Questions tagged [nmap]

A robust and open source security tool for network discovery and security auditing.

Filter by
Sorted by
Tagged with
9
votes
3answers
46k views

How to use nmap through proxychains?

I am running nmap through proxychains using this command: proxychains nmap -v scanme.namp.org This produced an error: root@kali:~# proxychains nmap -v scanme.nmap.org ProxyChains-3.1 (http://...
293
votes
8answers
1.1m views

How to find live hosts on my network?

I am trying to find the live hosts on my network using nmap. I am scanning the network in Ubuntu using the command sudo nmap -sP 192.168.2.1/24. However, I am unable to find the live hosts. I just get ...
14
votes
1answer
16k views

Nmap - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why Nmap decides to tell ...
17
votes
3answers
35k views

What are the security issues of open ports?

What could be the threats of having the ports open, after performing a nmap scan and identifying the open ports? I already searched for some answers for this question, but couldn't find anything ...
9
votes
2answers
50k views

Nmap through proxy

Using the following command: nmap --proxy socks4://*.*.*.*:25074 -sV -O --reason scanme.nmap.org I'm not sure if nmap is really using the proxy specified Had an idea of scanning "localhost" or "127....
5
votes
3answers
19k views

Find SMBv1 status with Nmap

Is there a ready way with nmap's scripting option to find machines with SMB 1 still enabled server side? It'd be a whole lot faster for me to monitor my remediation if it is available. I'd rather ...
10
votes
2answers
18k views

How does nmap do a zombie and decoy scan?

We're learning nmap in my ethical hacking class. We got showed how we can use nmap to perform a zombie scan: nmap -PN -sI zombieIP targetIP and decoy scan: nmap -p 135 -D decoyIP targetIP I ...
9
votes
4answers
11k views

Nmap scan produces all "unknown"

I scanned both localhost, and the IP address of the LAN adapter, and this is the produced output. Starting Nmap 5.51 ( http://nmap.org ) at 2012-10-12 18:06 Eastern Daylight Time Skipping SYN Stealth ...
3
votes
3answers
7k views

Nmap filtered or closed

When I scan one host(A) on my local network with nmap from another computer(B) on the same subnet it shows all 1000 ports closed. When I scan the other computer(B) with nmap from computer(A) it shows ...
2
votes
2answers
2k views

nmap - Difference between "Filtered" and "Admin-Prohibited"

I am a rather new user to nmap. By using some Google-Fu, I am still not able to ascertain what is the criteria used in order to distinguish "filtered" ports from "admin-prohibited" as they both seem ...
5
votes
1answer
14k views

Tracking down rogue wireless device on network

I have an unknown device that is connecting to my wifi router, and can't figure out what it is to save my life. I've never seen it before and haven't bought any new devices lately, it seems to have ...
3
votes
1answer
1k views

Why OpenVAS does not find all open ports compared to Nmap?

I recently launched a system discovery scan with OpenVAS to an IP from my net to compare its results to Nmap. As you can see in the image OpenVAS does not find all the ports Nmap does. Both scans ...
2
votes
1answer
1k views

nmap not running as root shows unknown open ports for a fraction of a second

On a server running Ubuntu 14.04.2 I was doing some basic security auditing when I ran the command nmap -p -d 1-65535 as a non-root user. Interestingly it reported a few (1-5 at a time, average, ...
14
votes
5answers
25k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
8
votes
5answers
28k views

Increase speed in nmap UDP scan?

How can I get nmap quicker in scanning UDP ports? This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
9
votes
4answers
7k views

nmap showing unknown IPs on private network

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
8
votes
2answers
7k views

Scanning my network with NMAP

Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
4
votes
3answers
11k views

Proxychains + nmap = segmentation fault

If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:- root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p 22,80,222,...
14
votes
2answers
13k views

different results using nmap with/without sudo

What is the reason that after running: $ nmap -sP 192.168.1.0/24 I got 3 results, but running: $ sudo nmap -sP 192.168.1.0/24 shows 7 results. What is the role of using sudo here?
10
votes
6answers
26k views

Is there a nmap command to get the top # most common ports?

I understand nmap by default scans the top 1k 'most common' ports (-F reduces to 100) I understand it gets these 'most common' ports based on the nmap-services file, specifically the frequency (3rd ...
1
vote
3answers
9k views

nmap -sP scan question

I'm trying to find the IP of my other computer on the network for penetration testing, but when I do -sP 192.168.1.1/24 I get all hosts are up (up to 255), and it doesn't identify any particular IP ...
11
votes
4answers
22k views

Filtered ports - What exactly filters them?

By the NMAP definition, unfiltered ports are the ones which cannot be determined to be open or closed since packet filtering prevents its probes from reaching the port. (ISBN 9780979958717 pag. 77) ...
9
votes
6answers
19k views

How to bypass Nmap blockage?

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside? Also, does blocking nmap on a network provide any security? ...
6
votes
2answers
9k views

Deauth all users on AP except yourself

I am looking to create a small first project to further my self education into infosec. I will be putting this on my Github. My idea is to create a script that automates the process of deauthing all ...
0
votes
2answers
12k views

Does having these ports open indicate any vulnerabilities?

I installed Ubuntu Gnome a couple of weeks ago along with a few packages and some software. When I scanned my localhost using Nmap, I got the following results. Are there any obvious vulnerabilities, ...
5
votes
3answers
21k views

nmap no ping returns host is active and all ports are filtered

I am trying to determine if hosts are up. For hosts where a ping fails, I run a Nmap (6.40) Regular and/or Quick Scan. For a subset of my hosts, the Nmap response is "Host seems down". As a follow up ...
4
votes
3answers
8k views

Can nmap take a list of ports to scan from a file?

Nmap can take a file containing a list of hosts to scan using the -iL flag. Is there similar functionality for a file containing a list of port numbers? I've scoured the man page, online docs at nmap....
8
votes
3answers
756 views

What are some instant red flags when scanning an network with nmap

When doing an Nmap scan from an external network, what open ports should be an instant red flag? For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
4
votes
1answer
656 views

Use nmap correctly

I currently have a VPS in a data center, I asked the admin to open a port to install a ftp server. It opened port 3345, at first I tought the port is not forwarded correctly, because I ran nmap as ...
3
votes
2answers
1k views

Router reboots when using Nmap

When I scan an external IP address with Nmap my router always reboots itself, sometimes I even have to manually restart it by using the power switch. The command I usually use is: nmap -p 1-65535 -...
2
votes
1answer
1k views

Result disparity between nmap and curl/nc for TRACE method

By using nc or curl I get HTTP status code 405 for TRACE requests, but if I scan my site with NMAP, it seems that TRACE is enabled. Could someone explain to me if TRACE is correctly disabled or not? ...
0
votes
1answer
101 views

what is the link between server certificate and cipher list advertised by server for nmap command?

Nmap out put for google.com. ssl-enum-ciphers. TLSv1.2: ciphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A. ...