Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [nmap]

Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, thus creating a "map" of the network.

0
votes
0answers
22 views

Zenmap identify connected devices to switch

I'm trying to do a "map" of my company's network to see all of its devices (switch, router... ). After some research, Zenmap (GUI of Nmap) semmed to be a good tool. But when I scanned the network on a ...
0
votes
1answer
17 views

Nmap Performance Mass Scanning SSL/TLS Certificate Data

Is Nmap built to use all of the available resources eg. in a server such as Dell PowerEdge T620 Server Xeon 16 Core 2.6GHz 128GB RAM with connectivity to both network ports? Basically, would the ...
0
votes
1answer
24 views

nmap port 22 filtered implications

I did the nmap scan on the list of external public ip (linux hosts). I tried to test out if any not needed services are opened. I realized there are many unfiltered ports on ssh tcp/22, however when ...
0
votes
1answer
40 views

How to prevent nmap from fingerprinting HAProxy

In our periodic security scans, our HAProxy instances are always reported as a version disclosure vulnerability. On further inspection, it appears that there are no version banners in any responses ...
0
votes
2answers
76 views

In Linux server - how to check if established TCP port connection supports TLS 1.2

I have a Linux server that has an established TCP port connection to a client. Can I somehow check if the connection on this port supports TLS 1.2 with any of the networking commands on a basic Linux ...
0
votes
0answers
164 views

nmap only returns hostnames with --dns-system, but it is very slow

I'm trying to find hosts in my network, and when I try a command without --system-dns I get for instance if using -v Initiating Parallel DNS resolution of 256 hosts. at 14:10 Completed Parallel DNS ...
1
vote
0answers
32 views

nmap showing different results every time

I am running: nmap -sP 192.168.251.0/24 to see the hosts in the office network. Every time that I run the command it shows a different result, for instance it sometimes shows 192.168.251.13 192....
0
votes
1answer
192 views

What is service “ismserver” listening on port 9500?

I am on Ubuntu 16.04 Upon nmap -sV localhost, I came upon the output line 9500/tcp filtered ismserver which I cannot recognize. The service ismserver listening on the port matches the IANA record, ...
-2
votes
1answer
216 views

Hide running service such as Nginx from a port scan

When I run a Port Scan to my server through NMap (like this)... $ nmap -A -p443 example.com ...then I get an output like... Starting Nmap 7.70 ( https://nmap.org ) at 2018-03-29 00:14 BST Nmap scan ...
-1
votes
1answer
27 views

Weird behavior of VPS host

Hi I noticed strange behavior on my VPS host I launch nmap on my laptop and scan VPS host nmap screenshot Listed netstat on VPS server netstat screenshot Tried to connect to some port connection ...
0
votes
1answer
2k views

SQL Server 2014 Disable SSL/TLS

I am running SQL Server 2014 on Server 2012 R2. Both are updated and current. I did a clean install of both and nothing else. I then requested VPN access for an offsite vendor and our security group ...
1
vote
1answer
43 views

Can a Syslog server recognize a client OS?

I recently set up a central syslog server. Logs are organized in files, in folder named after the client machines (using DNS), and scanned with logcheck. Some of the client machines have more than ...
0
votes
0answers
411 views

How to disable CONNECT method in Apache 2.4.29 and return 405 status?

I'm using Apache 2.4 as a reverse proxy and according to this post, I have no use for the HTTP CONNECT method. So I tried disabling proxy_connect module when I built Apache using configure (static) ...
0
votes
0answers
84 views

All ports and clients show up open

I recently checked my office network using a tool called nmap. However, I noticed something odd. All clients and all ports showed up open. I mean all of them. All from 192.168.1.1 to 192.168.255.255 ...
0
votes
0answers
130 views

Nmap/ARP queries giving same MAC address for all computers in subnet

Every time I run a scan on the computers in this network I’ll get their correct host names and open tcp ports and everything, but every single one shows like they have the same MAC address. I’m not ...
0
votes
2answers
273 views

Scanning internal network in search of Jenkins instances

I have issues with find all Jenkins instances in environment: I've tride to use nmap with http-title script to find all that answer with Dashboard[Jenkins] but some of them had more redirections than ...
0
votes
0answers
185 views

Tips for Troubleshooting Remote IMAP/SMTP Host Connection with OPENSSL and NMAP

I work in tech support for a company that has an email inbox integration. Users can input IMAP and SMTP host names and ports and we will attempt to open a connection with those ports and host names so ...
-5
votes
1answer
177 views

Difference between local and remote nmap - trying to set up mysql server remote access [closed]

I am try to set up mysql remotely. I have followed a number of guides such as this, and I have ended up using nmap to see what ports are open. When I am on my laptop, nmap -P0 <server> gives: ...
1
vote
3answers
2k views

SSL unsupported protocol error

I'm trying to use ncat to connect between virtual windows7 and linux machines. On linux: ncat -vnl 4444 --ssl On windows: ncat -v 10.10.14.2 4444 --ssl And when I try to connect from the client I ...
0
votes
0answers
28 views

HTTP verb OPTIONS disallowed. Why does NMAP show support?

Recent penetration testing showed a low risk vulnerability: "remote host is using the OPTIONS method..." The instructions to disable are easy enough to follow. Disallow the OPTIONS verb in IIS. Why ...
1
vote
1answer
454 views

Apache/Tomcat web server: nmap always returns that all http-methods are allowed

I'm running a web server with Apache http server in front of an Apache Tomcat server. My goal: Disable http-methods DELETE and PUT on the web server. According to OWASP (https://www.owasp.org/index....
2
votes
2answers
329 views

ssh-keyscan does not reveal DSA ssh-dss key

I am using ssh-keyscan to obtain public keys for a couple of SSH servers. One of my appliances only supports DSA / ssh-dss. ssh-keyscan with the "-t dsa" option is not able to get the public key while ...
1
vote
3answers
1k views

Port scanning and Windows Firewall

I am trying to understand the results I am getting when scanning ports on a machine that has an active built-in Windows Firewall. My test environment has two Windows 7 machines running in Hyper-V VMs ...
1
vote
1answer
863 views

What is the fastest way to scan all ports of a single maching using tcp scan

After reading this post here, from security.stackexchange, I was wondering what is the best way to scan all ports of a single maching using tcp scan only. "nmap -sT -p 1-65535 localhost" is what I ...
0
votes
1answer
40 views

getting hardware information of all devices on the network

I was wondering if i can get a full hardware information about each device on the network? (preferred linux commands) with the nmap command I found the devices in my net, but only name, ip addresses ...
1
vote
1answer
190 views

ncat on UDP protocol (RH 7)

I'm resuming the discussion "Check if remote host/port is open - Can't use GNU Netcat nor NMap - RHEL 7". I can't obtain the correct result because on my rh versions (5.6 and 7.1) there isn't the path ...
0
votes
0answers
71 views

Scan network for all devices

I'm running into a small issue with a network, when I scan it using either nmap or even Fing for android, I can only get the router, and my device, even though I know other devices are connected. This ...
0
votes
1answer
79 views

Port opened on RHEL but nmap cannot find it

I am using tomcat on RHEL7 cloud instance on default 8080 port. Opened port using sudo firewall-cmd --zone=public --add-port=8080/tcp --permanent, reloaded using sudo firewall-cmd --reload. Connecting ...
0
votes
2answers
368 views

use multiple ip addresses to tcp check remote server's port

Im trying to tcp connect yahoo's mail server on port 25 . I have 3 public ip addresses lets say:- (all are allowed in SPF records) 99.99.99.99 77.77.77.77 88.88.88.88 How to telnet(or other checks) ...
0
votes
2answers
192 views

Can nmap scan/test all answers from round-robin dns?

I have a round-robin dns record I want to test with nmap, currently it only tries one of the IPs (if I run a loop it checks each in order). Is there a way to have nmap test all A/AAAA records from a ...
1
vote
1answer
1k views

Does anyone know better way to scan for IPMI devices?

Iam using a simple nmap scan on IPMI/BMC port 623/tcp. Is this enough or Is there anything more I need to be aware using nmap? nmap -p 623 IP-IPEND
3
votes
2answers
69 views

Finding XP boxes on our intranet

We're out on a mission to find and eradicate XP boxes on our intranet. Now we're wondering what the fastest (scan) method might be --XP boxes connected to our active directory have already been ...
0
votes
1answer
559 views

NFS troubles: showmount -e {server IP} doesn't work

I'm having a number of troubles setting up an NFS mount on a Ubuntu server, and the main issue seems to be in making connection from the client (a Mac). I can ping the server address fine. Here is ...
1
vote
2answers
2k views

TLS version scan discrepancy between nmap, openssl, ssllab

I am trying to scan an endpoint to see what TLS version it is running and I am seeing some discrepancy between the nmap scan and the openssl scan. Scanning the same host I see only TLSv1.0 from nmap (...
2
votes
0answers
322 views

nmap reports IP address is active, when the network device is turned off?

I want to remotely examine if some servers are up. I don't use the ping command because it gives a lot of wrong results like "destination host unreachable" and "request Timed out" due to bad ...
0
votes
2answers
494 views

Which ports does NMAP scan for OS-detection

nmap offers OS-detection functionality based TCP/IP fingerprinting by sending six probing packets and analyzing their responses. In the documentation is says that some of them are send to an open port ...
1
vote
2answers
833 views

How to defeat NMAP's TCP/IP fingerprinting method for OS-detection

I want to evade nmap's TCP/IP fingerprinting, which it uses to detect the OS on a machine. I read A practical approach for defeating Nmap OS-Fingerprinting which explains how this can be done. It also ...
0
votes
2answers
781 views

vsftpd hide version on port scan

I'm looking for methods (iptables rules, etc...) to prevent the version from showing on a nmap report for VSFTPD. Currently, when executing: nmap -Pn -p 21 -sV localhost Nmap scan report for ...
2
votes
1answer
2k views

Understanding the nmap ssl-enum-ciphers script

I'm testing Tomcat SSL configuration of my server and I was using the ssl-enum-ciphers script of nmap and the following warning appears: Key exchange parameters of lower strength than certificate ...
-1
votes
1answer
581 views

Why does nmap scan of same target smtp server show port 25 missing

I am configuring a new server, on a new network and struggling to get outbound SMTP to work to known mail servers. If I do an nmap scan from my existing server - port 25 shows up, but from my new ...
7
votes
1answer
3k views

Displaying nmap result gradually as results are found

To get nmap results, one has to wait for the end of the scan. How can I force nmap to gradually display the newly found hosts and open ports while it is running?
3
votes
1answer
4k views

Fast and reliable way to scan a Class B network using nmap

I need to nmap scan a class B network within a short span of time. The requirements are quite straightforward. I want to: Scan as fast as possible Fulfill point 1 while maintaining reliability (...
4
votes
2answers
381 views

Best way to determine if IPs in a subnet are up or down in Linux

I have a simple method that I am using on four subnets to determine which registered IPs are actually up and active, and which ones can be removed. Initially, I iterate through the list of domain ...
5
votes
5answers
2k views

IMAP connection with Dovecot keeps failing (time-out)

* TLDR ; if you have connection problems, not only make sure you have added the required rules to your firewall, but also make sure ($ iptables -L -v) that the rules are in the correct order! * It's ...
0
votes
1answer
269 views

Nmap scan yields: FATAL: Unknown datalink type (127)

I get an error message trying to scan ports on any remote host using nmap (windows): Starting Nmap 7.25BETA1 ( https://nmap.org ) at 2016-07-28 12:36 Jerusalem Daylight Time NSE: Loaded 138 scripts ...
14
votes
2answers
19k views

Check if remote host/port is open - Can't use GNU Netcat nor NMap - RHEL 7

At work, the infrastructure team is rolling out new VMs with RHEL7 installed as the base OS. This particular image comes with the nmap-ncat version of Netcat and does not have NMap installed. We are ...
-1
votes
1answer
147 views

Nmap how to split and filter this(regex)?

I think i need a regex code to filter nmap output.txt I use a tool called: Word List Updater 2.7 so this is the output: http://pastebin.com/HwgiVHDA I want to filter,remove duplicates and look like ...
0
votes
1answer
100 views

IPTables Policy INPUT DROP but accepts connection

I configured iptables with the following rules: iptables -I INPUT -p tcp --dport 22 -j ACCEPT iptables -P INPUT DROP iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 ...
0
votes
2answers
52 views

Port Scanning Large Sets of Targets

1)How would you check to see if a list of ~10000 IPs if they have port 80 open? 2)How would you go about the same scenario but with a port range? 3)How would you check a list of 10000 IPs to see ...
0
votes
2answers
616 views

“Nmap Scripting Engine” HTTP Requests

I looked into my nginx access logs to check who accessed my server and I noticed this line: <IP> - - [25/Feb/2016:02:49:12 +0100] "GET / HTTP/1.1" 302 160 "-" "Mozilla/5.0 (compatible; Nmap ...