Questions tagged [nmap]

Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, thus creating a "map" of the network.

Filter by
Sorted by
Tagged with
0
votes
1answer
93 views

Run nmap in a Docker container as a non-admin user

I'd like to run the Nmap tool in a Docker container but not with the default root user account. I already set the (hopefully) right capabilities via setcap. Unfortunately, I get only the "...
0
votes
2answers
40 views

can ping but not arping via OpenVPN

I'm working on a remote machine using OpenVPN at a customer's network. The IP addresses there change dynamically and (until they get hostnames to work properly which is not in my hands at this point) ...
0
votes
0answers
38 views

Why is nmap slower than arp-scan?

I am trying to find hosts on my network by doing an ARP scan. I first did this using the "arp-scan" tool (available on most linux distributions): arp-scan 192.168.86.0/24. This printed ...
0
votes
1answer
111 views

Is there a built-in way to proxy SSH through socks5?

I have a Socks5 proxy that uses username/password authentication. I can use it with SSH using NCAT in the ProxyCommand: ssh -o ProxyCommand="ncat --proxy-type socks5 --proxy-auth username:...
2
votes
1answer
38 views

Unable to ping scan my machine (but I can ping)

I need to perform an nmap scan on all of the (responding) IPs in an array of VLANs. The command is nested in a PowerShell for loop and looks something like this: nmap.exe -Pn -T4 -A -oG [FILE].txt -oX ...
0
votes
0answers
11 views

PSAD only showing router ip address

So I set up PSAD on my server, and tried testing it using an nmap scan. I used: nmap -A -p- hostname.tld and PSAD is only showing an attack coming from the router (192.168.1.1) (I am testing from ...
0
votes
1answer
626 views

How do I block port 22 to prevent incoming ssh on Ubuntu?

I'm trying to block port 22 to disallow incoming ssh connections on a Ubuntu VM. I have issued the command: $> iptables -A INPUT -p tcp -dport 22 -s ###.##.##.## -j DROP But I can still ssh into ...
1
vote
2answers
307 views

nmap - get ssl expiration from fqdn

lets say i have the following url: www.domain.com:4567/blabla/index.html I'm trying to get its' ssl expiration date. There's this: nmap --script=ssl-cert.nse -p 9194 www.domain.com but it doesnt ...
0
votes
1answer
119 views

Why should I press enter twice to send HTTP request in ncap/nmap?

I need to set up a manual connection with a domain and send an HTTP request. Like this : https://nmap.org/ncat/guide/ncat-usage.html As it mentions I should hit enter twice. But all commands on CMD I ...
0
votes
1answer
41 views

I cant block ACK packets going through port 80

I want to block nmap's ack ping probes and in order to do that, I fist need to block all incoming ack packets coming on port 80. I used this command but it didnt work: iptables -A INPUT -p tcp --dport ...
-1
votes
1answer
454 views

firewalld causing nmap to return host seems down

I've two machines, server1 and server2. On server2, I stop firewalld. [root@server2 ~]# systemctl stop firewalld From server1, nmap returns Host is up. [root@server1 ~]$ nmap -sn server2 Starting ...
1
vote
1answer
2k views

nmap failing to resolve some IPs to hostname

My objective here is to get nmap to resolve IPs to hostnames without the --system-dns flag or the --dns-servers option. When I issue the following nmap command without the --system-dns flag or --dns-...
0
votes
0answers
78 views

Sometime nmap reports port as open or filtered

I was trying to "ping" my router from outside network. Regular ping is blocked so I tried nmap: nmap -Pn <IP> Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-13 08:39 UTC Nmap scan ...
0
votes
1answer
228 views

How to enumerate ciphers for mysql server using nmap

Can nmap be used to enumerate tls ciphers against mysql service? I am able to run testssl.sh to enumerator ciphers against mysql service, but running nmap does not enumerate ciphers (as shown below). ...
0
votes
0answers
90 views

After a while, port 80 shows as closed

After 2 years uptime, my server with gitlab (on premise) can't be reached, because the nginx proxy server can not listen to port 80. When I restart nginx it is usually working fine for 3 days or so. ...
0
votes
1answer
668 views

Can't open port with ufw

I need to open the port 8081 for my application. I want to connect to the application from another server. Problem I can't open the port. I started the application with port 8081 and ip 0.0.0.0 and ...
0
votes
1answer
90 views

How to check the udp port is accessible in an Ubuntu machine which is protected by a firewall

We were trying to install "Big blue button" in an Ubuntu server with a firewall. For installation, we need these UDP ports ("16384-32768") should be opened in the firewall. But we don't know whether ...
1
vote
1answer
383 views

Scan IP range for SSL/TLS versions and vulnerabilities with legible/greppable output

I'm looking to find computers on the network that are using older versions of tls/ssl. So far I've been using nmap's ssl-enum-ciphers and ssl-poodle scripts but the output isn't helpful as it shows ...
0
votes
1answer
398 views

Discover IPMI IP address by scanning all possible direct LAN addresses

I have a Supermicro server board that powers on but wont post. I have connected a LAN cable to the dedicated IPMI LAN port on the board and am trying to discover what the IPMI IP address of the board ...
1
vote
2answers
1k views

nmap host discovery to get MAC Address

I notice that nmap -sn is no longer provide the MAC address for remote host as discussed in Can I use nmap to discover IPs and mac addresses? I would like to get something like netdiscover output. ...
0
votes
0answers
40 views

Pingable device not detected by Nmap

I've used Nmap for quite a while and work with it on a regular basis as a network admin. Today I noticed something rather odd while scripting Android Development Bridge Functions, I'm able to ping and ...
1
vote
1answer
615 views

Scan a list/range of IP addresses to find out which SSL Certificates each one is using

I have a list of internal IP addresses 1000+ strong, most of which I suspect are running services on port 443 and therefore will have a certificate installed on the server. These ips all exist on ...
1
vote
0answers
304 views

Azure SQL Database firewall allows TCP connections when they should be blocked

I am looking at a particular Azure SQL Database that has Server level firewall rules. I am told there are no database level firewall rules. Nmap reported open ports on the database even though the ...
0
votes
1answer
90 views

Firewall: How to identify forbidden ports based on a whitelist of allowed ports per target-host?

Assume I have a list of hosts I want to scan. For each host I have a list of allowed ports. 192.168.1.2;80,443 192.168.1.3;3306 The list above reads "1st IP is allowed to have port 80 and 443 open, ...
0
votes
1answer
237 views

Ho to use NMAP to check if a port is filtered by a firewall?

I have the following situation. I should have the access to a VM via SSH but trying to connect to this machine I obtain no response. I suspect that some firewall rules are blocking my request (so it ...
-1
votes
1answer
410 views

Apache2 not working with port 80 but working on port 8000 in Proxmox (same configuration)

Some months ago I hired a Kimsufi server, I tried to forward ports without luck. I abandon the server, some days ago I started to reconfigure everything again, but I'm having still problems. I ...
2
votes
1answer
1k views

Why Nmap doesn't arp-scan find any devices when does?

When I run nmap -sn 192.168.0.0/24 I get the result: Nmap scan report for 192.168.0.1 host is up (0.16s latency). Nmap scan report for 192.168.0.103 host is up (0.19s latency). Nmap scan report for ...
2
votes
1answer
280 views

Why do some unknown hosts show up with nmap option-sL , and not with -sn [and do I need to worry about them]?

Initial Disclosure I am not a network engineer and my expertise in this area is low. Background while using nmap 7.70 with nmap -sL to look for the IP address of a known device on our local ...
-2
votes
1answer
593 views

Hostname and Operating System - what is the best way to do the scan? [closed]

Is it possible to run an Nmap scan that give the output for Operating system and the hostname? If so what are the flags that needs to be used?
0
votes
1answer
529 views

nmap - how to find port forwarding to SSH

I have a firewall that forwards port 2222 to a Linux machine running SSH server on port 2222. The problem is I do not know what the IP of the firewall is. So I want to scan the subnet to tell me ...
1
vote
3answers
250 views

Nmap - Specify which probe(s) to use?

I'm trying to determine if it's possible to specify probe types for nmap to use. For example, I want to scan a subnet (say 192.168.0.0/24) and probe every port on every host to see if a web server is ...
0
votes
1answer
96 views

nmap - get detailed output for requests?

Update 2: pf already defaults to drop. What causes nmap to notice the server? What does 'received reset' mean? Update 1: Maybe I misinterpreted my findings. When run with -v2, nmap tells me that "...
0
votes
1answer
108 views

why same nmap command behaves different at server than local machine?

I am running this nmap command on local machine (Windows 10 with nmap https://nmap.org/book/inst-windows.html) nmap --script ssl-enum-ciphers -p 443 api.valorebooks.com and it is showing SSL ...
0
votes
1answer
44 views

Using nmap to scan an entire range

I found many examples with nmap online, but I got curious and I could not find a more advanced command. For example, if I want to scan a rage of ip in this measure, 192.168.x.x, then from 192.160.0.0 ...
-2
votes
1answer
193 views

Nmap takes forever when pinging ports [closed]

When I execute nmap -sn 192.168.1.0/24, it takes 12 seconds to find 256 hosts but when I execute nmap -sS 192.168.1.0/24, it takes forever. Why is this happening? I cannot see what I did wrong. ...
0
votes
1answer
54 views

NMap Topologie missing Switches (no kind of Topology)

I did scan some of our Networks but for any reason NMap doesnt applies any kind of topologie. It seems like there is everything connected directly but there are switches in between and those ...
0
votes
1answer
173 views

why does ssh tunnel leaves ports opened with default services

I haven't tried in a different machine, but I am trying to establish an ssh tunnel to an external server. This how I am doing it: ssh -L 9898:firewalled.service.com:443 user@some-server I have 2 ...
0
votes
1answer
3k views

Nmap reporting open http-proxy on 8080, but none is running

While executing the following command from my Mac OSX: nmap -PN server.com It reports the following: Starting Nmap 7.70 ( https://nmap.org ) at 2019-04-18 16:14 EDT Nmap scan report for server....
1
vote
0answers
231 views

NPing gives significantly less time on `TCP Connect` than `TCP`

I'm using NPing (NMap's pinging tool) to measure latency on specific servers that may not respond to ICMP. Also, servers do not usually run HTTP(S) and I only check latency on a specific TCP port ...
0
votes
1answer
227 views

nmap output in csv format sorted by last octet in ip address

I have this command which works well to give me a list of ip address, MAC address, and Mac Vendor sudo nmap -sn 192.168.0.0/24 | awk '/Nmap scan report for/{printf $5;}/MAC Address:/{print " "substr($...
0
votes
1answer
1k views

Strange NMAP output

I am trying to scan TCP port 8092 of a host using nmap 7.60. When I execute nmap without root privileges it says that the port is filtered, but if I try to scan it with sudo it tells me that the port ...
1
vote
1answer
590 views

Why does nmap show port 25 as open? Server's firewall should block port 25

nmap 7.70 executed remotely shows the server's port 25 as open. However, the firewall on my VPS server only opens ssh, http and https services. On the laptop: nmap x.x.x.x Not shown: 996 filtered ...
0
votes
1answer
367 views

regular nmap scan flaky; hosts are missing sometimes

I'm using nmap 7.6 to scan my local wired network every minute. The problem is that the scan results are flaky: Sometimes hosts are missing in the result, although they are definitively available (e....
0
votes
1answer
1k views

IP Camera does not show open ports for RTP streaming but shows RTSP port open

I ran nmap on my IP camera to see what ports are open. I see a RTSP port open on port no 554, as expected. However, I do not see any ports open for RTP-RTCP streaming. Here is the output of nmap: ...
0
votes
0answers
53 views

Turned off SSL's in JBOSS nmap thinks different

I set my JBOS server to use TLS only with the following line in the connector sslEnabledProtocols = "TLSv1.1,TLSv1.2" but when I check the server with NMAP it shows: ssl-enum-ciphers: | SSLv3: | ...
0
votes
1answer
4k views

iptables rules and port scanners blocking

In order to block port scanners on Linux, i have found some rules on iptables to block attacker IP address. These rules work correctly and it blocks the attacker, and logs the attacker ip address in ...
1
vote
1answer
1k views

netstat vs nmap to find IPs in a local network

I'm in a local network : IPv4 shared address space (100.x.x.x). Connected to a wifi hotspot. Ip ranges : 100.76.164.0/23 When I run : nmap 100.76.164.0/23 : It says all the hosts are down netstat -...
0
votes
1answer
51 views

Nmap Performance Mass Scanning SSL/TLS Certificate Data

Is Nmap built to use all of the available resources eg. in a server such as Dell PowerEdge T620 Server Xeon 16 Core 2.6GHz 128GB RAM with connectivity to both network ports? Basically, would the ...
1
vote
1answer
2k views

nmap port 22 filtered implications

I did the nmap scan on the list of external public ip (linux hosts). I tried to test out if any not needed services are opened. I realized there are many unfiltered ports on ssh tcp/22, however when ...
1
vote
1answer
1k views

How to prevent nmap from fingerprinting HAProxy

In our periodic security scans, our HAProxy instances are always reported as a version disclosure vulnerability. On further inspection, it appears that there are no version banners in any responses ...

1
2 3 4 5