Tag Info

Hot answers tagged

27

Nmap is a great port scanner, but sometimes you want something more authoritative. You can ask the kernel what processes have which ports open by using the netstat utility: me@myhost:~$ sudo netstat -tlnp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 ...


11

A Linux system has a so called loopback interface, which is for internal communication. Its hostname is localhost and its IP address is 127.0.0.1. When you run nmap on localhost, you actually run the portscan on the virtual loopback interface. 192.168.1.1 is the IP address of your physical (most likely eth0) interface. So you've run nmap on two different ...


10

Determine your exposure Taking your output from the netstat command, what looks like a lot of services is actually a very short list: $ netstat -lntup | awk '{print $6 $7}'|sed 's/LISTEN//'| cut -d"/" -f2|sort|uniq|grep -v Foreign avahi-daemon:r dhclient dropbox nmbd rpcbind rpc.statd smbd sshd Getting a lay of the land Looking at this list there are ...


10

127.0.0.1 is not the "outside world", it is looking around inside the house. Check your firewall configuration (iptables in Linux today), most of them shouldn't be accessible from the ouside. Don't run services you don't need. Uninstall all not required software. Change passwords to be stronger. Check your usage of the system, don't go chasing any ...


6

Short answer Yes it is possible, use tsocks nmap -sT IP Long answer First of all Tor doesn't use privoxy, Tor provides an socks proxy for connecting via the Tor network. This means you won't see any network routes or things like that on your system but you have to configure your applications to use the Tor socks proxy to connect via Tor. Typical Tor ...


5

why do port 21, 25 and 1863 appear as "filtered" and the 2043 other ports do not appear as filtered? Because in your ISP, router, your network administrator, anything between them, or yourself are filtering them. These ports have a pretty bad history, the 1863 is the port used by the Microsoft instant messaging protocol (aka MSN and friends) which I ...


5

You misunderstand regex syntax. [16-32] does not mean "match 16, 17, ... or 32". It means "match one character which is either 1 or 2 or in the range 6-3" (which is not a valid range, hence the error). It's possible to write a regex to match a range of integers, but it's complex and error prone. In your case, it would be much easier to use nmap's ...


5

To "close" the port you can use iptables sudo iptables -A INPUT -p tcp --dport 23 -m state --state NEW,ESTABLISHED -j DROP


4

It's not clear for me, are you need strings containing only report or open? If so, use: grep : nmap | grep -E "report|open" sed : nmap | sed '/report\|open/!d' if report and open together grep : nmap | grep report | grep open sed : nmap | sed '/report.*open\|open.*report/!d'


4

You can use comma as a separator to separate two different ranges of port. For ex. in your case you can give the following $ nmap 24.0.0.0/24 -p 1-79,81-65535 Hence this way we omitted port scanning on port 80.


4

In its standard mode, nmap does two different types of scan: a host scan, to determine which hosts are available for further port scanning, and a port scan, which reveals the status of ports on available machines. -sn does no port scan, but it does a host scan -- this is particularly useful when scanning a range with nmap, where it will print out those hosts ...


4

Your nmap is trying to query DNS servers to resolve the hostnames associated with the IP addresses your scanning. Because it cannot succeed to do so, it times out, but you get the extra delay in the meanwhile. Use the -n option with nmap to avoid this. That would be: sudo nmap -n -sP 192.168.1.100-200 If you had a properly configured local DNS server ...


3

If your connection is refused, and Nmap shows the port to be closed, then you cannot connect. If you have some other way (physical terminal, virtual console, etc) to get access, you can confirm whether the SSH daemon is running with any of these commands (some may not be available on your system): ps -f -C sshd ps aux | grep sshd sudo netstat -ptan | grep ...


3

If I got the “more or less open ports below 443” case correctly, this should be a generic solution handling it correctly: awk '/\/https\// {for(i=5;i<=NF;i++)if($i~"/open/.+/https/"){sub("/.*","",$i); print $2" "$i}}' nmap-synscan.gnmap


3

Outbound traffic is normally sent with the higher ports. Your port scan happened while a tcp/udp session was in progress and ended before the sequential netstats


3

Have a look in the Nmap book's chapter 13, "Output formats", it has a section on "Grepable Output" and even one on "Output to a Database".


2

172.31.100.0 is the IP address of one of the hosts you scanned. If your network is actually 172.31.96.0/21 (or larger), then 100.0 is a perfectly valid IP address. 172.31.100.0 is part of the pre-CIDR Class B IP space, so you may have gotten a default network of 173.31.0.0/16 if you didn't configure otherwise (and 100.0 completely valid on that network). ...


2

Looking at the nmap-service-probes database, it looks like nmap can't detect which version of uTorrent is running.


2

Well it depends which 'info' you are looking for. Assuming you know what HTTP(S) service and version is running (IIS / Apache / nginx), then you can have an idea of the what is the underlying OS. The more informations you are looking for, the longer the scan will take (also if you trigger an IDS the scan might take ages): Using nmap (FAST) : $ nmap -PN ...


2

Take a look at the Rainmap Web-hosted Nmap scanner. It was developed as a Google Summer of Code project 2 years ago under the guidance of the Nmap development team


2

Rather than post-processing with grep, try passing the --open option to Nmap. This will hide all closed or filtered ports. You can use the -oG or -oA options to output "grepable" results, too. Here's an example that does what I think you're looking for: nmap -p 25 --open -oA smtp-servers-%y%m%d 192.168.15.0/24 The results would be in ...


2

yes, -sn is a ping scan for host discovery, and does not do any detailed port scan (which ports are open on the host). these are 2 different scans that the man page is talking about. your interpretation is pretty close.


2

While you can 'shut' individual services - perhaps it may just be easier to setup a firewall. Nearly all common distro's (Ubuntu, Debian, Centos, etc) have support for iptables built-in. A simple rule-set to get started: (you can just type these in at a command-prompt; to make them permanent add them to your startup scripts or tell us what distro you're ...


2

Firstly, I like to check the linux man(ual) pages for questions like this. Also of note, is that this script uses piping: http://en.wikipedia.org/wiki/Pipeline_%28computing%29 For example, by opening terminal and typing man nmap, we can see what nmap does and what each argument means From the man page for nmap Nmap (“Network Mapper”) is an open source ...


2

You're right that the documentation is worded poorly. -sn means "skip the port scan phase," and was previously available as -sP, with the mnemonic "Ping scan". Nmap scans happen in phases. These are: Name resolution NSE script pre-scan phase Host discovery ("ping" scan, but not necessarily ICMP Echo request) Parallel reverse name resolution Port or ...


2

In version 6.25, Nmap switched the language of the Nmap Scripting Engine (NSE) from Lua 5.1 to Lua 5.2. This means that you must be using at least version 6.25 in order to use the scripts on nmap.org. Ubuntu 12.04 only has Nmap 5.21 available in its repositories, but any release after 13.10 will have a compatible version (6.40 specifically). Upgrading your ...


2

If you do nmap localhost, it tells you about a different situation: some programs on linux work as server although they are used only locally. This is because other programs use them like a server they connect to. So both answers are true, since you ask something different. Port 23 is used for telnet. Normally not used anymore. Try to do nmap -sV ...


2

I wrote this script, and my official guide is available here. The simplest solution is to upgrade to the latest Nmap (version 6.47 as of this writing).


1

'Filtered port' statement from nmap differs according your scan method. The standard scan (TCP Scan if unprivileged user, or Half-Open scan -sS if superuser) relies on TCP protocol . (named 3-way hanshake) A client (you) issues a SYN, if the server replies SYN/ACK : it means that the port is open ! you issues a SYN, if the server replies RST : it means ...


1

It's the fourth choice. Web servers listen on port 80 by default, and that's where -p80 in the nmap command line comes into play. In other words, it's looking for hosts that have port 80 open and seeing which of these will reply to an ICMP ECHO request, otherwise known as a ping.



Only top voted, non community-wiki answers of a minimum length are eligible