Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 40 guests and 1 member online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Network Pen Testingarrow Nmap show a lot of ports
EH-Net
May 23, 2013, 12:44:03 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Nmap show a lot of ports  (Read 6840 times)
0 Members and 1 Guest are viewing this topic.
impelse
Hero Member
*****
Offline Offline

Posts: 565


View Profile WWW
« on: April 27, 2009, 11:49:20 PM »

I am running a scan to a computer in internet and show me a looooooot of ports, and I know that it is not normall and that the all ports they are not open, I checked google but I could not find anything, somebody mention that probably is the firewall:

nmap -sS -sV -PO 192.168.1.1

Shows a lot of ports unknown and tcpwarpped, just want to see the open ports not the all the existing ports list.

But if I run the same command in a local computer shows me the really open ports.

What is worng? is it my firewall or I am mising another parameter?
Logged

CCNA, Security+, 70-290, 70-291
CCNA Security
Taking Hackingdojo training

Website: http://blog.thehost1.com/
jimbob
Guest
« Reply #1 on: April 28, 2009, 04:52:04 AM »

Hi,
What device are you scanning? Are you sure that the open ports are false positives?

Jimbob
Logged
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #2 on: April 28, 2009, 07:15:01 AM »

It could be a defensive mechanism on the other side as well.   I have a firewall I put together a while back that responded OPEN on the first 1024 ports when scanned.   It was an IpCop Distro with a few add-ons.
Logged

~~~~~~~~~~~~~~
Ketchup
impelse
Hero Member
*****
Offline Offline

Posts: 565


View Profile WWW
« Reply #3 on: April 28, 2009, 08:12:43 AM »

Its a web server with CentOS and there is not firewall there. Let me see another machine (but all of them are CentOS).

But my question is: the command and the parameter is ok?
Logged

CCNA, Security+, 70-290, 70-291
CCNA Security
Taking Hackingdojo training

Website: http://blog.thehost1.com/
Kev
Sr. Member
****
Offline Offline

Posts: 428


View Profile
« Reply #4 on: April 28, 2009, 10:38:11 AM »

Your command and parameter is ok. But dont use just one technique when scanning. That the beauty of nmap and its the most customizable scanner availble.  When you start combining timing options,etc... you sometimes obtain more reliable output. 
Logged
timmedin
Sr. Member
****
Offline Offline

Posts: 469



View Profile WWW
« Reply #5 on: April 28, 2009, 12:03:51 PM »

Sounds like a setting a setting in the firewall. What if you try one of the other scan options.
sS - TCP SYN
sT - Connect()
sA - ACK
sW - Window
sM - Maimon scans
Logged

twitter.com/timmedin | http://blog.securitywhole.com
sgt_mjc
Sr. Member
****
Offline Offline

Posts: 294


View Profile
« Reply #6 on: April 28, 2009, 02:02:22 PM »

And don't forget the swiss army knife, netcat. You can always try connectign to the suspected port with nc -v 192.168.1.1 x where x is the port you want to connect to. If its open, you'll know along with its banner. Good luck.
Logged

Mike Conway
CISSP
CompTia Security +
C|EH
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #7 on: April 28, 2009, 02:13:20 PM »

impelse, also make sure you are running NMAP as root / administrator.   I have had some weird results, especially on nix when sudo'ing out.
Logged

~~~~~~~~~~~~~~
Ketchup
impelse
Hero Member
*****
Offline Offline

Posts: 565


View Profile WWW
« Reply #8 on: April 28, 2009, 02:22:34 PM »

I am using nmap with BackTrack 4 Beta, I am just experimenting a little bit, just to be familiar with it.

Logged

CCNA, Security+, 70-290, 70-291
CCNA Security
Taking Hackingdojo training

Website: http://blog.thehost1.com/
Artful Dodger
Newbie
*
Offline Offline

Posts: 43


View Profile
« Reply #9 on: April 29, 2009, 12:38:15 PM »

Ive seen this happen when scsanning an ISA box.  It showed almost all ports opened.  They were false positives that I think were due to how it was proxying.
Logged

CISSP, C|HFI, Security+, Network+, XYZ...blah.
impelse
Hero Member
*****
Offline Offline

Posts: 565


View Profile WWW
« Reply #10 on: April 29, 2009, 01:21:16 PM »

I tested from my office and showed me just the open ports, so I tested from my home again and I got all the ports open, so I decided to upgrade therouter's firmware for the Linksys WTR54GS and after that I can not ping outside, jajajajajaj, it was to late so I couldn't complete a test with the nmap, because told me to use the -PN switch.

Now, I have to figure out why I can not ping outside, I did not setup any policy.

Logged

CCNA, Security+, 70-290, 70-291
CCNA Security
Taking Hackingdojo training

Website: http://blog.thehost1.com/
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.102 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.