Skip to main content
54 votes
Accepted

Why do hackers scan for open ports?

To run an exploit, an attacker needs a vulnerability. To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs ...
Philipp's user avatar
  • 49.4k
23 votes
Accepted

Nmap - Closed vs Filtered

This largely depends on the used scan. The Nmap scan types page explains the status of the port and the reasons per scan. Some examples: TCP SYN Scan (-sS) - Sends a TCP packet with SYN flag set - ...
Nomad's user avatar
  • 2,389
21 votes
Accepted

Nmap through proxy

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. ...
Steffen Ullrich's user avatar
19 votes
Accepted

Missing scripts in NMAP

The changelog for Nmap 6.49BETA6 says: [GH#171] smb-check-vulns has been split into: smb-vuln-conficker smb-vuln-cve2009-3103 smb-vuln-ms06-025 smb-vuln-ms07-029 smb-vuln-regsvc-...
bonsaiviking's user avatar
  • 11.7k
18 votes
Accepted

Why doesn't `nmap -sn 192.168.2.1/150` show the hosts that are up?

Your first example uses the CIDR notation to specify the host range as a netmask. But since /150 is an illegal value for an IPv4 subnet mask, nmap falls back to the largest plausible value which is /...
Arminius's user avatar
  • 44.9k
17 votes
Accepted

How to use nmap through proxychains?

The support for proxy with nmap is very limited. Especially you cannot do any kind of ICMP (ping) or UDP scans, no SYN stealth scan, no OS detection etc. This means that the default nmap commands you ...
Steffen Ullrich's user avatar
17 votes
Accepted

What's the advantage of sending an RST packet after getting a response in a SYN scan?

Leaving a connection in syn_rcvd state will raise flags as well as this is a common denial of service attack. If you don't send a RST, the server will remain in a syn_rcv state for up to 60 seconds ...
Jeff S.'s user avatar
  • 286
15 votes

How to use nmap through proxychains?

You have to use the -sT option -- the Connect() scan technique. Otherwise nmap will use the SYN method, canceling out proxychains. For you example, this would be proxychains nmap -sT -v scanme.namp....
gmelis's user avatar
  • 251
15 votes
Accepted

Is external Nmap scan considered active or passive?

I tend to take a legal eye when I look that this (IANAL). An NMAP scan of a target will always be active regardless of who performs the scan. Just because you shift the scanning responsibility to a ...
Shane Andrie's user avatar
  • 3,840
15 votes
Accepted

Nmap scan what does STATE=filtered mean?

Filtered is described in the NMAP Reference Guide, Chapter 15: Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering ...
Demento's user avatar
  • 7,465
15 votes
Accepted

How do you scan multiple subnets using Nmap?

Let's see the first five lines of the help: Nmap 7.92 ( https://nmap.org ) Usage: nmap [Scan Type(s)] [Options] {target specification} TARGET SPECIFICATION: Can pass hostnames, IP addresses, ...
Esa Jokinen's user avatar
  • 19.1k
14 votes
Accepted

Make server return "Unable to split netmask from target expression"

You are entering a URL with / in it rather than a hostname, and the tools you're using are treating that as a CIDR address (and then failing to parse it). Compare the following (wrong way, right way):...
gowenfawr's user avatar
  • 72.9k
14 votes

How to verify which for domains (if any) is this certificate valid for?

First you need to decode all the HTML/XML entities like - etc. Once you've done this you get something like this: -----BEGIN CERTIFICATE----- ...
Steffen Ullrich's user avatar
12 votes

What's the advantage of sending an RST packet after getting a response in a SYN scan?

This is technically false: Nmap does not send a RST at any point in the half-open SYN scan. Instead, it relies on the scanning machine's OS to send RST packets in response to what the kernel views as ...
bonsaiviking's user avatar
  • 11.7k
12 votes
Accepted

Connection to ports 2000 and 5060 successful despite filtering

There is something between the scanner and the target that is responding on behalf of the target, spoofing its source address so as to appear to be the target itself. When you ran the Nmap scan as ...
bonsaiviking's user avatar
  • 11.7k
11 votes

Nmap through proxy

For now, use an external tool like proxychains. The nmap documentation for --proxies states, that the feature is not fully implemented yet: Warning: this feature is still under development and has ...
Arminius's user avatar
  • 44.9k
10 votes
Accepted

Can nmap take a list of ports to scan from a file?

Not by itself, no. But with some quick scripting you can. For example, on *nix systems: nmap -p `cat ports.list` ... This would allow you to maintain a list of ports in a file in a CSV format. If ...
h4ckNinja's user avatar
  • 3,066
10 votes

Nmap default scan technique

When scanning TCP ports, Nmap will do a SYN scan by default and fall back to a connect scan if the user doesn't have sufficient privileges. From the docs: -sS (TCP SYN scan) SYN scan is the ...
Arminius's user avatar
  • 44.9k
9 votes

Missing scripts in NMAP

Basically just run --script vuln instead of --script smb-check-vulns and you will get your results. In the latest NMAP versions "vuln" is a category that has all vulnerabilities in them instead of a ...
Jake's user avatar
  • 91
9 votes
Accepted

How can the nmap tool be used to evade a firewall/IDS?

There are various ways that comes handy with nmap to evade the basic Firewall rules or Intrusion Detection Systems (IDS). Packet Fragmentation: This option evade pattern matching detection technique....
Scissor's user avatar
  • 106
9 votes

nmap to scan all resolved ip addresses for a given domain name?

Nmap has a script to do this, resolveall. The interface isn't as nice as it could be: you have to provide the hostname via the resolveall.hosts script argument. Here's how to do that and also add any ...
bonsaiviking's user avatar
  • 11.7k
9 votes
Accepted

Find SMBv1 status with Nmap

There is not currently a script to check for this. It would be a trivial change to the existing smbv2-enabled script. Currently, the script has three possible outputs: No output: SMB of any version ...
bonsaiviking's user avatar
  • 11.7k
9 votes
Accepted

Multiple Open ports on a server, is that safe?

There are a lot of misunderstandings and assumptions in your question, but I will try to address them. First, you are scanning a domain (I assume from the Internet). Just because nmap shows them as ...
schroeder's user avatar
  • 131k
8 votes

Nmap says host down when host is up

Try nmap -Pn 192.168.0.171, also confirm try nc -z -v -w 1 192.168.0.171 80 if that does not work.
BMC's user avatar
  • 444
8 votes
Accepted

NMAP discovery scan reporting host offline, pinging the same host gets ICMP responses

If you want to run a ping scan, make sure you are running as root. From nmap archived docco: When you run an Nmap ping scan as root, the default is to use the ICMP and ACK methods. Non-root ...
SilverlightFox's user avatar
8 votes
Accepted

Ports Showing Closed/Filtered in Nmap Scans

To avoid 65K+ lines of mostly-useless output, Nmap collapses most "uninteresting" results into a line that says something like "Not shown: 65530 filtered ports." Open ports are never collapsed this ...
bonsaiviking's user avatar
  • 11.7k
8 votes
Accepted

Why can I ping a server, but nmap normal scan cannot see the host?

From nmap.org: If no host discovery options are given, Nmap sends an ICMP echo request, a TCP SYN packet to port 443, a TCP ACK packet to port 80, and an ICMP timestamp request. ... For unprivileged ...
multithr3at3d's user avatar
7 votes

How to find live hosts on my network?

Once you have administrator privileges (i.e., root), you can use netdiscover(8) with -r flag to specify different class and mask. It uses network class C /24 by default. For example: $ sudo ...
slayer's user avatar
  • 462
7 votes
Accepted

Tracking down rogue wireless device on network

Rass, yes I remembered 4 years ago my network guy reported the very same problem. The accounts department went and bought a Brother wireless printer & connected it via wifi. turns out it's MAC ...
TheIriekid's user avatar
7 votes
Accepted

Nmap: Spoofing IP adress (-S option) or using Proxy chains, what's the difference?

No. Scanning through a proxy allows you to scan from the IP of that proxy, and it only works with certain scan types, as you're just tunneling traffic through a proxy server. Connect scans are the ...
Polynomial's user avatar
  • 135k

Only top scored, non community-wiki answers of a minimum length are eligible