Questions tagged [nmap]

Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, thus creating a "map" of the network.

Filter by
Sorted by
Tagged with
0 votes
0 answers
22 views

Nmap 7.92 ssl-enum-ciphers not accurate?

Not sure if Nmap 7.92 ssl-enum-ciphers is accurate or it's a bug but when I scan a server using Nmap 7.70 it responds with an A rating for TSL1.2 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp384r1) but ...
user avatar
  • 250
0 votes
0 answers
64 views

nmap reports ftp port open when the server is actually shut down

nmap output: $ sudo nmap -PN 1.2.3.4 Starting Nmap 7.92 ( https://nmap.org ) at 2022-02-24 09:58 CET Nmap scan report for 1.2.3.4 Host is up (0.035s latency). Not shown: 999 filtered tcp ports (no-...
user avatar
0 votes
0 answers
8 views

i don't understand about RST like FIN(-sF) as client

I have understand about FIN(-sF) as client example command: nmap -sF -p 22 192.168.1.102 but i don't understand about RST like FIN(-sF) as client. I want understand like FIN(-sF) as client by any ...
user avatar
0 votes
1 answer
97 views

How to find Free IP address in a sub range?

We are using below command to figure out the IP addresses which are down (which is free IP address to use) nmap -v -sn -n 192.168.1.0/24 -oG - | awk '/Status: Down/{print $2}' I wanted to get a ...
user avatar
0 votes
1 answer
52 views

is it possible to intercept only nmap scannings with IPtables?

I'm trying to redirect all scans coming from nmap to another destination. I'm trying IPTABLES, but I have no idea on how to tell apart the nmap scanning from the legitimate traffic. Is it something ...
user avatar
0 votes
0 answers
173 views

Hide nginx from nmap scan

When I run a nmap -sV scan agains my server, the port 443 is exposed as nginx. PORT STATE SERVICE VERSION 443/tcp open ssl/http nginx I want to hide this information. I tried ...
user avatar
  • 101
0 votes
0 answers
41 views

iptables rule to drop packets with namp closed ports

When I run a nmap against my server, there are some ports that are closed. 50000/tcp closed ibm-db2 50001/tcp closed unknown 50002/tcp closed iiimsf 50003/tcp closed unknown 50006/tcp closed unknown ...
user avatar
  • 101
0 votes
1 answer
95 views

Cannot Open Azure VM (Ubuntu 18.04) Port

Running the jupyter notebook server on port 8888 on the virtual machine. Trying to use port forward to my desktop (running Linux Mint). The server is running on the VM alright, but the port is closed ...
user avatar
  • 113
0 votes
1 answer
83 views

nmap not detecting clearly open udp port

I've opened port 4000 on my local machine as follows: nc -lvup 4000 and then attempted to connected to the same port as follows: nc -vu 127.0.0.1 4000 and was able to successfully connect and send ...
user avatar
0 votes
1 answer
105 views

Scanning a range of ports with Ncat?

I'm aware that Nmap is the obvious choice for this task, however I would still like to know if it's possible to scan a range of ports with Ncat. I see that I'm able to scan one port, but with a range ...
user avatar
  • 101
0 votes
0 answers
23 views

How to disable http discovery headers on nmap?

When scann a specific host the IPS bans me when request the nmap http paths. How to disable only the http header/protocols/etc detection but without disable others protocols detection like as smb or ...
user avatar
  • 121
1 vote
1 answer
471 views

Nmap results incorrect when connecting via VPN

I am trying to determine why my nmap results are incorrect when I am connected to a VPN provider. As you can see below nmap reports that ports are open when connecting to a VPN provider even though ...
user avatar
  • 121
0 votes
1 answer
817 views

Run nmap in a Docker container as a non-admin user

I'd like to run the Nmap tool in a Docker container but not with the default root user account. I already set the (hopefully) right capabilities via setcap. Unfortunately, I get only the "...
user avatar
0 votes
2 answers
272 views

can ping but not arping via OpenVPN

I'm working on a remote machine using OpenVPN at a customer's network. The IP addresses there change dynamically and (until they get hostnames to work properly which is not in my hands at this point) ...
user avatar
  • 101
2 votes
1 answer
1k views

Is there a built-in way to proxy SSH through socks5?

I have a Socks5 proxy that uses username/password authentication. I can use it with SSH using NCAT in the ProxyCommand: ssh -o ProxyCommand="ncat --proxy-type socks5 --proxy-auth username:...
user avatar
2 votes
1 answer
150 views

Unable to ping scan my machine (but I can ping)

I need to perform an nmap scan on all of the (responding) IPs in an array of VLANs. The command is nested in a PowerShell for loop and looks something like this: nmap.exe -Pn -T4 -A -oG [FILE].txt -oX ...
user avatar
  • 21
0 votes
1 answer
2k views

How do I block port 22 to prevent incoming ssh on Ubuntu?

I'm trying to block port 22 to disallow incoming ssh connections on a Ubuntu VM. I have issued the command: $> iptables -A INPUT -p tcp -dport 22 -s ###.##.##.## -j DROP But I can still ssh into ...
user avatar
1 vote
2 answers
1k views

nmap - get ssl expiration from fqdn

lets say i have the following url: www.domain.com:4567/blabla/index.html I'm trying to get its' ssl expiration date. There's this: nmap --script=ssl-cert.nse -p 9194 www.domain.com but it doesnt ...
user avatar
  • 629
0 votes
1 answer
268 views

Why should I press enter twice to send HTTP request in ncap/nmap?

I need to set up a manual connection with a domain and send an HTTP request. Like this : https://nmap.org/ncat/guide/ncat-usage.html As it mentions I should hit enter twice. But all commands on CMD I ...
user avatar
  • 105
0 votes
1 answer
79 views

I cant block ACK packets going through port 80

I want to block nmap's ack ping probes and in order to do that, I fist need to block all incoming ack packets coming on port 80. I used this command but it didnt work: iptables -A INPUT -p tcp --dport ...
user avatar
-1 votes
1 answer
2k views

firewalld causing nmap to return host seems down

I've two machines, server1 and server2. On server2, I stop firewalld. [root@server2 ~]# systemctl stop firewalld From server1, nmap returns Host is up. [root@server1 ~]$ nmap -sn server2 Starting ...
user avatar
1 vote
1 answer
6k views

nmap failing to resolve some IPs to hostname

My objective here is to get nmap to resolve IPs to hostnames without the --system-dns flag or the --dns-servers option. When I issue the following nmap command without the --system-dns flag or --dns-...
user avatar
0 votes
1 answer
604 views

How to enumerate ciphers for mysql server using nmap

Can nmap be used to enumerate tls ciphers against mysql service? I am able to run testssl.sh to enumerator ciphers against mysql service, but running nmap does not enumerate ciphers (as shown below). ...
user avatar
  • 101
0 votes
0 answers
218 views

After a while, port 80 shows as closed

After 2 years uptime, my server with gitlab (on premise) can't be reached, because the nginx proxy server can not listen to port 80. When I restart nginx it is usually working fine for 3 days or so. ...
user avatar
0 votes
1 answer
2k views

Can't open port with ufw

I need to open the port 8081 for my application. I want to connect to the application from another server. Problem I can't open the port. I started the application with port 8081 and ip 0.0.0.0 and ...
user avatar
0 votes
1 answer
291 views

How to check the udp port is accessible in an Ubuntu machine which is protected by a firewall

We were trying to install "Big blue button" in an Ubuntu server with a firewall. For installation, we need these UDP ports ("16384-32768") should be opened in the firewall. But we don't know whether ...
user avatar
  • 37
1 vote
1 answer
803 views

Scan IP range for SSL/TLS versions and vulnerabilities with legible/greppable output

I'm looking to find computers on the network that are using older versions of tls/ssl. So far I've been using nmap's ssl-enum-ciphers and ssl-poodle scripts but the output isn't helpful as it shows ...
user avatar
0 votes
1 answer
2k views

Discover IPMI IP address by scanning all possible direct LAN addresses

I have a Supermicro server board that powers on but wont post. I have connected a LAN cable to the dedicated IPMI LAN port on the board and am trying to discover what the IPMI IP address of the board ...
user avatar
1 vote
2 answers
3k views

nmap host discovery to get MAC Address

I notice that nmap -sn is no longer provide the MAC address for remote host as discussed in Can I use nmap to discover IPs and mac addresses? I would like to get something like netdiscover output. ...
user avatar
  • 191
1 vote
1 answer
2k views

Scan a list/range of IP addresses to find out which SSL Certificates each one is using

I have a list of internal IP addresses 1000+ strong, most of which I suspect are running services on port 443 and therefore will have a certificate installed on the server. These ips all exist on ...
user avatar
1 vote
0 answers
479 views

Azure SQL Database firewall allows TCP connections when they should be blocked

I am looking at a particular Azure SQL Database that has Server level firewall rules. I am told there are no database level firewall rules. Nmap reported open ports on the database even though the ...
user avatar
  • 63
0 votes
1 answer
96 views

Firewall: How to identify forbidden ports based on a whitelist of allowed ports per target-host?

Assume I have a list of hosts I want to scan. For each host I have a list of allowed ports. 192.168.1.2;80,443 192.168.1.3;3306 The list above reads "1st IP is allowed to have port 80 and 443 open, ...
user avatar
  • 103
0 votes
1 answer
1k views

Ho to use NMAP to check if a port is filtered by a firewall?

I have the following situation. I should have the access to a VM via SSH but trying to connect to this machine I obtain no response. I suspect that some firewall rules are blocking my request (so it ...
user avatar
-1 votes
1 answer
1k views

Apache2 not working with port 80 but working on port 8000 in Proxmox (same configuration)

Some months ago I hired a Kimsufi server, I tried to forward ports without luck. I abandon the server, some days ago I started to reconfigure everything again, but I'm having still problems. I ...
user avatar
  • 119
2 votes
0 answers
2k views

why doesn't arp-scan find any devices when nmap does?

When I run nmap -sn 192.168.0.0/24 I get the result: Nmap scan report for 192.168.0.1 Host is up (0.16s latency). Nmap scan report for 192.168.0.103 Host is up (0.19s latency). Nmap scan report for ...
user avatar
  • 121
2 votes
1 answer
554 views

Why do some unknown hosts show up with nmap option-sL , and not with -sn [and do I need to worry about them]?

Initial Disclosure I am not a network engineer and my expertise in this area is low. Background while using nmap 7.70 with nmap -sL to look for the IP address of a known device on our local ...
user avatar
-2 votes
1 answer
1k views

Hostname and Operating System - what is the best way to do the scan? [closed]

Is it possible to run an Nmap scan that give the output for Operating system and the hostname? If so what are the flags that needs to be used?
user avatar
-1 votes
1 answer
1k views

nmap - how to find port forwarding to SSH

I have a firewall that forwards port 2222 to a Linux machine running SSH server on port 2222. The problem is I do not know what the IP of the firewall is. So I want to scan the subnet to tell me ...
user avatar
  • 237
1 vote
3 answers
372 views

Nmap - Specify which probe(s) to use?

I'm trying to determine if it's possible to specify probe types for nmap to use. For example, I want to scan a subnet (say 192.168.0.0/24) and probe every port on every host to see if a web server is ...
user avatar
0 votes
1 answer
216 views

nmap - get detailed output for requests?

Update 2: pf already defaults to drop. What causes nmap to notice the server? What does 'received reset' mean? Update 1: Maybe I misinterpreted my findings. When run with -v2, nmap tells me that "...
user avatar
  • 11
0 votes
1 answer
244 views

why same nmap command behaves different at server than local machine?

I am running this nmap command on local machine (Windows 10 with nmap https://nmap.org/book/inst-windows.html) nmap --script ssl-enum-ciphers -p 443 api.valorebooks.com and it is showing SSL ...
user avatar
0 votes
1 answer
105 views

Using nmap to scan an entire range

I found many examples with nmap online, but I got curious and I could not find a more advanced command. For example, if I want to scan a rage of ip in this measure, 192.168.x.x, then from 192.160.0.0 ...
user avatar
  • 11
-2 votes
1 answer
390 views

Nmap takes forever when pinging ports [closed]

When I execute nmap -sn 192.168.1.0/24, it takes 12 seconds to find 256 hosts but when I execute nmap -sS 192.168.1.0/24, it takes forever. Why is this happening? I cannot see what I did wrong. ...
user avatar
0 votes
1 answer
124 views

NMap Topologie missing Switches (no kind of Topology)

I did scan some of our Networks but for any reason NMap doesnt applies any kind of topologie. It seems like there is everything connected directly but there are switches in between and those ...
user avatar
  • 39
0 votes
1 answer
235 views

why does ssh tunnel leaves ports opened with default services

I haven't tried in a different machine, but I am trying to establish an ssh tunnel to an external server. This how I am doing it: ssh -L 9898:firewalled.service.com:443 user@some-server I have 2 ...
user avatar
1 vote
1 answer
6k views

Nmap reporting open http-proxy on 8080, but none is running

While executing the following command from my Mac OSX: nmap -PN server.com It reports the following: Starting Nmap 7.70 ( https://nmap.org ) at 2019-04-18 16:14 EDT Nmap scan report for server....
user avatar
1 vote
0 answers
377 views

NPing gives significantly less time on `TCP Connect` than `TCP`

I'm using NPing (NMap's pinging tool) to measure latency on specific servers that may not respond to ICMP. Also, servers do not usually run HTTP(S) and I only check latency on a specific TCP port ...
user avatar
0 votes
1 answer
304 views

nmap output in csv format sorted by last octet in ip address

I have this command which works well to give me a list of ip address, MAC address, and Mac Vendor sudo nmap -sn 192.168.0.0/24 | awk '/Nmap scan report for/{printf $5;}/MAC Address:/{print " "substr($...
user avatar
0 votes
1 answer
2k views

Strange NMAP output

I am trying to scan TCP port 8092 of a host using nmap 7.60. When I execute nmap without root privileges it says that the port is filtered, but if I try to scan it with sudo it tells me that the port ...
user avatar
1 vote
1 answer
1k views

Why does nmap show port 25 as open? Server's firewall should block port 25

nmap 7.70 executed remotely shows the server's port 25 as open. However, the firewall on my VPS server only opens ssh, http and https services. On the laptop: nmap x.x.x.x Not shown: 996 filtered ...
user avatar

1
2 3 4 5