several routers. There are about 7 routers ...
-1
votes
1answer
63 views
What is the Difference between TCP Syn discovery and TCP ACK discovery in NMAP?
when im using nmap for network discovery , i dont understand theses options
PS
PA
PU
n
when i use -PS or PA or PU ? and what is the difference between them ?
@ref:
https://nmap.org/book/man-host-...
-1
votes
0answers
17 views
Zenmap -pf output
We smart host all our mail via a third party that archives and sanitises all our inbound and outbound mail.
We recently had a spam attack, where the web portal to a users mailbox on this 3rd party ...
-4
votes
1answer
145 views
VPN vs real IP address
Is it more secure to use a VPN that has open ports?
22/tcp open ssh
53/tcp open domain
80/tcp open http
110/tcp open pop3
443/tcp open https
500/tcp open isakmp
1723/tcp open pptp
4567/tcp ...
-1
votes
2answers
273 views
How to handle the virus on my router?
I believe my router is infected with a virus. If it is, it has been infected for a large period of time (perhaps a year or more). Though, I only started to consider it being a virus around a week ago.
...
2
votes
1answer
68 views
What port state to expect from Nmap when scanning ports that are open only to specific IP addresses
My firewall has a few ports open but traffic is only forwarded when coming from specific IP addresses (whitelisted).
When scanning these ports with nmap from a non whitelisted IP address, what state ...
0
votes
1answer
86 views
List of all available nmap script arguments
I need to do a scan, for example with http-sql-injection.nse
nmap script.
I already know that I should use --script-args to set arguments, but my question is not about it.
How can I look on the ...
0
votes
2answers
94 views
explain NMAP results
When I ran nmap -sn x.x.x.x/24 on a network behind Cisco ASA firewall I get 255 hosts up even though there are only three hosts on that subnet.
If I run nmap -T4 -F x.x.x.x/24 I get all 254 IP ...
0
votes
0answers
65 views
How can I perform nmap scanning on a Windows virtual box
I am trying to do an Nmap scan to a Windows 2016 Server virtual machine from my host Windows 10 machine.
I want to see the open ports in the virtual Windows machine. There is no problem with the ...
2
votes
1answer
97 views
Use Splunk to run Nmap scan from remote host to potential attacker
When receiving internal attacks, I'd like to utilize Splunk alerts to trigger an Nmap scan against that attacking host from a remote machine; one other than the Splunk server.
Is there any API or ...
0
votes
2answers
78 views
Inconsistent list of hosts found by nmap pings from scan to scan - tcpdump shows ICMP echo replies did arrive
I'm running nmap periodically to monitor which hosts are in our server subnet:
rm list; for i in $(seq 1 254) ; do echo 10.10.10.$i >> list ; done
sudo nmap -oG - -PE -sn -iL list
Most of the ...
1
vote
2answers
67 views
nmap -sn through proxychains fails
Why I can not do the following with nmap?
proxychains nmap -A -v 10.185.11.0/24
Output:
ProxyChains-3.1 (http://proxychains.sf.net)
Starting Nmap 7.60 ( https://nmap.org ) at 2018-08-07 10:12 EEST
...
3
votes
0answers
1k views
What is RTTVAR in NMap? [closed]
I find a lot of sources explaining how to get rid of the following message:
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
But
What exactly is RTTVAR(Round Trip Time Variance)?
What is ...
0
votes
2answers
95 views
Verify whether the IP address is SQL Server
Is a network scan the only way to know if an IP address is a SQL server? How can I verify this 100%?
0
votes
0answers
18 views
NMAP multiple IP scanning (specifying ports for every ip) [duplicate]
I am using nmap for daily monitoring the network service and open ports status,
i wrote a bash script that scans a range of ip and ndiff the output with previous scans, and make it as a daily cronjob.
...
0
votes
0answers
79 views
All smartphone ports filtered - how to scan smartphones on local Wifi?
I am using Nmap and scanning my smartphone (LG G5 - Android) on my local network and practicing trying to gain remote access into it. However, whenever I scan my cellphone, either all ports are closed ...
9
votes
3answers
469 views
What are some instant red flags when scanning an network with nmap
When doing an Nmap scan from an external network, what open ports should be an instant red flag?
For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
0
votes
1answer
298 views
What -sn -Pn does in Nmap?
-sn: It tells the nmap not to do any Port Scan.
-Pn: It tells the nmap not to do any Ping Scan.
Now when I use both together like this, nmap -sn -Pn host.com.
What I saw in the terminal is Nmap ...
0
votes
2answers
60 views
Internal IP's Probing to Unknown External IP's
I recently took a CEH class and they mentioned checking for internal IP's probing to External unknown IP's to determine an attack. What would be the best way to gather and analyze these types of ...
1
vote
1answer
94 views
nmap not showing closed ports
When I running the command
nmap -p 443 -iL ip.txt
It only shows IP addresses with open ports in the output, but does not show IP addresses with closed ports. How can I see the closed ports/IPs.
1
vote
3answers
422 views
NMAP to scan ip and ports from file
I want to scan IP and port from a file as below:
192.168.1.2 443
192.168.2.100 8443
192.168.3.99 80
192.168.4.11 443
How can I do that? I know there is option to take IP from a file using -iL but ...
1
vote
1answer
40 views
is -nU an option with nmap?
My coworkers seem to have -nU (no udp) as an option for their nmap scripts but I've never seen this in use and when I try to use this option with nmap, it does not work. I thought no udp was enabled ...
0
votes
2answers
362 views
No output from nmap script
I'm trying to use the nmap script ssl-dh-params to identify what specific 1024-bit Diffie-Hellman group a TLS server is using. However, the script is not giving me any output at all and I can't ...
0
votes
0answers
33 views
Nmap scan results different when specifying port
Does anyone know how this happened?
I use nmap [ip address] The result shows port 21 is open.
But when I use nmap -p 21 [ip address] the result shows port 21 is filtered.
3
votes
2answers
78 views
Nmap and it default scripts when I already know some of the information
I am a network guy and not a “hacker” or whatever the official term is these days.
I’ve been learning how to use nmap as I think it’s a great tool for just keeping the network secure.
The thing is ...
1
vote
1answer
120 views
Nmap HeartBleed script does not seem to work over non-standard ports
The Nmap script for HeartBleed (using Nmap v7.40) seems to work only over known ports. Whenever a non-standard port is used, the script does not report anything.
nmap -p 46000 --script ssl-heartbleed ...
0
votes
0answers
142 views
What are all of these IPs addresses? Honeypots?
I was scanning my network (192.168.0.1-100) and I found many IP addresses that are not mine nor known, around 800 of them. I guess it has something to do with the ISP. After scanning the ips with nmap ...
1
vote
2answers
162 views
nmap finger print looks alot like shell code and not what's on nmap.org
my concern is the finger print at the end could someone please explain what it is, thanks (looks like a nop sled and buffer overflow )
bash >> nmap -sS -sU -T4 -A -v 192.168.50.1
Nmap scan report ...
0
votes
2answers
286 views
Multiple Open ports on a server, is that safe? [closed]
Using nmap I try to scan a server as a result I get multiple open ports.
For example when I try to scan domain.com as a result:
7/tcp open echo
9/tcp open discard
13/tcp open daytime
21/tcp filtered ...
1
vote
2answers
625 views
Xmas Scan Versus FIN Scan
While studying Nmap, I came across different port scans. Out of these XMAS and FIN scan caught my interest. Though XMAS scan sends FIN, URG and RST flags, the response is the same as that of a FIN ...
0
votes
2answers
466 views
nmap traceroute shows only one hop regardless of target
I'm using Zenmap to map out the network topology of the company I'm working in. When I ran the following command to trace route how my system connects to the internet but Zenmap only shows me a single ...
1
vote
0answers
45 views
network ports are filtered strangely?
I have some Ubuntu servers deployed in VULTR Global Cloud and I have about 300 network ports each server.
However, every server will be filtered in China suddenly (I can ping from China). I use nmap ...
-1
votes
1answer
103 views
What are some IDS/IPS that are able to detect stealth scans done in nmap today? [closed]
I was informed that these scans are no longer "stealth"
0
votes
1answer
161 views
Find out the IP or hostname of the firewall? [closed]
Is there a way to find the IP of the firewall which is blocking my access to an endpoint?
I tried netcat / nmap but not much luck.
I need some form of a tool which does a traceroute to the subnet or ...
3
votes
1answer
526 views
Clarifications regarding ciphers and Nmap scan
I'm running the below Nmap command to test the strength of the cipher suites I have used in my host
nmap -sV --script ssl-enum-ciphers -p 443 <host>
The Nmap doc says that Each ciphersuite is ...
1
vote
1answer
242 views
How to control the ciphersuites in nmap “ssl-enum-ciphers”
There is a script for enumerating the TLS versions and ciphersuites ofered by a server provided by nmap. See this link.
Is there a way that allow me to specify the verisions and ciphersuites I want ...
1
vote
1answer
87 views
Why so many restransmissions on Nmap?
I executed the following code:
sudo nmap -sT -Pn --max-parallelism 1 --max-retries 0 -p5481,10212,19999,2308,102 192.168.0.19 192.168.0.20
And when I analyzed the scan on Wireshark, I saw this:
I ...
0
votes
0answers
68 views
Unable to run Metasploit scripts on a mysql server for authorized penetration testing
I am taking a course in penetration testing and I was provided with a virtual environment to pen test. I was provided with a vpn for my CC server and i am able to ping the host which was found to run ...
0
votes
1answer
144 views
Why I recived user-set on my Nmap analyze?
I executed this command:
nmap -sn -n --scan-delay 1s --max-retries 0 -Pn --packet-trace --reason <IP>
And I received this response:
Host is up, received user-set.
It seems that Nmap thinks ...
