Questions tagged [nmap]
Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, thus creating a "map" of the network.
257
questions
0
votes
1
answer
644
views
Using nmap to scan an entire range
I found many examples with nmap online, but I got curious and I could not find a more advanced command. For example, if I want to scan a rage of ip in this measure, 192.168.x.x, then from 192.160.0.0 ...
- 11
-2
votes
1
answer
784
views
Nmap takes forever when pinging ports [closed]
When I execute nmap -sn 192.168.1.0/24, it takes 12 seconds to find 256 hosts but when I execute nmap -sS 192.168.1.0/24, it takes forever. Why is this happening?
I cannot see what I did wrong. ...
1
vote
1
answer
314
views
NMap Topologie missing Switches (no kind of Topology)
I did scan some of our Networks but for any reason NMap doesnt applies any kind of topologie.
It seems like there is everything connected directly but there are switches in between and those ...
- 59
0
votes
1
answer
331
views
why does ssh tunnel leaves ports opened with default services
I haven't tried in a different machine, but I am trying to establish an ssh tunnel to an external server. This how I am doing it:
ssh -L 9898:firewalled.service.com:443 user@some-server
I have 2 ...
1
vote
2
answers
10k
views
Nmap reporting open http-proxy on 8080, but none is running
While executing the following command from my Mac OSX:
nmap -PN server.com
It reports the following:
Starting Nmap 7.70 ( https://nmap.org ) at 2019-04-18 16:14 EDT
Nmap scan report for server....
- 146
1
vote
0
answers
622
views
NPing gives significantly less time on `TCP Connect` than `TCP`
I'm using NPing (NMap's pinging tool) to measure latency on specific servers that may not respond to ICMP. Also, servers do not usually run HTTP(S) and I only check latency on a specific TCP port ...
- 111
0
votes
1
answer
484
views
nmap output in csv format sorted by last octet in ip address
I have this command which works well to give me a list of ip address, MAC address, and Mac Vendor
sudo nmap -sn 192.168.0.0/24 | awk '/Nmap scan report for/{printf $5;}/MAC Address:/{print " "substr($...
0
votes
1
answer
2k
views
Strange NMAP output
I am trying to scan TCP port 8092 of a host using nmap 7.60. When I execute nmap without root privileges it says that the port is filtered, but if I try to scan it with sudo it tells me that the port ...
- 133
1
vote
1
answer
2k
views
Why does nmap show port 25 as open? Server's firewall should block port 25
nmap 7.70 executed remotely shows the server's port 25 as open. However, the firewall on my VPS server only opens ssh, http and https services.
On the laptop:
nmap x.x.x.x
Not shown: 996 filtered ...
- 213
0
votes
1
answer
748
views
regular nmap scan flaky; hosts are missing sometimes
I'm using nmap 7.6 to scan my local wired network every minute.
The problem is that the scan results are flaky: Sometimes hosts are missing in the result, although they are definitively available (e....
- 817
0
votes
1
answer
2k
views
IP Camera does not show open ports for RTP streaming but shows RTSP port open
I ran nmap on my IP camera to see what ports are open. I see a RTSP port open on port no 554, as expected. However, I do not see any ports open for RTP-RTCP streaming.
Here is the output of nmap:
...
- 125
0
votes
0
answers
105
views
Turned off SSL's in JBOSS nmap thinks different
I set my JBOS server to use TLS only with the following line in the connector
sslEnabledProtocols = "TLSv1.1,TLSv1.2" but when I check the server with NMAP it shows:
ssl-enum-ciphers:
| SSLv3:
| ...
- 73
0
votes
1
answer
7k
views
iptables rules and port scanners blocking
In order to block port scanners on Linux, i have found some rules on iptables to block attacker IP address.
These rules work correctly and it blocks the attacker, and logs the attacker ip address in ...
- 763
1
vote
1
answer
2k
views
netstat vs nmap to find IPs in a local network
I'm in a local network : IPv4 shared address space (100.x.x.x). Connected to a wifi hotspot. Ip ranges : 100.76.164.0/23
When I run :
nmap 100.76.164.0/23 : It says all the hosts are down
netstat -...
- 11
0
votes
1
answer
177
views
Nmap Performance Mass Scanning SSL/TLS Certificate Data
Is Nmap built to use all of the available resources eg. in a server such as Dell PowerEdge T620 Server Xeon 16 Core 2.6GHz 128GB RAM with connectivity to both network ports? Basically, would the ...
- 1
1
vote
1
answer
8k
views
nmap port 22 filtered implications
I did the nmap scan on the list of external public ip (linux hosts). I tried to test out if any not needed services are opened.
I realized there are many unfiltered ports on ssh tcp/22, however when ...
- 11
1
vote
1
answer
2k
views
How to prevent nmap from fingerprinting HAProxy
In our periodic security scans, our HAProxy instances are always reported as a version disclosure vulnerability. On further inspection, it appears that there are no version banners in any responses ...
- 111
2
votes
2
answers
15k
views
In Linux server - how to check if established TCP port connection supports TLS 1.2
I have a Linux server that has an established TCP port connection to a client. Can I somehow check if the connection on this port supports TLS 1.2 with any of the networking commands on a basic Linux ...
- 21
1
vote
0
answers
382
views
nmap showing different results every time
I am running:
nmap -sP 192.168.251.0/24
to see the hosts in the office network.
Every time that I run the command it shows a different result, for instance it sometimes shows
192.168.251.13
192....
0
votes
1
answer
4k
views
What is service "ismserver" listening on port 9500?
I am on Ubuntu 16.04
Upon nmap -sV localhost, I came upon the output line 9500/tcp filtered ismserver which I cannot recognize.
The service ismserver listening on the port matches the IANA record, ...
- 101
0
votes
1
answer
3k
views
Hide running service such as Nginx from a port scan
When I run a Port Scan to my server through NMap (like this)...
$ nmap -A -p443 example.com
...then I get an output like...
Starting Nmap 7.70 ( https://nmap.org ) at 2018-03-29 00:14 BST
Nmap scan ...
- 33
-1
votes
1
answer
45
views
Weird behavior of VPS host
Hi I noticed strange behavior on my VPS host
I launch nmap on my laptop and scan VPS host
nmap screenshot
Listed netstat on VPS server
netstat screenshot
Tried to connect to some port
connection ...
- 1
1
vote
1
answer
11k
views
SQL Server 2014 Disable SSL/TLS
I am running SQL Server 2014 on Server 2012 R2. Both are updated and current. I did a clean install of both and nothing else. I then requested VPN access for an offsite vendor and our security group ...
- 31
1
vote
1
answer
84
views
Can a Syslog server recognize a client OS?
I recently set up a central syslog server. Logs are organized in files, in folder named after the client machines (using DNS), and scanned with logcheck.
Some of the client machines have more than ...
- 103
0
votes
0
answers
4k
views
How to disable CONNECT method in Apache 2.4.29 and return 405 status?
I'm using Apache 2.4 as a reverse proxy and according to this post, I have no use for the HTTP CONNECT method. So I tried disabling proxy_connect module when I built Apache using configure (static) ...
0
votes
2
answers
1k
views
Scanning internal network in search of Jenkins instances
I have issues with find all Jenkins instances in environment: I've tride to use nmap with http-title script to find all that answer with Dashboard[Jenkins] but some of them had more redirections than ...
Schredis
-4
votes
1
answer
895
views
Difference between local and remote nmap - trying to set up mysql server remote access [closed]
I am try to set up mysql remotely. I have followed a number of guides such as this, and I have ended up using nmap to see what ports are open.
When I am on my laptop, nmap -P0 <server> gives:
...
- 93
1
vote
3
answers
8k
views
SSL unsupported protocol error
I'm trying to use ncat to connect between virtual windows7 and linux machines.
On linux:
ncat -vnl 4444 --ssl
On windows:
ncat -v 10.10.14.2 4444 --ssl
And when I try to connect from the client I ...
- 111
1
vote
1
answer
3k
views
Apache/Tomcat web server: nmap always returns that all http-methods are allowed
I'm running a web server with Apache http server in front of an Apache Tomcat server.
My goal: Disable http-methods DELETE and PUT on the web server.
According to OWASP (https://www.owasp.org/index....
- 335
2
votes
2
answers
3k
views
ssh-keyscan does not reveal DSA ssh-dss key
I am using ssh-keyscan to obtain public keys for a couple of SSH servers. One of my appliances only supports DSA / ssh-dss. ssh-keyscan with the "-t dsa" option is not able to get the public key while ...
2
votes
3
answers
6k
views
Port scanning and Windows Firewall
I am trying to understand the results I am getting when scanning ports on a machine that has an active built-in Windows Firewall. My test environment has two Windows 7 machines running in Hyper-V VMs ...
- 21
1
vote
1
answer
10k
views
What is the fastest way to scan all ports of a single maching using tcp scan
After reading this post here, from security.stackexchange, I was wondering what is the best way to scan all ports of a single maching using tcp scan only.
"nmap -sT -p 1-65535 localhost" is what I ...
- 11
0
votes
1
answer
183
views
getting hardware information of all devices on the network
I was wondering if i can get a full hardware information about each device on the network? (preferred linux commands) with the nmap command I found the devices in my net, but only name, ip addresses ...
- 1
1
vote
1
answer
567
views
ncat on UDP protocol (RH 7)
I'm resuming the discussion "Check if remote host/port is open - Can't use GNU Netcat nor NMap - RHEL 7".
I can't obtain the correct result because on my rh versions (5.6 and 7.1) there isn't the path ...
- 121
0
votes
0
answers
93
views
Scan network for all devices
I'm running into a small issue with a network, when I scan it using either nmap or even Fing for android, I can only get the router, and my device, even though I know other devices are connected. This ...
0
votes
1
answer
160
views
Port opened on RHEL but nmap cannot find it
I am using tomcat on RHEL7 cloud instance on default 8080 port. Opened port using sudo firewall-cmd --zone=public --add-port=8080/tcp --permanent, reloaded using sudo firewall-cmd --reload. Connecting ...
- 103
0
votes
2
answers
2k
views
use multiple ip addresses to tcp check remote server's port
Im trying to tcp connect yahoo's mail server on port 25 . I have 3 public ip addresses lets say:-
(all are allowed in SPF records)
99.99.99.99
77.77.77.77
88.88.88.88
How to telnet(or other checks) ...
- 618
1
vote
2
answers
923
views
Can nmap scan/test all answers from round-robin dns?
I have a round-robin dns record I want to test with nmap, currently it only tries one of the IPs (if I run a loop it checks each in order).
Is there a way to have nmap test all A/AAAA records from a ...
- 8,006
1
vote
2
answers
6k
views
Does anyone know better way to scan for IPMI devices?
Iam using a simple nmap scan on IPMI/BMC port 623/tcp.
Is this enough or Is there anything more I need to be aware using nmap?
nmap -p 623 IP-IPEND
- 71
3
votes
2
answers
117
views
Finding XP boxes on our intranet
We're out on a mission to find and eradicate XP boxes on our intranet.
Now we're wondering what the fastest (scan) method might be --XP boxes connected to our active directory have already been ...
- 489
0
votes
1
answer
4k
views
NFS troubles: showmount -e {server IP} doesn't work
I'm having a number of troubles setting up an NFS mount on a Ubuntu server, and the main issue seems to be in making connection from the client (a Mac).
I can ping the server address fine.
Here is ...
- 111
3
votes
2
answers
5k
views
TLS version scan discrepancy between nmap, openssl, ssllab
I am trying to scan an endpoint to see what TLS version it is running and I am seeing some discrepancy between the nmap scan and the openssl scan. Scanning the same host I see only TLSv1.0 from nmap (...
- 53
3
votes
0
answers
1k
views
nmap reports IP address is active, when the network device is turned off?
I want to remotely examine if some servers are up.
I don't use the ping command because it gives a lot of wrong results like "destination host unreachable" and "request Timed out" due to bad ...
- 31
0
votes
2
answers
1k
views
Which ports does NMAP scan for OS-detection
nmap offers OS-detection functionality based TCP/IP fingerprinting by sending six probing packets and analyzing their responses. In the documentation is says that some of them are send to an open port ...
- 357
3
votes
2
answers
2k
views
How to defeat NMAP's TCP/IP fingerprinting method for OS-detection
I want to evade nmap's TCP/IP fingerprinting, which it uses to detect the OS on a machine. I read A practical approach for defeating Nmap OS-Fingerprinting which explains how this can be done. It also ...
- 357
1
vote
2
answers
3k
views
vsftpd hide version on port scan
I'm looking for methods (iptables rules, etc...) to prevent the version from showing on a nmap report for VSFTPD.
Currently, when executing: nmap -Pn -p 21 -sV localhost
Nmap scan report for ...
- 11
2
votes
1
answer
7k
views
Understanding the nmap ssl-enum-ciphers script
I'm testing Tomcat SSL configuration of my server and I was using the ssl-enum-ciphers script of nmap and the following warning appears:
Key exchange parameters of lower strength than certificate ...
- 127
-1
votes
1
answer
2k
views
Why does nmap scan of same target smtp server show port 25 missing
I am configuring a new server, on a new network and struggling to get outbound SMTP to work to known mail servers.
If I do an nmap scan from my existing server - port 25 shows up, but from my new ...
- 256
25
votes
1
answer
23k
views
Displaying nmap result gradually as results are found
To get nmap results, one has to wait for the end of the scan.
How can I force nmap to gradually display the newly found hosts and open ports while it is running?
- 583
4
votes
1
answer
9k
views
Fast and reliable way to scan a Class B network using nmap
I need to nmap scan a class B network within a short span of time. The requirements are quite straightforward. I want to:
Scan as fast as possible
Fulfill point 1 while maintaining reliability (...
- 191