Tag Info

Hot answers tagged

10

127.0.0.1 is not the "outside world", it is looking around inside the house. Check your firewall configuration (iptables in Linux today), most of them shouldn't be accessible from the ouside. Don't run services you don't need. Uninstall all not required software. Change passwords to be stronger. Check your usage of the system, don't go chasing any ...


9

Determine your exposure Taking your output from the netstat command, what looks like a lot of services is actually a very short list: $ netstat -lntup | awk '{print $6 $7}'|sed 's/LISTEN//'| cut -d"/" -f2|sort|uniq|grep -v Foreign avahi-daemon:r dhclient dropbox nmbd rpcbind rpc.statd smbd sshd Getting a lay of the land Looking at this list there are ...


5

You misunderstand regex syntax. [16-32] does not mean "match 16, 17, ... or 32". It means "match one character which is either 1 or 2 or in the range 6-3" (which is not a valid range, hence the error). It's possible to write a regex to match a range of integers, but it's complex and error prone. In your case, it would be much easier to use nmap's ...


5

Short answer Yes it is possible, use tsocks nmap -sT IP Long answer First of all Tor doesn't use privoxy, Tor provides an socks proxy for connecting via the Tor network. This means you won't see any network routes or things like that on your system but you have to configure your applications to use the Tor socks proxy to connect via Tor. Typical Tor ...


4

In its standard mode, nmap does two different types of scan: a host scan, to determine which hosts are available for further port scanning, and a port scan, which reveals the status of ports on available machines. -sn does no port scan, but it does a host scan -- this is particularly useful when scanning a range with nmap, where it will print out those hosts ...


4

It's not clear for me, are you need strings containing only report or open? If so, use: grep : nmap | grep -E "report|open" sed : nmap | sed '/report\|open/!d' if report and open together grep : nmap | grep report | grep open sed : nmap | sed '/report.*open\|open.*report/!d'


3

Have a look in the Nmap book's chapter 13, "Output formats", it has a section on "Grepable Output" and even one on "Output to a Database".


3

If your connection is refused, and Nmap shows the port to be closed, then you cannot connect. If you have some other way (physical terminal, virtual console, etc) to get access, you can confirm whether the SSH daemon is running with any of these commands (some may not be available on your system): ps -f -C sshd ps aux | grep sshd sudo netstat -ptan | grep ...


2

You're right that the documentation is worded poorly. -sn means "skip the port scan phase," and was previously available as -sP, with the mnemonic "Ping scan". Nmap scans happen in phases. These are: Name resolution NSE script pre-scan phase Host discovery ("ping" scan, but not necessarily ICMP Echo request) Parallel reverse name resolution Port or ...


2

Rather than post-processing with grep, try passing the --open option to Nmap. This will hide all closed or filtered ports. You can use the -oG or -oA options to output "grepable" results, too. Here's an example that does what I think you're looking for: nmap -p 25 --open -oA smtp-servers-%y%m%d 192.168.15.0/24 The results would be in ...


2

While you can 'shut' individual services - perhaps it may just be easier to setup a firewall. Nearly all common distro's (Ubuntu, Debian, Centos, etc) have support for iptables built-in. A simple rule-set to get started: (you can just type these in at a command-prompt; to make them permanent add them to your startup scripts or tell us what distro you're ...


2

Firstly, I like to check the linux man(ual) pages for questions like this. Also of note, is that this script uses piping: http://en.wikipedia.org/wiki/Pipeline_%28computing%29 For example, by opening terminal and typing man nmap, we can see what nmap does and what each argument means From the man page for nmap Nmap (“Network Mapper”) is an open source ...


1

It's the fourth choice. Web servers listen on port 80 by default, and that's where -p80 in the nmap command line comes into play. In other words, it's looking for hosts that have port 80 open and seeing which of these will reply to an ICMP ECHO request, otherwise known as a ping.


1

You can check the status of your ssh server remotely by using nmap $ nmap -v -nn serverip 22 If it shows that the ssh-server is down, then you have to get some local access to the ssh-server and execute command like: $ /etc/init.d/ssh status If this show ssh service is down, then you have to start it by $ sudo /etc/init.d/ssh start or $ service ...


1

If you want another program (database, etc.) to use Nmap output, always use the XML output (-oX). Depending on your preferred programming languages, there will often be a parser library already written: Nmap::Parser for Perl, Nmap::Parser for Ruby, ndiff (comes with Nmap) for Python. If you really need to use command pipelines, there are a few XML utilities ...


1

The short answers to your questions are below. The long answer is, "read the manpage." The Really Long Answer is, check out the source code. Host discovery ("detect servers") For hosts on the same link as the scanner, Nmap uses ARP requests to determine the link-layer address of each IP address being scanned. Any positive reply is taken to mean that the ...


1

I assume that you don't want to look into the source code because of its complexity. A book that describes in a simple way how nmap functions and what are the differences between its scanning techniques is Secrets of Network Cartography: A Comprehensive Guide to nmap (available online for free). For more documentation, check the docs on nmap.org


1

I can address your third question. One totally different way to identify an operating system is using Michal Zalewski's p0f. p0f guesses operating systems based on particular flags and other characteristics of TCP packets that pass by. A SYN packet from an incoming connection is enough to make a guess. The "fingerprint" file from Zalewski's site is kind of ...


1

172.31.100.0 is the IP address of one of the hosts you scanned. If your network is actually 172.31.96.0/21 (or larger), then 100.0 is a perfectly valid IP address. 172.31.100.0 is part of the pre-CIDR Class B IP space, so you may have gotten a default network of 173.31.0.0/16 if you didn't configure otherwise (and 100.0 completely valid on that network). ...



Only top voted, non community-wiki answers of a minimum length are eligible