Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [nmap]

A robust and open source security tool for network discovery and security auditing.

0
votes
2answers
60 views

Do I have to block UDP ports when I launch my own server with a public IP?

I am trying to give better security to my Raspberry sever. When I installed UFW, I allowed just port 80/tcp and my own high port for SSH communication, and by default are all others ports "deny". ...
-1
votes
0answers
56 views

Using Nmap For Penetration Testing [closed]

I have two virtual machines installed on a Windows 10 host machine: Windows 7 VM and Kali Linux VM. From Kali Linux I want to scan my Windows 7 machine using Nmap. However, I can not see open ports ...
0
votes
0answers
23 views

Nmap : Run a scan in an IPv4 shared address space (100.x.x.x)

I'm connected with a wifi hotspot provided by a mobile service provider. My private ip (ifconfig) is 100.76.164.44/23 Wikipedia says about the 100.x.x.x range : Shared address space for ...
2
votes
2answers
44 views

What exactly does a default port scan look like? I am trying to run a default port scan without setting off the ids on my test network

What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.
0
votes
1answer
26 views

NMAP NSE script stopping after 900 seconds (15 minutes)

I am experimenting with ssh bruteforce over my home network using the ssh-brute nse script. I have a short list of usernames (just 12) but a long list of passwords (1M). I can't seem to get the ssh-...
2
votes
2answers
63 views

Nmap not following redirect when using “http-title” script

I am trying to scan a bunch of IPs for their http-title. Now the problem I have is that nmap pretty much never follows any redirects. Usually the title I want is behind that redirect though. For ...
3
votes
0answers
79 views

How can Nmap bypass Windows Server firewall rules?

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
1
vote
1answer
78 views

NMAP reporting all ports open

I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between. I tried the SYN scan, and when I check the traffic in WireShark I see ...
0
votes
3answers
55 views

Nmap scanning single port too fast? Shows as filtered?

I ran into an issue when trying to scan a single port on a single machine. I ran a range scan to find machines with port 25 open. Then I just arbitrarily chose one to work on. I scan that machine with ...
-1
votes
1answer
117 views

NMAP - Terminate/stop scan on finding open port

Is there any command on nmap or on some other tool which will stop scan and move on to a different IP on finding a single open port? Need to perform this for host discovery on few assets which has ...
2
votes
1answer
91 views

Nmap --script-args usage?

I'm trying to use multiple Nmap --script-args at the same time. $ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com ...
1
vote
2answers
137 views

How to find and ban some devices from my wifi using the command line? [closed]

I use Arch Linux. I just installed some packages such as nmap, netdiscover and others. It is a ubiquiti internet network, for the sharing of connection to several routers. There are about 7 routers ...
-1
votes
1answer
63 views

What is the Difference between TCP Syn discovery and TCP ACK discovery in NMAP?

when im using nmap for network discovery , i dont understand theses options PS PA PU n when i use -PS or PA or PU ? and what is the difference between them ? @ref: https://nmap.org/book/man-host-...
-1
votes
0answers
17 views

Zenmap -pf output

We smart host all our mail via a third party that archives and sanitises all our inbound and outbound mail. We recently had a spam attack, where the web portal to a users mailbox on this 3rd party ...
-4
votes
1answer
145 views

VPN vs real IP address

Is it more secure to use a VPN that has open ports? 22/tcp open ssh 53/tcp open domain 80/tcp open http 110/tcp open pop3 443/tcp open https 500/tcp open isakmp 1723/tcp open pptp 4567/tcp ...
-1
votes
2answers
273 views

How to handle the virus on my router?

I believe my router is infected with a virus. If it is, it has been infected for a large period of time (perhaps a year or more). Though, I only started to consider it being a virus around a week ago. ...
2
votes
1answer
68 views

What port state to expect from Nmap when scanning ports that are open only to specific IP addresses

My firewall has a few ports open but traffic is only forwarded when coming from specific IP addresses (whitelisted). When scanning these ports with nmap from a non whitelisted IP address, what state ...
0
votes
1answer
86 views

List of all available nmap script arguments

I need to do a scan, for example with http-sql-injection.nse nmap script. I already know that I should use --script-args to set arguments, but my question is not about it. How can I look on the ...
0
votes
2answers
94 views

explain NMAP results

When I ran nmap -sn x.x.x.x/24 on a network behind Cisco ASA firewall I get 255 hosts up even though there are only three hosts on that subnet. If I run nmap -T4 -F x.x.x.x/24 I get all 254 IP ...
0
votes
0answers
65 views

How can I perform nmap scanning on a Windows virtual box

I am trying to do an Nmap scan to a Windows 2016 Server virtual machine from my host Windows 10 machine. I want to see the open ports in the virtual Windows machine. There is no problem with the ...
2
votes
1answer
97 views

Use Splunk to run Nmap scan from remote host to potential attacker

When receiving internal attacks, I'd like to utilize Splunk alerts to trigger an Nmap scan against that attacking host from a remote machine; one other than the Splunk server. Is there any API or ...
0
votes
2answers
78 views

Inconsistent list of hosts found by nmap pings from scan to scan - tcpdump shows ICMP echo replies did arrive

I'm running nmap periodically to monitor which hosts are in our server subnet: rm list; for i in $(seq 1 254) ; do echo 10.10.10.$i >> list ; done sudo nmap -oG - -PE -sn -iL list Most of the ...
1
vote
2answers
67 views

nmap -sn through proxychains fails

Why I can not do the following with nmap? proxychains nmap -A -v 10.185.11.0/24 Output: ProxyChains-3.1 (http://proxychains.sf.net) Starting Nmap 7.60 ( https://nmap.org ) at 2018-08-07 10:12 EEST ...
3
votes
0answers
1k views

What is RTTVAR in NMap? [closed]

I find a lot of sources explaining how to get rid of the following message: RTTVAR has grown to over 2.3 seconds, decreasing to 2.0 But What exactly is RTTVAR(Round Trip Time Variance)? What is ...
0
votes
2answers
95 views

Verify whether the IP address is SQL Server

Is a network scan the only way to know if an IP address is a SQL server? How can I verify this 100%?
0
votes
0answers
18 views

NMAP multiple IP scanning (specifying ports for every ip) [duplicate]

I am using nmap for daily monitoring the network service and open ports status, i wrote a bash script that scans a range of ip and ndiff the output with previous scans, and make it as a daily cronjob. ...
0
votes
0answers
79 views

All smartphone ports filtered - how to scan smartphones on local Wifi?

I am using Nmap and scanning my smartphone (LG G5 - Android) on my local network and practicing trying to gain remote access into it. However, whenever I scan my cellphone, either all ports are closed ...
9
votes
3answers
469 views

What are some instant red flags when scanning an network with nmap

When doing an Nmap scan from an external network, what open ports should be an instant red flag? For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
0
votes
1answer
298 views

What -sn -Pn does in Nmap?

-sn: It tells the nmap not to do any Port Scan. -Pn: It tells the nmap not to do any Ping Scan. Now when I use both together like this, nmap -sn -Pn host.com. What I saw in the terminal is Nmap ...
0
votes
2answers
60 views

Internal IP's Probing to Unknown External IP's

I recently took a CEH class and they mentioned checking for internal IP's probing to External unknown IP's to determine an attack. What would be the best way to gather and analyze these types of ...
1
vote
1answer
94 views

nmap not showing closed ports

When I running the command nmap -p 443 -iL ip.txt It only shows IP addresses with open ports in the output, but does not show IP addresses with closed ports. How can I see the closed ports/IPs.
1
vote
3answers
422 views

NMAP to scan ip and ports from file

I want to scan IP and port from a file as below: 192.168.1.2 443 192.168.2.100 8443 192.168.3.99 80 192.168.4.11 443 How can I do that? I know there is option to take IP from a file using -iL but ...
1
vote
1answer
40 views

is -nU an option with nmap?

My coworkers seem to have -nU (no udp) as an option for their nmap scripts but I've never seen this in use and when I try to use this option with nmap, it does not work. I thought no udp was enabled ...
0
votes
2answers
362 views

No output from nmap script

I'm trying to use the nmap script ssl-dh-params to identify what specific 1024-bit Diffie-Hellman group a TLS server is using. However, the script is not giving me any output at all and I can't ...
0
votes
0answers
33 views

Nmap scan results different when specifying port

Does anyone know how this happened? I use nmap [ip address] The result shows port 21 is open. But when I use nmap -p 21 [ip address] the result shows port 21 is filtered.
3
votes
2answers
78 views

Nmap and it default scripts when I already know some of the information

I am a network guy and not a “hacker” or whatever the official term is these days. I’ve been learning how to use nmap as I think it’s a great tool for just keeping the network secure. The thing is ...
1
vote
1answer
120 views

Nmap HeartBleed script does not seem to work over non-standard ports

The Nmap script for HeartBleed (using Nmap v7.40) seems to work only over known ports. Whenever a non-standard port is used, the script does not report anything. nmap -p 46000 --script ssl-heartbleed ...
0
votes
0answers
142 views

What are all of these IPs addresses? Honeypots?

I was scanning my network (192.168.0.1-100) and I found many IP addresses that are not mine nor known, around 800 of them. I guess it has something to do with the ISP. After scanning the ips with nmap ...
1
vote
2answers
162 views

nmap finger print looks alot like shell code and not what's on nmap.org

my concern is the finger print at the end could someone please explain what it is, thanks (looks like a nop sled and buffer overflow ) bash >> nmap -sS -sU -T4 -A -v 192.168.50.1 Nmap scan report ...
0
votes
2answers
286 views

Multiple Open ports on a server, is that safe? [closed]

Using nmap I try to scan a server as a result I get multiple open ports. For example when I try to scan domain.com as a result: 7/tcp open echo 9/tcp open discard 13/tcp open daytime 21/tcp filtered ...
1
vote
2answers
625 views

Xmas Scan Versus FIN Scan

While studying Nmap, I came across different port scans. Out of these XMAS and FIN scan caught my interest. Though XMAS scan sends FIN, URG and RST flags, the response is the same as that of a FIN ...
0
votes
2answers
466 views

nmap traceroute shows only one hop regardless of target

I'm using Zenmap to map out the network topology of the company I'm working in. When I ran the following command to trace route how my system connects to the internet but Zenmap only shows me a single ...
1
vote
0answers
45 views

network ports are filtered strangely?

I have some Ubuntu servers deployed in VULTR Global Cloud and I have about 300 network ports each server. However, every server will be filtered in China suddenly (I can ping from China). I use nmap ...
-1
votes
1answer
103 views

What are some IDS/IPS that are able to detect stealth scans done in nmap today? [closed]

I was informed that these scans are no longer "stealth"
0
votes
1answer
161 views

Find out the IP or hostname of the firewall? [closed]

Is there a way to find the IP of the firewall which is blocking my access to an endpoint? I tried netcat / nmap but not much luck. I need some form of a tool which does a traceroute to the subnet or ...
3
votes
1answer
526 views

Clarifications regarding ciphers and Nmap scan

I'm running the below Nmap command to test the strength of the cipher suites I have used in my host nmap -sV --script ssl-enum-ciphers -p 443 <host> The Nmap doc says that Each ciphersuite is ...
1
vote
1answer
242 views

How to control the ciphersuites in nmap “ssl-enum-ciphers”

There is a script for enumerating the TLS versions and ciphersuites ofered by a server provided by nmap. See this link. Is there a way that allow me to specify the verisions and ciphersuites I want ...
1
vote
1answer
87 views

Why so many restransmissions on Nmap?

I executed the following code: sudo nmap -sT -Pn --max-parallelism 1 --max-retries 0 -p5481,10212,19999,2308,102 192.168.0.19 192.168.0.20 And when I analyzed the scan on Wireshark, I saw this: I ...
0
votes
0answers
68 views

Unable to run Metasploit scripts on a mysql server for authorized penetration testing

I am taking a course in penetration testing and I was provided with a virtual environment to pen test. I was provided with a vpn for my CC server and i am able to ping the host which was found to run ...
0
votes
1answer
144 views

Why I recived user-set on my Nmap analyze?

I executed this command: nmap -sn -n --scan-delay 1s --max-retries 0 -Pn --packet-trace --reason <IP> And I received this response: Host is up, received user-set. It seems that Nmap thinks ...