Questions tagged [nmap]
A robust and open source security tool for network discovery and security auditing.
431
questions
1
vote
0answers
53 views
How do I use Npcap? [migrated]
I'm trying to packet capture a remote system using Wireshark on my primarily windows environment.
I want to sniff out SMBv1 and HTTP traffic. I've read this was possible using WinPCap, but it's been ...
0
votes
0answers
28 views
Why is Nmap not working with -oG command [on hold]
I am trying to learn how to use Nmap. I am running the following command in order to scan my WIFI subnet,
nmap -oG - 192.168.1.0-255 -vv
It starts the scan but get stuck at the last host, 192.168.1....
1
vote
0answers
38 views
Inbound rules for a port is configured and disabled yet an NMap scan shows that the port is opened
I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules.
As mentioned on the app, Inbound connections that do not match a rule are simply blocked.
For ...
0
votes
1answer
71 views
Firebase ports scanning using nmap
Purely for research purposes used nmap to check security of my application deployed to Firebase. However, there some questions which I can't understand:
Why Firebase has open so many ports? Something ...
0
votes
0answers
17 views
is port scanning my own WiFi network illegal in australia? [migrated]
I've recently been drawn into pen-testing and port scanning and i wanted to give it a try. but i,m unsure of the laws around port scanning in Australia. I have no idea if i could get in trouble with ...
2
votes
1answer
57 views
nmap scanning - What is the difference between -sP and -sn?
On the Nmap home page in my language, I can see -sP scan, but on the English version of the site, I can't see it. But I see -sn that looks very similar, I want to understand what's the difference.
0
votes
1answer
25 views
nmap xml file has only one row [closed]
I'm using Zenmap to discover some hosts. I save the scan as an nmap xml file. Then I import the xml file into excel to view the data.
There are thousands of rows of output in the Zenmap console, but ...
0
votes
1answer
76 views
Hardening against Nmap and other network scanners
It is possible to make Server respond with irrelevant data if it is scanned with Nmap? If yes, are there any examples of such SW?
0
votes
0answers
49 views
nmap gives different results in two shells on the same computer
I'm running kali and metasploitable2 in Virtualbox, and have them connected via the host-only networking mode. I can ping and ssh from kali to metasploitable, and have assigned the following IP ...
1
vote
0answers
70 views
NMAP not showing all live hosts
I have a live host on 192.168.0.151 on my local network. I know it's live since I've set it up with a static IP and also if pinged, I get a reply.
The weird thing is when I run nmap -sP 192.168.0....
0
votes
0answers
67 views
NMAP traceroute result
I am currently using the below command to find out to perform post-scan using information from the scan results to determine if i can use specific port (e.g. 113/tcp) to reach the target. But when i ...
0
votes
0answers
106 views
How to fingerprint Windows 10 reliably?
Recently, I have been practicing penetration testing and I have come to a standstill when trying to fingerprint the OS for a Windows 10 target with nmap.
For the most part, I'm not able to identify ...
2
votes
1answer
133 views
Why is scanning considered a pre-attack and not reconnaissance?
I am studying for a CEH certificate. I have a question about a simple quiz and a book that I am reading.
In the CEH book, it states that:
We can scan for a target using network tools (e.g. tarcert, ...
0
votes
1answer
84 views
Modified NMAP script: variable 'host' is not declared [closed]
I am modifying an nse script, ssl-cert.nse, which was already made for enumerating ssl certificates. I want to output the host ip and the port number in a line of the ssl certificate output. However, ...
0
votes
2answers
49 views
Test Hosts Available for NMAP Scanning? [closed]
Are there any known hosts online that make themselves available for port scanning in order to learn tools like NMAP? Thanks!
0
votes
1answer
79 views
What is the difference between probe and scan?
I'm struggling to understand the difference between probe and scan because they seem very similar. Does NMAP tool use probes and scans?
Could you give a practical example to make the theoretical ...
-1
votes
1answer
181 views
How to use Nmap as a port knocking client?
I want to use Nmap for port knocking on CTF machines, so I've read the manual for configuring it properly:
nmap <ip> -p <port1>,<port2>,... -r --max-retries 0 --max-parallelism 1
...
1
vote
1answer
295 views
nmap privilege escalation - is still a risk?
There is a known and popular technique to leverage nmap for privilege escalation if the suid bit is set for nmap.
One can execute nmap in interactive mode and from there execute bash commands in the ...
3
votes
1answer
670 views
Ports Showing Closed/Filtered in Nmap Scans
hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other ...
0
votes
1answer
146 views
Scanning multiple hosts with Nmap's Default Accounts NSE script not producing the expected result
I'm utilizing Nmap's default account credential scanner. I've built a couple of my own fingerprints and I've tested that the fingerprints work when scanning one host at a time.
Example command line ...
0
votes
2answers
86 views
How can I check what scripts are in Nmap's default category (`--script=default`)?
I know that the -sC and -A options run the "default" category of scripts (--script=default):
https://nmap.org/book/nse-usage.html
I've searched the nmap script folder for a default sub-folder, but ...
0
votes
2answers
213 views
Open ports on my NetGear router
I ran an nmap scan on my home router and I am seeing a ton of open ports. Is this normal? How do I go about closing them?
$ nmap 192.168.1.1
Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-16 20:...
-1
votes
1answer
160 views
how to check if remote host is running LDAP server?
I am currently pen-testing a remote website (its mine)
I would like to know if its possible to test if the web-server is running LDAP server.
I tried Nmap with no luck(it lists every port from 1 to ...
0
votes
1answer
94 views
<hostscript> tag missing in nse output for http-drupal-enum script [closed]
I use the ruby NMAP::XML class to pick apart the nse output from large scans but it expects the script output to be embedded in hostscript tags.
I have just started using http-drupal-enum script (in ...
1
vote
0answers
27 views
Nmap showing different open ports every few seconds [duplicate]
I'm running Nmap on an Amazon Web Services EC2 instance but between runs just a couple seconds apart, I'm getting new results. Is this normal? I'm seeing open ports then they don't show.
I'm running ...
0
votes
0answers
33 views
Is there any Nmap command/script to identify certificate name mismatch and untrusted certificate?
I am using Nmap commands in my script for server validation. I know in Nmap there is the ssl-cert.nse script that retrieves details about the server certificate. I want one more step where I find ...
1
vote
0answers
98 views
nmap - No Ports Open [closed]
I bought a Tonbux Smart WiFi Plug WL-SC01 and I'm doing some hack tests on it for educational purposes. I used nmap to check for both UDP and TCP ports but both return that there are no open ports at ...
3
votes
1answer
496 views
NMAP results inconsistent
I'm doing a NMAP scan that runs continuously. For some reason the results are not consistent. Sometimes it detects all the connected devices of the local network and sometimes only some of them.
...
1
vote
1answer
86 views
Nmap / Qualys say 3DES is available, but OpenSSL fails to connect
Running a Qualys scan showed that the IP was vulnerable to a Sweet32 attack, here is the output:
TLSv1 WITH 64-BIT CBC CIPHERS IS SUPPORTED
DES-CBC3-SHA RSA RSA SHA1 3DES(168)...
0
votes
1answer
51 views
Finding how many filtered ports of a host that would be listed as “filtered” on Nmap
I just started working on nmap and was confused by this question. I'm unsure if I understood it correctly, so I appreciate your help with this.
Using Nmap, find how many ports are filtered in testphp....
2
votes
2answers
277 views
nmap - Difference between “Filtered” and “Admin-Prohibited”
I am a rather new user to nmap. By using some Google-Fu, I am still not able to ascertain what is the criteria used in order to distinguish "filtered" ports from "admin-prohibited" as they both seem ...
1
vote
2answers
305 views
Is there a way to see if an nMap scan in the background is progressing?
I have launched an nMap scan from an Ubuntu machine with the following parameters:
nmap -Pn -T3 -sS -sV -iL /home/tsouser/Desktop/Scope.txt --reason --top-ports 100 --max_rtt_timeout 200ms --...
0
votes
0answers
142 views
Why nmap password scanner completes in 10 seconds and doesn't give any result?
I'm completely new to nmap and I'm trying to brute force passwords on a target. A command that I'm trying is:
nmap -p 80 --unprivileged --script http-form-brute <target>
But instead of "...
1
vote
2answers
140 views
Should ports be visible to nmap?
I'm currently working on the firewall when I discovered that the firewall exposes a lot of ports outside of the internal network. I discovered this when setting up a new FTP server using a basic nmap ...
0
votes
0answers
244 views
Telnet output with nmap
I made a scan on a server with nmap with these options : nmap -sT -A -P0 and this is the output for the telnet port (23) :
PORT STATE SERVICE VERSION
23/tcp open telnet
| fingerprint-strings: ...
1
vote
2answers
120 views
Nmap simultaneous scanning
Quick Nmap question. If there are X amount of ports per machine to scan and I want to scan 2 machines at once (no more no less), is there any way of forcing nmap to always be scanning 2 different ...
1
vote
2answers
462 views
Do I have to block UDP ports when I launch my own server with a public IP?
I am trying to give better security to my Raspberry sever. When I installed UFW, I allowed just port 80/tcp and my own high port for SSH communication, and by default are all others ports "deny".
...
2
votes
2answers
91 views
What exactly does a default port scan look like? I am trying to run a default port scan without setting off the ids on my test network
What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.
0
votes
1answer
186 views
NMAP NSE script stopping after 900 seconds (15 minutes)
I am experimenting with ssh bruteforce over my home network using the ssh-brute nse script. I have a short list of usernames (just 12) but a long list of passwords (1M).
I can't seem to get the ssh-...
2
votes
2answers
599 views
Nmap not following redirect when using “http-title” script
I am trying to scan a bunch of IPs for their http-title.
Now the problem I have is that nmap pretty much never follows any redirects.
Usually the title I want is behind that redirect though.
For ...
3
votes
1answer
223 views
How can Nmap bypass Windows Server firewall rules?
I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
1
vote
1answer
316 views
NMAP reporting all ports open
I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between.
I tried the SYN scan, and when I check the traffic in WireShark I see ...
1
vote
3answers
268 views
Nmap scanning single port too fast? Shows as filtered?
I ran into an issue when trying to scan a single port on a single machine. I ran a range scan to find machines with port 25 open. Then I just arbitrarily chose one to work on. I scan that machine with ...
-1
votes
1answer
597 views
NMAP - Terminate/stop scan on finding open port
Is there any command on nmap or on some other tool which will stop scan and move on to a different IP on finding a single open port?
Need to perform this for host discovery on few assets which has ...
2
votes
1answer
296 views
Nmap --script-args usage?
I'm trying to use multiple Nmap --script-args at the same time.
$ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com
...
1
vote
2answers
203 views
How to find and ban some devices from my wifi using the command line? [closed]
I use Arch Linux. I just installed some packages such as nmap, netdiscover and others. It is a ubiquiti internet network, for the sharing of connection to several routers. There are about 7 routers ...
-1
votes
1answer
154 views
What is the Difference between TCP Syn discovery and TCP ACK discovery in NMAP?
when im using nmap for network discovery , i dont understand theses options
PS
PA
PU
n
when i use -PS or PA or PU ? and what is the difference between them ?
@ref:
https://nmap.org/book/man-host-...
-4
votes
1answer
170 views
VPN vs real IP address
Is it more secure to use a VPN that has open ports?
22/tcp open ssh
53/tcp open domain
80/tcp open http
110/tcp open pop3
443/tcp open https
500/tcp open isakmp
1723/tcp open pptp
4567/tcp ...
-1
votes
2answers
723 views
How to handle the virus on my router?
I believe my router is infected with a virus. If it is, it has been infected for a large period of time (perhaps a year or more). Though, I only started to consider it being a virus around a week ago.
...
2
votes
1answer
88 views
What port state to expect from Nmap when scanning ports that are open only to specific IP addresses
My firewall has a few ports open but traffic is only forwarded when coming from specific IP addresses (whitelisted).
When scanning these ports with nmap from a non whitelisted IP address, what state ...
