Questions tagged [nmap]
Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, thus creating a "map" of the network.
254
questions
-1
votes
1
answer
127
views
How to find device names on local network?
Currently I'm trying to write a Python script to scan through my local network, and list all of the active IP addresses, and their corresponding MAC address and device name. Also all of the devices ...
-2
votes
1
answer
125
views
How to discover HTTPS servers on local network with certificate for particular hostname
I am making a network-connected device (using Raspberry Pi 4 inside), and I would like a way for these devices to discover each other (when on the same local subnet). I am vaguely aware of protocols ...
- 132
0
votes
0
answers
45
views
VMware Host only networks: Hosts not receiving NULL/FIN/XMAS packets using PFsense router
Setup:
2 host-only ints each connected to a separate host on a separate network
PFsense VM routing between 2 networks (implicit accept on both networks, no other rules)
Can receive normal, syn,syn/ack,...
- 1
2
votes
3
answers
235
views
nmap vulnerability scan reports " smtps on port 465 ssl-dh-params" vulnerability, on Ubuntu 20.04 webserver. How to close the vulnerabilty?
I am running an Ubuntu 20.04 LEMP (Linux, Nginx, MariaDb, PHP) email/web server. I am also doing some nmap vulnerability tests form my MacOS Client machine. On MacOS, I am using Oh My Zsh! with the ...
- 113
1
vote
1
answer
57
views
How can I use nmap against an IPoIB network?
I'm trying to use nmap to check which services are running on a given network but it cannot start just because nmap issues ARP Ping Scans on IPv4 network, and on a Infiniband Network, as far as I know,...
- 5,480
0
votes
0
answers
123
views
Ufw not showing open port
I'm new to linux and I use ufw to open / close ports on my Debian 11 VPS.
If I use ufw stauts verbose I get the following list of open ports:
To Action From
-- ...
-1
votes
1
answer
113
views
List all active devices in different subnets?
My company has a class A network that contains various subnets. I need to automate a way to produce a list of all online devices (in all the subnets). To start, just a list of responsive private IPs ...
- 11
-1
votes
1
answer
42
views
How to get OS and version of every server on network?
This is a case of "we are where we are". I'm a developer and I've been asked to get a list of every server on our network (IP and hostname) along with the OS version
We exclusively use ...
- 359
0
votes
1
answer
124
views
Will a web server get blacklisted for port scanning?
As I understand it, port scanning is an activity that can be a precursor to malicious activity, as one of the things it is used for is to scan for open ports that one can attack.
In that train of ...
- 311
1
vote
1
answer
137
views
Nmap - Print names from virtual hosts
I'm trying to identify virtual hosts with Nmap, command:
nmap --script http-vhosts -p80 {ip}
Nmap identifies a number of hosts. But how do I get the actual host names that are found? Now nmap only ...
- 11
2
votes
1
answer
2k
views
Nmap unable to resolve hostnames
I have tried running several nmap commands and I can't get the results to return host names. My results look like this:
Nmap scan report for 10.2.16.253
Host is up (0.0025s latency).
All 1000 scanned ...
- 23
0
votes
0
answers
475
views
Nmap ssl-enum-ciphers not showing ciphers with specific certificate running MS SQL 2019
I have a server running MS Sql 2019 Std.I have configured MS SQL to use SSL. I have a cert from entrust that when I scan with Nmap --script ssl-enum-ciphers fqdn does not show the TLS version for port ...
0
votes
1
answer
408
views
How to find Free IP address in a sub range?
We are using below command to figure out the IP addresses which are down (which is free IP address to use)
nmap -v -sn -n 192.168.1.0/24 -oG - | awk '/Status: Down/{print $2}'
I wanted to get a ...
- 1,311
0
votes
1
answer
105
views
is it possible to intercept only nmap scannings with IPtables?
I'm trying to redirect all scans coming from nmap to another destination.
I'm trying IPTABLES, but I have no idea on how to tell apart the nmap scanning from the legitimate traffic.
Is it something ...
0
votes
1
answer
277
views
Cannot Open Azure VM (Ubuntu 18.04) Port
Running the jupyter notebook server on port 8888 on the virtual machine. Trying to use port forward to my desktop (running Linux Mint). The server is running on the VM alright, but the port is closed ...
- 145
1
vote
1
answer
434
views
nmap not detecting clearly open udp port
I've opened port 4000 on my local machine as follows:
nc -lvup 4000
and then attempted to connected to the same port as follows:
nc -vu 127.0.0.1 4000
and was able to successfully connect and send ...
- 115
1
vote
1
answer
680
views
Scanning a range of ports with Ncat?
I'm aware that Nmap is the obvious choice for this task, however I would still like to know if it's possible to scan a range of ports with Ncat.
I see that I'm able to scan one port, but with a range ...
- 111
1
vote
1
answer
1k
views
Nmap results incorrect when connecting via VPN
I am trying to determine why my nmap results are incorrect when I am connected to a VPN provider.
As you can see below nmap reports that ports are open when connecting to a VPN provider even though ...
- 121
1
vote
1
answer
2k
views
Run nmap in a Docker container as a non-admin user
I'd like to run the Nmap tool in a Docker container but not with the default root user account. I already set the (hopefully) right capabilities via setcap.
Unfortunately, I get only the "...
- 13
0
votes
2
answers
521
views
can ping but not arping via OpenVPN
I'm working on a remote machine using OpenVPN at a customer's network. The IP addresses there change dynamically and (until they get hostnames to work properly which is not in my hands at this point) ...
- 101
2
votes
1
answer
3k
views
Is there a built-in way to proxy SSH through socks5?
I have a Socks5 proxy that uses username/password authentication. I can use it with SSH using NCAT in the ProxyCommand: ssh -o ProxyCommand="ncat --proxy-type socks5 --proxy-auth username:...
- 149
2
votes
1
answer
338
views
Unable to ping scan my machine (but I can ping)
I need to perform an nmap scan on all of the (responding) IPs in an array of VLANs.
The command is nested in a PowerShell for loop and looks something like this:
nmap.exe -Pn -T4 -A -oG [FILE].txt -oX ...
- 21
0
votes
1
answer
2k
views
How do I block port 22 to prevent incoming ssh on Ubuntu?
I'm trying to block port 22 to disallow incoming ssh connections on a Ubuntu VM. I have issued the command:
$> iptables -A INPUT -p tcp -dport 22 -s ###.##.##.## -j DROP
But I can still ssh into ...
1
vote
2
answers
3k
views
nmap - get ssl expiration from fqdn
lets say i have the following url:
www.domain.com:4567/blabla/index.html
I'm trying to get its' ssl expiration date.
There's this:
nmap --script=ssl-cert.nse -p 9194 www.domain.com
but it doesnt ...
- 639
0
votes
1
answer
415
views
Why should I press enter twice to send HTTP request in ncap/nmap?
I need to set up a manual connection with a domain and send an HTTP request.
Like this : https://nmap.org/ncat/guide/ncat-usage.html
As it mentions I should hit enter twice. But all commands on CMD I ...
- 105
0
votes
1
answer
132
views
I cant block ACK packets going through port 80
I want to block nmap's ack ping probes and in order to do that, I fist need to block all incoming ack packets coming on port 80. I used this command but it didnt work:
iptables -A INPUT -p tcp --dport ...
- 1
-1
votes
1
answer
2k
views
firewalld causing nmap to return host seems down
I've two machines, server1 and server2. On server2, I stop firewalld.
[root@server2 ~]# systemctl stop firewalld
From server1, nmap returns Host is up.
[root@server1 ~]$ nmap -sn server2
Starting ...
- 393
1
vote
1
answer
10k
views
nmap failing to resolve some IPs to hostname
My objective here is to get nmap to resolve IPs to hostnames without the --system-dns flag or the --dns-servers option.
When I issue the following nmap command without the --system-dns flag or --dns-...
- 393
0
votes
1
answer
1k
views
How to enumerate ciphers for mysql server using nmap
Can nmap be used to enumerate tls ciphers against mysql service?
I am able to run testssl.sh to enumerator ciphers against mysql service, but running nmap does not enumerate ciphers (as shown below). ...
- 101
0
votes
0
answers
285
views
After a while, port 80 shows as closed
After 2 years uptime, my server with gitlab (on premise) can't be reached, because the nginx proxy server can not listen to port 80.
When I restart nginx it is usually working fine for 3 days or so. ...
0
votes
1
answer
3k
views
Can't open port with ufw
I need to open the port 8081 for my application. I want to connect to the application from another server. Problem I can't open the port.
I started the application with port 8081 and ip 0.0.0.0 and ...
- 103
0
votes
1
answer
508
views
How to check the udp port is accessible in an Ubuntu machine which is protected by a firewall
We were trying to install "Big blue button" in an Ubuntu server with a firewall. For installation, we need these UDP ports ("16384-32768") should be opened in the firewall. But we don't know whether ...
- 47
1
vote
1
answer
1k
views
Scan IP range for SSL/TLS versions and vulnerabilities with legible/greppable output
I'm looking to find computers on the network that are using older versions of tls/ssl.
So far I've been using nmap's ssl-enum-ciphers and ssl-poodle scripts but the output isn't helpful as it shows ...
- 21
1
vote
1
answer
3k
views
Discover IPMI IP address by scanning all possible direct LAN addresses
I have a Supermicro server board that powers on but wont post.
I have connected a LAN cable to the dedicated IPMI LAN port on the board and am trying to discover what the IPMI IP address of the board ...
- 121
1
vote
2
answers
5k
views
nmap host discovery to get MAC Address
I notice that nmap -sn is no longer provide the MAC address for remote host as discussed in Can I use nmap to discover IPs and mac addresses?
I would like to get something like netdiscover output. ...
- 191
1
vote
1
answer
5k
views
Scan a list/range of IP addresses to find out which SSL Certificates each one is using
I have a list of internal IP addresses 1000+ strong, most of which I suspect are running services on port 443 and therefore will have a certificate installed on the server. These ips all exist on ...
- 21
1
vote
0
answers
641
views
Azure SQL Database firewall allows TCP connections when they should be blocked
I am looking at a particular Azure SQL Database that has Server level firewall rules. I am told there are no database level firewall rules. Nmap reported open ports on the database even though the ...
- 63
0
votes
1
answer
145
views
Firewall: How to identify forbidden ports based on a whitelist of allowed ports per target-host?
Assume I have a list of hosts I want to scan. For each host I have a list of allowed ports.
192.168.1.2;80,443
192.168.1.3;3306
The list above reads "1st IP is allowed to have port 80 and 443 open, ...
- 103
0
votes
1
answer
2k
views
Ho to use NMAP to check if a port is filtered by a firewall?
I have the following situation. I should have the access to a VM via SSH but trying to connect to this machine I obtain no response. I suspect that some firewall rules are blocking my request (so it ...
- 177
-1
votes
1
answer
3k
views
Apache2 not working with port 80 but working on port 8000 in Proxmox (same configuration)
Some months ago I hired a Kimsufi server, I tried to forward ports without luck.
I abandon the server, some days ago I started to reconfigure everything again, but I'm having still problems.
I ...
- 119
2
votes
0
answers
3k
views
why doesn't arp-scan find any devices when nmap does?
When I run nmap -sn 192.168.0.0/24 I get the result:
Nmap scan report for 192.168.0.1
Host is up (0.16s latency).
Nmap scan report for 192.168.0.103
Host is up (0.19s latency).
Nmap scan report for ...
- 121
2
votes
1
answer
749
views
Why do some unknown hosts show up with nmap option-sL , and not with -sn [and do I need to worry about them]?
Initial Disclosure
I am not a network engineer and my expertise in this area is low.
Background
while using nmap 7.70 with
nmap -sL
to look for the IP address of a known device on our local ...
-2
votes
1
answer
3k
views
Hostname and Operating System - what is the best way to do the scan? [closed]
Is it possible to run an Nmap scan that give the output for Operating system and the hostname?
If so what are the flags that needs to be used?
-1
votes
1
answer
2k
views
nmap - how to find port forwarding to SSH
I have a firewall that forwards port 2222 to a Linux machine running SSH server on port 2222. The problem is I do not know what the IP of the firewall is. So I want to scan the subnet to tell me ...
- 277
2
votes
3
answers
535
views
Nmap - Specify which probe(s) to use?
I'm trying to determine if it's possible to specify probe types for nmap to use. For example, I want to scan a subnet (say 192.168.0.0/24) and probe every port on every host to see if a web server is ...
- 21
0
votes
1
answer
522
views
nmap - get detailed output for requests?
Update 2: pf already defaults to drop. What causes nmap to notice the server? What does 'received reset' mean?
Update 1:
Maybe I misinterpreted my findings. When run with -v2, nmap tells me that "...
- 11
0
votes
1
answer
399
views
why same nmap command behaves different at server than local machine?
I am running this nmap command on local machine (Windows 10 with nmap https://nmap.org/book/inst-windows.html)
nmap --script ssl-enum-ciphers -p 443 api.valorebooks.com
and it is showing SSL ...
- 103
0
votes
1
answer
387
views
Using nmap to scan an entire range
I found many examples with nmap online, but I got curious and I could not find a more advanced command. For example, if I want to scan a rage of ip in this measure, 192.168.x.x, then from 192.160.0.0 ...
- 11
-2
votes
1
answer
637
views
Nmap takes forever when pinging ports [closed]
When I execute nmap -sn 192.168.1.0/24, it takes 12 seconds to find 256 hosts but when I execute nmap -sS 192.168.1.0/24, it takes forever. Why is this happening?
I cannot see what I did wrong. ...
0
votes
1
answer
194
views
NMap Topologie missing Switches (no kind of Topology)
I did scan some of our Networks but for any reason NMap doesnt applies any kind of topologie.
It seems like there is everything connected directly but there are switches in between and those ...
- 39