Questions tagged [nmap]
A robust and open source security tool for network discovery and security auditing.
0
votes
0answers
30 views
How to import port information when import an xml file using db_import in metasploit? [on hold]
When I import the xml file containing output (-oX) from nmap into metasploit using db_import [filename.xml], I cannot see the port information. When I run db_hosts, metasploit seems to store only ...
0
votes
0answers
60 views
I did a IP scan on a network and I see the IP is scannable, but I cannot ping the device
I made a change on a serial-to-ethernet converter and the device is no longer pingable or accessable through the webUI, but when I do a IP scan, NMAP picks it up as:
Nmap scan report for 192.168.0....
0
votes
0answers
37 views
nmap gives different results in two shells on the same computer
I'm running kali and metasploitable2 in Virtualbox, and have them connected via the host-only networking mode. I can ping and ssh from kali to metasploitable, and have assigned the following IP ...
1
vote
0answers
50 views
NMAP not showing all live hosts
I have a live host on 192.168.0.151 on my local network. I know it's live since I've set it up with a static IP and also if pinged, I get a reply.
The weird thing is when I run nmap -sP 192.168.0....
0
votes
0answers
37 views
NMAP traceroute result
I am currently using the below command to find out to perform post-scan using information from the scan results to determine if i can use specific port (e.g. 113/tcp) to reach the target. But when i ...
0
votes
0answers
71 views
How to fingerprint Windows 10 reliably?
Recently, I have been practicing penetration testing and I have come to a standstill when trying to fingerprint the OS for a Windows 10 target with nmap.
For the most part, I'm not able to identify ...
2
votes
1answer
117 views
Why is scanning considered a pre-attack and not reconnaissance?
I am studying for a CEH certificate. I have a question about a simple quiz and a book that I am reading.
In the CEH book, it states that:
We can scan for a target using network tools (e.g. tarcert, ...
0
votes
1answer
51 views
Modified NMAP script: variable 'host' is not declared [closed]
I am modifying an nse script, ssl-cert.nse, which was already made for enumerating ssl certificates. I want to output the host ip and the port number in a line of the ssl certificate output. However, ...
0
votes
2answers
45 views
Test Hosts Available for NMAP Scanning? [closed]
Are there any known hosts online that make themselves available for port scanning in order to learn tools like NMAP? Thanks!
0
votes
1answer
62 views
What is the difference between probe and scan?
I'm struggling to understand the difference between probe and scan because they seem very similar. Does NMAP tool use probes and scans?
Could you give a practical example to make the theoretical ...
-1
votes
1answer
126 views
How to use Nmap as a port knocking client?
I want to use Nmap for port knocking on CTF machines, so I've read the manual for configuring it properly:
nmap <ip> -p <port1>,<port2>,... -r --max-retries 0 --max-parallelism 1
...
1
vote
1answer
197 views
nmap privilege escalation - is still a risk?
There is a known and popular technique to leverage nmap for privilege escalation if the suid bit is set for nmap.
One can execute nmap in interactive mode and from there execute bash commands in the ...
3
votes
1answer
520 views
Ports Showing Closed/Filtered in Nmap Scans
hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other ...
0
votes
1answer
83 views
Scanning multiple hosts with Nmap's Default Accounts NSE script not producing the expected result
I'm utilizing Nmap's default account credential scanner. I've built a couple of my own fingerprints and I've tested that the fingerprints work when scanning one host at a time.
Example command line ...
0
votes
2answers
68 views
How can I check what scripts are in Nmap's default category (`--script=default`)?
I know that the -sC and -A options run the "default" category of scripts (--script=default):
https://nmap.org/book/nse-usage.html
I've searched the nmap script folder for a default sub-folder, but ...
0
votes
2answers
138 views
Open ports on my NetGear router
I ran an nmap scan on my home router and I am seeing a ton of open ports. Is this normal? How do I go about closing them?
$ nmap 192.168.1.1
Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-16 20:...
-1
votes
1answer
119 views
how to check if remote host is running LDAP server?
I am currently pen-testing a remote website (its mine)
I would like to know if its possible to test if the web-server is running LDAP server.
I tried Nmap with no luck(it lists every port from 1 to ...
0
votes
1answer
94 views
<hostscript> tag missing in nse output for http-drupal-enum script [closed]
I use the ruby NMAP::XML class to pick apart the nse output from large scans but it expects the script output to be embedded in hostscript tags.
I have just started using http-drupal-enum script (in ...
1
vote
0answers
27 views
Nmap showing different open ports every few seconds [duplicate]
I'm running Nmap on an Amazon Web Services EC2 instance but between runs just a couple seconds apart, I'm getting new results. Is this normal? I'm seeing open ports then they don't show.
I'm running ...
0
votes
0answers
27 views
Is there any Nmap command/script to identify certificate name mismatch and untrusted certificate?
I am using Nmap commands in my script for server validation. I know in Nmap there is the ssl-cert.nse script that retrieves details about the server certificate. I want one more step where I find ...
1
vote
0answers
75 views
nmap - No Ports Open [closed]
I bought a Tonbux Smart WiFi Plug WL-SC01 and I'm doing some hack tests on it for educational purposes. I used nmap to check for both UDP and TCP ports but both return that there are no open ports at ...
3
votes
1answer
273 views
NMAP results inconsistent
I'm doing a NMAP scan that runs continuously. For some reason the results are not consistent. Sometimes it detects all the connected devices of the local network and sometimes only some of them.
...
1
vote
1answer
70 views
Nmap / Qualys say 3DES is available, but OpenSSL fails to connect
Running a Qualys scan showed that the IP was vulnerable to a Sweet32 attack, here is the output:
TLSv1 WITH 64-BIT CBC CIPHERS IS SUPPORTED
DES-CBC3-SHA RSA RSA SHA1 3DES(168)...
0
votes
1answer
50 views
Finding how many filtered ports of a host that would be listed as “filtered” on Nmap
I just started working on nmap and was confused by this question. I'm unsure if I understood it correctly, so I appreciate your help with this.
Using Nmap, find how many ports are filtered in testphp....
2
votes
2answers
200 views
nmap - Difference between “Filtered” and “Admin-Prohibited”
I am a rather new user to nmap. By using some Google-Fu, I am still not able to ascertain what is the criteria used in order to distinguish "filtered" ports from "admin-prohibited" as they both seem ...
1
vote
2answers
208 views
Is there a way to see if an nMap scan in the background is progressing?
I have launched an nMap scan from an Ubuntu machine with the following parameters:
nmap -Pn -T3 -sS -sV -iL /home/tsouser/Desktop/Scope.txt --reason --top-ports 100 --max_rtt_timeout 200ms --...
0
votes
0answers
109 views
Why nmap password scanner completes in 10 seconds and doesn't give any result?
I'm completely new to nmap and I'm trying to brute force passwords on a target. A command that I'm trying is:
nmap -p 80 --unprivileged --script http-form-brute <target>
But instead of "...
1
vote
2answers
112 views
Should ports be visible to nmap?
I'm currently working on the firewall when I discovered that the firewall exposes a lot of ports outside of the internal network. I discovered this when setting up a new FTP server using a basic nmap ...
0
votes
0answers
187 views
Telnet output with nmap
I made a scan on a server with nmap with these options : nmap -sT -A -P0 and this is the output for the telnet port (23) :
PORT STATE SERVICE VERSION
23/tcp open telnet
| fingerprint-strings: ...
1
vote
2answers
96 views
Nmap simultaneous scanning
Quick Nmap question. If there are X amount of ports per machine to scan and I want to scan 2 machines at once (no more no less), is there any way of forcing nmap to always be scanning 2 different ...
1
vote
2answers
401 views
Do I have to block UDP ports when I launch my own server with a public IP?
I am trying to give better security to my Raspberry sever. When I installed UFW, I allowed just port 80/tcp and my own high port for SSH communication, and by default are all others ports "deny".
...
2
votes
2answers
82 views
What exactly does a default port scan look like? I am trying to run a default port scan without setting off the ids on my test network
What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.
0
votes
1answer
149 views
NMAP NSE script stopping after 900 seconds (15 minutes)
I am experimenting with ssh bruteforce over my home network using the ssh-brute nse script. I have a short list of usernames (just 12) but a long list of passwords (1M).
I can't seem to get the ssh-...
2
votes
2answers
480 views
Nmap not following redirect when using “http-title” script
I am trying to scan a bunch of IPs for their http-title.
Now the problem I have is that nmap pretty much never follows any redirects.
Usually the title I want is behind that redirect though.
For ...
3
votes
1answer
202 views
How can Nmap bypass Windows Server firewall rules?
I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
1
vote
1answer
272 views
NMAP reporting all ports open
I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between.
I tried the SYN scan, and when I check the traffic in WireShark I see ...
0
votes
3answers
228 views
Nmap scanning single port too fast? Shows as filtered?
I ran into an issue when trying to scan a single port on a single machine. I ran a range scan to find machines with port 25 open. Then I just arbitrarily chose one to work on. I scan that machine with ...
-1
votes
1answer
491 views
NMAP - Terminate/stop scan on finding open port
Is there any command on nmap or on some other tool which will stop scan and move on to a different IP on finding a single open port?
Need to perform this for host discovery on few assets which has ...
2
votes
1answer
242 views
Nmap --script-args usage?
I'm trying to use multiple Nmap --script-args at the same time.
$ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com
...
1
vote
2answers
168 views
How to find and ban some devices from my wifi using the command line? [closed]
I use Arch Linux. I just installed some packages such as nmap, netdiscover and others. It is a ubiquiti internet network, for the sharing of connection to several routers. There are about 7 routers ...
-1
votes
1answer
135 views
What is the Difference between TCP Syn discovery and TCP ACK discovery in NMAP?
when im using nmap for network discovery , i dont understand theses options
PS
PA
PU
n
when i use -PS or PA or PU ? and what is the difference between them ?
@ref:
https://nmap.org/book/man-host-...
-4
votes
1answer
167 views
VPN vs real IP address
Is it more secure to use a VPN that has open ports?
22/tcp open ssh
53/tcp open domain
80/tcp open http
110/tcp open pop3
443/tcp open https
500/tcp open isakmp
1723/tcp open pptp
4567/tcp ...
-1
votes
2answers
652 views
How to handle the virus on my router?
I believe my router is infected with a virus. If it is, it has been infected for a large period of time (perhaps a year or more). Though, I only started to consider it being a virus around a week ago.
...
2
votes
1answer
84 views
What port state to expect from Nmap when scanning ports that are open only to specific IP addresses
My firewall has a few ports open but traffic is only forwarded when coming from specific IP addresses (whitelisted).
When scanning these ports with nmap from a non whitelisted IP address, what state ...
2
votes
1answer
1k views
List of all available nmap script arguments
I need to do a scan, for example with http-sql-injection.nse
nmap script.
I already know that I should use --script-args to set arguments, but my question is not about it.
How can I look on the ...
0
votes
2answers
279 views
explain NMAP results
When I ran nmap -sn x.x.x.x/24 on a network behind Cisco ASA firewall I get 255 hosts up even though there are only three hosts on that subnet.
If I run nmap -T4 -F x.x.x.x/24 I get all 254 IP ...
2
votes
1answer
218 views
Use Splunk to run Nmap scan from remote host to potential attacker
When receiving internal attacks, I'd like to utilize Splunk alerts to trigger an Nmap scan against that attacking host from a remote machine; one other than the Splunk server.
Is there any API or ...
0
votes
2answers
139 views
Inconsistent list of hosts found by nmap pings from scan to scan - tcpdump shows ICMP echo replies did arrive
I'm running nmap periodically to monitor which hosts are in our server subnet:
rm list; for i in $(seq 1 254) ; do echo 10.10.10.$i >> list ; done
sudo nmap -oG - -PE -sn -iL list
Most of the ...
1
vote
2answers
158 views
nmap -sn through proxychains fails
Why I can not do the following with nmap?
proxychains nmap -A -v 10.185.11.0/24
Output:
ProxyChains-3.1 (http://proxychains.sf.net)
Starting Nmap 7.60 ( https://nmap.org ) at 2018-08-07 10:12 EEST
...
3
votes
0answers
5k views
What is RTTVAR in NMap? [closed]
I find a lot of sources explaining how to get rid of the following message:
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
But
What exactly is RTTVAR(Round Trip Time Variance)?
What is ...
