Questions tagged [nmap]

Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, thus creating a "map" of the network.

Filter by
Sorted by
Tagged with
0 votes
1 answer
20 views

Dynamic port forwarding using tsh ssh -D cripples nmap functionality

I am having some issues when trying to use a teleport node as a sort of proxy to scan resources inside networks behind that said proxy node. My setup looks like this: I have a node inside my Teleport ...
Tudi Alex's user avatar
0 votes
1 answer
190 views

nmap - single port scan returns result, range port scan returns all port in ignored state result

don't hate me, I am a newbie. If I do: nmap -sV -p80 255.255.255.0 I get: PORT STATE SERVICE VERSION 22/tcp filtered ssh but if I do: nmap -sV -p0-100 255.255.255.0 I get: All 101 scanned ...
DevelBase2's user avatar
0 votes
0 answers
217 views

nftables : improve anti port scanning rules

I'm looking for ways to confuse port scanners. I do realize it is not that useful, but it is mostly to slow down attackers, and also to avoid ending up on websites like Shodan (or at least make the ...
ShellCode's user avatar
  • 111
0 votes
0 answers
154 views

How to get the OpenVPN *REMOTE* server version?

Getting the local openvpn client version number is easy: openvpn --version. But I am wondering how to get the server version running remotely? Thanks! I tried nc and nmap. But none of them provided me ...
faze's user avatar
  • 101
0 votes
1 answer
195 views

nmap shows 8080/tcp open http-proxy on centos 7 VPS but lsof shows nothing for that port

Im running a Centos 7 VPS server for the past several years. Originally when I set it up I didnt install any firewall (iptables specifically) because I was under the impression the host (linode) ...
Tim's user avatar
  • 203
-1 votes
1 answer
2k views

How to retrieve device names on local network?

Currently I'm trying to retrieve the name of each device that is connected to my local network, like my phone, laptop, printer, chromecast, etc. After doing some research, I know that its fairly ...
gravityclover's user avatar
-2 votes
1 answer
684 views

How to discover HTTPS servers on local network with certificate for particular hostname

I am making a network-connected device (using Raspberry Pi 4 inside), and I would like a way for these devices to discover each other (when on the same local subnet). I am vaguely aware of protocols ...
jacobq's user avatar
  • 132
2 votes
3 answers
716 views

nmap vulnerability scan reports " smtps on port 465 ssl-dh-params" vulnerability, on Ubuntu 20.04 webserver. How to close the vulnerabilty?

I am running an Ubuntu 20.04 LEMP (Linux, Nginx, MariaDb, PHP) email/web server. I am also doing some nmap vulnerability tests form my MacOS Client machine. On MacOS, I am using Oh My Zsh! with the ...
DanRan's user avatar
  • 93
1 vote
1 answer
99 views

How can I use nmap against an IPoIB network?

I'm trying to use nmap to check which services are running on a given network but it cannot start just because nmap issues ARP Ping Scans on IPv4 network, and on a Infiniband Network, as far as I know,...
Vinícius Ferrão's user avatar
-1 votes
1 answer
238 views

List all active devices in different subnets?

My company has a class A network that contains various subnets. I need to automate a way to produce a list of all online devices (in all the subnets). To start, just a list of responsive private IPs ...
Andrew Campi's user avatar
-1 votes
1 answer
555 views

How to get OS and version of every server on network?

This is a case of "we are where we are". I'm a developer and I've been asked to get a list of every server on our network (IP and hostname) along with the OS version We exclusively use ...
pee2pee's user avatar
  • 379
0 votes
1 answer
282 views

Will a web server get blacklisted for port scanning?

As I understand it, port scanning is an activity that can be a precursor to malicious activity, as one of the things it is used for is to scan for open ports that one can attack. In that train of ...
John Doe's user avatar
  • 365
1 vote
1 answer
351 views

Nmap - Print names from virtual hosts

I'm trying to identify virtual hosts with Nmap, command: nmap --script http-vhosts -p80 {ip} Nmap identifies a number of hosts. But how do I get the actual host names that are found? Now nmap only ...
AsusT9's user avatar
  • 11
2 votes
1 answer
5k views

Nmap unable to resolve hostnames

I have tried running several nmap commands and I can't get the results to return host names. My results look like this: Nmap scan report for 10.2.16.253 Host is up (0.0025s latency). All 1000 scanned ...
UbuntuNoob's user avatar
0 votes
0 answers
875 views

Nmap ssl-enum-ciphers not showing ciphers with specific certificate running MS SQL 2019

I have a server running MS Sql 2019 Std.I have configured MS SQL to use SSL. I have a cert from entrust that when I scan with Nmap --script ssl-enum-ciphers fqdn does not show the TLS version for port ...
lee_in_wv's user avatar
0 votes
1 answer
778 views

How to find Free IP address in a sub range?

We are using below command to figure out the IP addresses which are down (which is free IP address to use) nmap -v -sn -n 192.168.1.0/24 -oG - | awk '/Status: Down/{print $2}' I wanted to get a ...
Samselvaprabu's user avatar
0 votes
1 answer
165 views

is it possible to intercept only nmap scannings with IPtables?

I'm trying to redirect all scans coming from nmap to another destination. I'm trying IPTABLES, but I have no idea on how to tell apart the nmap scanning from the legitimate traffic. Is it something ...
Fabio Rovati's user avatar
0 votes
1 answer
387 views

Cannot Open Azure VM (Ubuntu 18.04) Port

Running the jupyter notebook server on port 8888 on the virtual machine. Trying to use port forward to my desktop (running Linux Mint). The server is running on the VM alright, but the port is closed ...
Della's user avatar
  • 215
1 vote
1 answer
841 views

nmap not detecting clearly open udp port

I've opened port 4000 on my local machine as follows: nc -lvup 4000 and then attempted to connected to the same port as follows: nc -vu 127.0.0.1 4000 and was able to successfully connect and send ...
Teererai Marange's user avatar
1 vote
1 answer
2k views

Scanning a range of ports with Ncat?

I'm aware that Nmap is the obvious choice for this task, however I would still like to know if it's possible to scan a range of ports with Ncat. I see that I'm able to scan one port, but with a range ...
Ed Shway's user avatar
  • 111
1 vote
1 answer
2k views

Nmap results incorrect when connecting via VPN

I am trying to determine why my nmap results are incorrect when I am connected to a VPN provider. As you can see below nmap reports that ports are open when connecting to a VPN provider even though ...
A_B's user avatar
  • 121
1 vote
1 answer
3k views

Run nmap in a Docker container as a non-admin user

I'd like to run the Nmap tool in a Docker container but not with the default root user account. I already set the (hopefully) right capabilities via setcap. Unfortunately, I get only the "...
Johannes's user avatar
0 votes
2 answers
827 views

can ping but not arping via OpenVPN

I'm working on a remote machine using OpenVPN at a customer's network. The IP addresses there change dynamically and (until they get hostnames to work properly which is not in my hands at this point) ...
Cookie's user avatar
  • 101
3 votes
1 answer
4k views

Is there a built-in way to proxy SSH through socks5?

I have a Socks5 proxy that uses username/password authentication. I can use it with SSH using NCAT in the ProxyCommand: ssh -o ProxyCommand="ncat --proxy-type socks5 --proxy-auth username:...
ykaganovich's user avatar
2 votes
1 answer
509 views

Unable to ping scan my machine (but I can ping)

I need to perform an nmap scan on all of the (responding) IPs in an array of VLANs. The command is nested in a PowerShell for loop and looks something like this: nmap.exe -Pn -T4 -A -oG [FILE].txt -oX ...
TheCube's user avatar
  • 21
0 votes
1 answer
3k views

How do I block port 22 to prevent incoming ssh on Ubuntu?

I'm trying to block port 22 to disallow incoming ssh connections on a Ubuntu VM. I have issued the command: $> iptables -A INPUT -p tcp -dport 22 -s ###.##.##.## -j DROP But I can still ssh into ...
P. James Norris's user avatar
1 vote
2 answers
4k views

nmap - get ssl expiration from fqdn

lets say i have the following url: www.domain.com:4567/blabla/index.html I'm trying to get its' ssl expiration date. There's this: nmap --script=ssl-cert.nse -p 9194 www.domain.com but it doesnt ...
JustAGuy's user avatar
  • 649
0 votes
1 answer
532 views

Why should I press enter twice to send HTTP request in ncap/nmap?

I need to set up a manual connection with a domain and send an HTTP request. Like this : https://nmap.org/ncat/guide/ncat-usage.html As it mentions I should hit enter twice. But all commands on CMD I ...
m0ss's user avatar
  • 105
0 votes
1 answer
177 views

I cant block ACK packets going through port 80

I want to block nmap's ack ping probes and in order to do that, I fist need to block all incoming ack packets coming on port 80. I used this command but it didnt work: iptables -A INPUT -p tcp --dport ...
xparks37's user avatar
-1 votes
1 answer
3k views

firewalld causing nmap to return host seems down

I've two machines, server1 and server2. On server2, I stop firewalld. [root@server2 ~]# systemctl stop firewalld From server1, nmap returns Host is up. [root@server1 ~]$ nmap -sn server2 Starting ...
JeremyCanfield's user avatar
3 votes
1 answer
12k views

nmap failing to resolve some IPs to hostname

My objective here is to get nmap to resolve IPs to hostnames without the --system-dns flag or the --dns-servers option. When I issue the following nmap command without the --system-dns flag or --dns-...
JeremyCanfield's user avatar
0 votes
1 answer
1k views

How to enumerate ciphers for mysql server using nmap

Can nmap be used to enumerate tls ciphers against mysql service? I am able to run testssl.sh to enumerator ciphers against mysql service, but running nmap does not enumerate ciphers (as shown below). ...
jzacharuk's user avatar
  • 101
0 votes
0 answers
369 views

After a while, port 80 shows as closed

After 2 years uptime, my server with gitlab (on premise) can't be reached, because the nginx proxy server can not listen to port 80. When I restart nginx it is usually working fine for 3 days or so. ...
Antonio Valle's user avatar
0 votes
1 answer
4k views

Can't open port with ufw

I need to open the port 8081 for my application. I want to connect to the application from another server. Problem I can't open the port. I started the application with port 8081 and ip 0.0.0.0 and ...
Bahamas's user avatar
  • 103
0 votes
1 answer
799 views

How to check the udp port is accessible in an Ubuntu machine which is protected by a firewall

We were trying to install "Big blue button" in an Ubuntu server with a firewall. For installation, we need these UDP ports ("16384-32768") should be opened in the firewall. But we don't know whether ...
aks's user avatar
  • 57
1 vote
1 answer
1k views

Scan IP range for SSL/TLS versions and vulnerabilities with legible/greppable output

I'm looking to find computers on the network that are using older versions of tls/ssl. So far I've been using nmap's ssl-enum-ciphers and ssl-poodle scripts but the output isn't helpful as it shows ...
rambetherleu's user avatar
1 vote
1 answer
4k views

Discover IPMI IP address by scanning all possible direct LAN addresses

I have a Supermicro server board that powers on but wont post. I have connected a LAN cable to the dedicated IPMI LAN port on the board and am trying to discover what the IPMI IP address of the board ...
proximacentauri's user avatar
1 vote
2 answers
6k views

nmap host discovery to get MAC Address

I notice that nmap -sn is no longer provide the MAC address for remote host as discussed in Can I use nmap to discover IPs and mac addresses? I would like to get something like netdiscover output. ...
Wolf's user avatar
  • 211
1 vote
1 answer
7k views

Scan a list/range of IP addresses to find out which SSL Certificates each one is using

I have a list of internal IP addresses 1000+ strong, most of which I suspect are running services on port 443 and therefore will have a certificate installed on the server. These ips all exist on ...
rambetherleu's user avatar
1 vote
0 answers
739 views

Azure SQL Database firewall allows TCP connections when they should be blocked

I am looking at a particular Azure SQL Database that has Server level firewall rules. I am told there are no database level firewall rules. Nmap reported open ports on the database even though the ...
M6rk's user avatar
  • 63
0 votes
1 answer
177 views

Firewall: How to identify forbidden ports based on a whitelist of allowed ports per target-host?

Assume I have a list of hosts I want to scan. For each host I have a list of allowed ports. 192.168.1.2;80,443 192.168.1.3;3306 The list above reads "1st IP is allowed to have port 80 and 443 open, ...
Christoph's user avatar
  • 103
2 votes
1 answer
4k views

Ho to use NMAP to check if a port is filtered by a firewall?

I have the following situation. I should have the access to a VM via SSH but trying to connect to this machine I obtain no response. I suspect that some firewall rules are blocking my request (so it ...
AndreaNobili's user avatar
-1 votes
1 answer
4k views

Apache2 not working with port 80 but working on port 8000 in Proxmox (same configuration)

Some months ago I hired a Kimsufi server, I tried to forward ports without luck. I abandon the server, some days ago I started to reconfigure everything again, but I'm having still problems. I ...
z3nth10n's user avatar
  • 119
2 votes
0 answers
4k views

why doesn't arp-scan find any devices when nmap does?

When I run nmap -sn 192.168.0.0/24 I get the result: Nmap scan report for 192.168.0.1 Host is up (0.16s latency). Nmap scan report for 192.168.0.103 Host is up (0.19s latency). Nmap scan report for ...
Subtle Development Space's user avatar
2 votes
1 answer
974 views

Why do some unknown hosts show up with nmap option-sL , and not with -sn [and do I need to worry about them]?

Initial Disclosure I am not a network engineer and my expertise in this area is low. Background while using nmap 7.70 with nmap -sL to look for the IP address of a known device on our local ...
Mister October's user avatar
-2 votes
1 answer
4k views

Hostname and Operating System - what is the best way to do the scan? [closed]

Is it possible to run an Nmap scan that give the output for Operating system and the hostname? If so what are the flags that needs to be used?
Alvin Alvin's user avatar
-1 votes
1 answer
2k views

nmap - how to find port forwarding to SSH

I have a firewall that forwards port 2222 to a Linux machine running SSH server on port 2222. The problem is I do not know what the IP of the firewall is. So I want to scan the subnet to tell me ...
stone.212's user avatar
  • 347
2 votes
3 answers
714 views

Nmap - Specify which probe(s) to use?

I'm trying to determine if it's possible to specify probe types for nmap to use. For example, I want to scan a subnet (say 192.168.0.0/24) and probe every port on every host to see if a web server is ...
SuperStudent's user avatar
0 votes
1 answer
873 views

nmap - get detailed output for requests?

Update 2: pf already defaults to drop. What causes nmap to notice the server? What does 'received reset' mean? Update 1: Maybe I misinterpreted my findings. When run with -v2, nmap tells me that "...
loopend's user avatar
  • 11
0 votes
1 answer
484 views

why same nmap command behaves different at server than local machine?

I am running this nmap command on local machine (Windows 10 with nmap https://nmap.org/book/inst-windows.html) nmap --script ssl-enum-ciphers -p 443 api.valorebooks.com and it is showing SSL ...
Kamran Qadir's user avatar

1
2 3 4 5 6