$ time nmap -q -sV -P0 -p80 google.com | fgrep '80/tcp open' 80/tcp open http Google httpd 2.0 (GFE) real 0m6.563s user 0m0.280s sys 0m0.016s $
Are there any faster methods to get info about the webserver?
Google httpd 2.0 (GFE) is enough
For most HTTP servers, Nmap simply grabs the Server header, so that could be enough. To get that information, try this:
Otherwise, if you want to use Nmap, there are some ways you could speed things up.
All together, these will save a few milliseconds. Unfortunately, the 6 seconds that you are seeing is Nmap waiting for the server to send data first. Nmap tries service detection probes in a particular order: first the NULL probe (wait for server to send first), then any probes that are "for" the port being scanned, then any other probes with a rarity less than the version intensity (default 7). The probes and their ports and rarities are defined in the
To avoid messing up Nmap for all other scans, make a copy of the
Well it depends which 'info' you are looking for. Assuming you know what HTTP(S) service and version is running (IIS / Apache / nginx), then you can have an idea of the what is the underlying OS.
The more informations you are looking for, the longer the scan will take (also if you trigger an IDS the scan might take ages):
Using nmap (FAST) :
Using nmap (SLOWer but more info)
-A is equivalent to -sV -O -T4 (Version Detection / OS detection / Agressive timing)