Hot answers tagged

283

This is the simplest way of performing host discovery with nmap. nmap -sP 192.168.2.1/24 Why does it not work all the time ? When this command runs nmap tries to ping the given IP address range to check if the hosts are alive. If ping fails it tries to send syn packets to port 80 (SYN scan). This is not hundred percent reliable because modern host based ...


99

"tcpwrapped" refers to tcpwrapper, a host-based network access control program on Unix and Linux. When Nmap labels something tcpwrapped, it means that the behavior of the port is consistent with one that is protected by tcpwrapper. Specifically, it means that a full TCP handshake was completed, but the remote host closed the connection without receiving any ...


75

The easiest way to check this is to verify the ARP-tables after doing the ping sweep using nmap: arp -a -n This lists all hosts which responded to an ARP query, even the ones which filter ICMP.


52

To run an exploit, an attacker needs a vulnerability. To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs implement them and preferably the versions of those programs). To fingerprint a service, the attacker needs to know that there is one running on a publicly ...


40

All the tracerouting tools rely on the following principle: they send packets with a short life, and wait for ICMP packets reporting the death of these packets. An IP packet has a field called "TTL" (as "Time To Live") which is decremented at each hop; when it reaches 0, the packet dies, and the router on which this happens is supposed to send back a "Time ...


29

An open port is an attack surface. The daemon that is listing on a port, could be vulnerable to a buffer overflow, or another remotely exploitable vulnerability. An important principle in security is reducing your attack surface, and ensure that servers have the minimum number of exposed services.


25

Wireshark is cool too. You might want to check out Wireshark. It logs all of the traffic on the local network. It will tell you which nodes are broadcasting. You can also see what is being transmitted. It's available in the Ubuntu Software Center. Additionally here's a link about installing Wireshark on Ubuntu via command line. In regard to the traffic ...


18

First of all you need to understand how things actually work, so take a look here: NAT. This is how your router currently makes internet communication for all your hosts possible. So, everything is behind a NAT, and that's exactly why you can't access any host using your public IP address. If you want a machine inside your private home network to be ...


18

In a nmap -D scan, for scanning to return any result, your real IP address must be used amongst the pool of decoys. Without your real IP being used, you will not be able to receive any response from your target server, and nmap scanning would not work. The -D option creates confusion by introducing decoy IP addresses. So, if the target server is logging ...


18

The changelog for Nmap 6.49BETA6 says: [GH#171] smb-check-vulns has been split into: smb-vuln-conficker smb-vuln-cve2009-3103 smb-vuln-ms06-025 smb-vuln-ms07-029 smb-vuln-regsvc-dos smb-vuln-ms08-067 The scripts now use the vulns library, and the "unsafe" script-arg has been replaced by putting the scripts into the "dos" category. [...


17

You're most likely hitting a well-configured IDS/IPS appliance. snort can easily detect your port scan in progress with the sfPortscan filter (the -sS is practically a "portscan in progress" signature), and in addition to logging your attack, it can be configured to perform an active response. These responses can be as simple as sending you an RST, or as ...


16

Leaving a connection in syn_rcvd state will raise flags as well as this is a common denial of service attack. If you don't send a RST, the server will remain in a syn_rcv state for up to 60 seconds and retransmit the SYN ACK up to 5x. This will waste resources on the network you're scanning and cause a bunch of (depending on the speed and success of your ...


15

Nmap dev here: Sorry, but there is not an option to cleanly stop a scan and finalize the XML output. The --resume option, as you noted, only works with Normal and Grepable output. It also cannot cope with --randomize-hosts. Here are the stages of development we would need to undertake to make this possible: Extend --resume to parse Nmap's XML output for ...


15

I tend to take a legal eye when I look that this (IANAL). An NMAP scan of a target will always be active regardless of who performs the scan. Just because you shift the scanning responsibility to a third party doesn't change that fact. You might be able to argue that you retrieved the scan data passively, but I would argue otherwise based on the post. ...


15

Your first example uses the CIDR notation to specify the host range as a netmask. But since /150 is an illegal value for an IPv4 subnet mask, nmap falls back to the largest plausible value which is /32 (because an IPv4 address only has 32 bits), making you scan exactly one host: $ nmap -sn 192.168.2.1/150 Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-...


14

One approach is to analyse the TTL field on the packets. Time to live is an IP feature to mitigate routing loops. Every packet starts with a certain TTL value, usually 64, and each routing hop reduces the TTL by one. If the TTL gets to zero then the packet is dropped, and an ICMP "TTL expired in transit" message is returned. The traceroute utility uses the ...


13

Don't know really how to explain it differently as I think the nmap page explains it ok, but basically... Some hosts respond to pings if they are online (I.e. ping www.google.com and you get a reply.) Nmap tries pinging them, if they respond nmap continues scanning and you get your result. If it gets no response it says 'hmm they must be down, well no ...


12

If you can send packets to the target machine, use nmap -O, which provides OS fingerprinting. If you can eavesdrop/intercept network traffic with the target machine, use pof, a tool for passive OS fingerprinting. You didn't provide much information about what are your constraints or why the standard tools (like nmap or pof) didn't work for you. Therefore, ...


12

It doesn't really work like that. Ports don't pose a security risk in themselves; it's the application listening on a port that has the risk attached. And, how vulnerable any given application might be depends on many factors - is the application well patched? Is it well configured? So you can't just say "VNC is a risk", what VNC server is it? What ...


12

FTP has a "feature" in it that allows one party to request that the FTP server send a file to another party, in effect acting as a proxy. This is really a vulnerability: if that feature is enabled on an internet-facing FTP server then that server could be used as a jumping off point for attacks on whatever the FTP server can connect to. This "feature" has ...


12

Try with this command nmap -sn --traceroute <remote_ip> And lookup these: https://serverfault.com/questions/432017/whats-going-on-with-traceroute https://svn.nmap.org/nmap/zenmap/share/zenmap/config/scan_profile.usp http://seclists.org/basics/2011/Mar/19


12

I would assume that the range you are trying to scan is fe80:0000:0000:0000:0000:0000:0000:0000/112 which is the last 16 bits (the last section) of the address. That range includes 65,536 IPv6 addresses, probably all of which are going to time out when scanned. It will probably take most of a day (86,400 seconds - close enough to 65,536 at one second per ...


12

UDP scanning is likely to be slower than TCP due to the differences in how the protocol works (i.e. with TCP it's easier to establish that a port is open due to the three-way handshake). That said it's possible to increase the speed of UDP scans in a couple of ways. one thing to watch for here is that if you apply too many timing options you risk reducing ...


11

If you saved Nmap's XML output, there is an attribute of the <state> tag called reason, which will give you the reason Nmap chose to label a port closed, open, or filtered. This is usually something like "reset", "conn-refused", "syn-ack", or "port-unreach", depending on the kind of scan and the state of the port. This information can also be viewed in ...


11

There is a specific URL for that : scanme.nmap.org Hello, and welcome to Scanme.Nmap.Org, a service provided by the Nmap Security Scanner Project and Insecure.Org. We set up this machine to help folks learn about Nmap and also to test and make sure that their Nmap installation (or Internet connection) is working properly. You are authorized to ...


11

The thing about passive sniffing is that you don't get other people's network traffic unless you're either in a position to see that traffic due to network topology (e.g. you're sniffing a trunk port) or are doing network spoofing (e.g. ARP spoofing) that causes packets to be sent to your device. If they're doing the latter, you just need to look out for ...


11

Here is the relevant line from the command line help output ofnmap. -Pn: Treat all hosts as online -- skip host discovery The -Pn flag allows nmap to assume that the host is online because you told nmap that the host is online.


11

Possibilities: You are using a VM with a virtual NAT (Network Address Translation) network adapter. I have experienced profound slowdown under VirtualBox, for instance, when using NAT instead of a bridged network adapter. You are scanning something that isn't there. The -Pn option means "don't bother trying to find out if anything is listening at this ...


11

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. Apart from that using any kind of proxy means that nmap communicates with the IP stack of the proxy and not of the target. This means: ICMP ping can not be done to ...


11

The support for proxy with nmap is very limited. Especially you cannot do any kind of ICMP (ping) or UDP scans, no SYN stealth scan, no OS detection etc. This means that the default nmap commands you are using will not work with a proxy and depending on the implementation will either fail or will bypass the proxy. You have to limit yourself to only the kind ...


Only top voted, non community-wiki answers of a minimum length are eligible