
Terminal - Commands tagged nmap - 10 results
This is sample output - yours may be different.
Starting Nmap 5.61TEST5 ( http://nmap.org ) at 2012-05-30 10:47 EST
Nmap scan report for syd01s04-in-f0.1e100.net (74.125.237.0)
Nmap scan report for syd01s04-in-f1.1e100.net (74.125.237.1)
Nmap scan report for syd01s04-in-f2.1e100.net (74.125.237.2)
Nmap scan report for syd01s04-in-f3.1e100.net (74.125.237.3)
Nmap scan report for syd01s04-in-f4.1e100.net (74.125.237.4)
Nmap will list all IP's in the target specified, can specify subnet or range of IP addresses. It will attempt to resolve all IP's listed. No packets sent to target only generates DNS queries.
checkport() { sudo nmap -sS -p $1 $2 }
This is sample output - yours may be different.
$ checkport 80 commandlinefu.com
Starting Nmap 5.21 ( http://nmap.org ) at 2011-12-13 11:41 GMT
Nmap scan report for commandlinefu.com (74.207.251.129)
Host is up (0.17s latency).
rDNS record for 74.207.251.129: li93-129.members.linode.com
PORT STATE SERVICE
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 0.71 seconds
Check to see if a port is open or closed on a given host.
nmap -v -sT 192.168.0.0/24
This is sample output - yours may be different.
Scanning 192.168.1.55 [1000 ports]
Discovered open port 22/tcp on 192.168.1.55
Discovered open port 80/tcp on 192.168.1.55
Discovered open port 21/tcp on 192.168.1.55
Completed Connect Scan at 12:35, 1.39s elapsed (1000 total ports)
Nmap scan report for 192.168.1.55
Host is up (0.013s latency).
Not shown: 997 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
MAC Address: 00:1B:2F:2C:53:F4 (Netgear)
TCP Connect scanning for localhost and network 192.168.0.0/24
nmap -sT -PN -vv <target ip>
This is sample output - yours may be different.
Starting Nmap 5.00 ( http://nmap.org ) at 2011-07-21 19:21 PDT
NSE: Loaded 0 scripts for scanning.
Initiating Connect Scan at 19:21
Scanning localhost (127.0.0.1) [1000 ports]
Discovered open port 111/tcp on 127.0.0.1
Discovered open port 993/tcp on 127.0.0.1
Discovered open port 25/tcp on 127.0.0.1
Discovered open port 995/tcp on 127.0.0.1
Discovered open port 113/tcp on 127.0.0.1
Discovered open port 143/tcp on 127.0.0.1
Discovered open port 21/tcp on 127.0.0.1
Discovered open port 110/tcp on 127.0.0.1
Discovered open port 22/tcp on 127.0.0.1
Discovered open port 1984/tcp on 127.0.0.1
Discovered open port 465/tcp on 127.0.0.1
Discovered open port 5432/tcp on 127.0.0.1
Discovered open port 3333/tcp on 127.0.0.1
Discovered open port 10025/tcp on 127.0.0.1
Discovered open port 8333/tcp on 127.0.0.1
Discovered open port 10024/tcp on 127.0.0.1
Discovered open port 2401/tcp on 127.0.0.1
Completed Connect Scan at 19:21, 0.14s elapsed (1000 total ports)
Host localhost (127.0.0.1) is up (0.00092s latency).
Scanned at 2011-07-21 19:21:55 PDT for 0s
Interesting ports on localhost (127.0.0.1):
Not shown: 983 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
110/tcp open pop3
111/tcp open rpcbind
113/tcp open auth
143/tcp open imap
465/tcp open smtps
993/tcp open imaps
995/tcp open pop3s
1984/tcp open bigbrother
2401/tcp open cvspserver
3333/tcp open dec-notes
5432/tcp open postgresql
8333/tcp open unknown
10024/tcp open unknown
10025/tcp open unknown
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.23 seconds
Change the IP address from 127.0.0.1 to the target machines ip address. Even if the target has ICMP (ping) blocked, it will show you what ports are open on the target. Very handy for situations where you know the target is up and online but wont respond to pings.
nmap -oG - -T4 -p22 -v 192.168.0.254 | grep ssh
This is sample output - yours may be different.
Host: 192.168.0.254 () Ports: 22/open/tcp//ssh///
Host: 192.168.0.252 () Ports: 22/closed/tcp//ssh///
Using NMAP to check to see if port 22(SSH) is open on servers and network devices.
nmap -v -sP 192.168.0.0/16 10.0.0.0/8
This is sample output - yours may be different.
Starting Nmap 5.21 ( http://nmap.org ) at 2010-07-01 XX:XX EDT
Initiating Ping Scan at XX:XX
Scanning 4096 hosts [2 ports/host]
Completed Ping Scan at XX:XX, 1.50s elapsed (31 total hosts)
Initiating Parallel DNS resolution of 4096 hosts. at XX:XX
Completed Parallel DNS resolution of 4096 hosts. at XX:XX, 0.00s elapsed
Nmap scan report for 10.0.0.1 [host down]
[... snip ...]
Nmap scan report for host1.localdomain (10.0.0.21)
Host is up (0.00031s latency).
Nmap scan report for host2.localdomain (10.0.0.22)
Host is up (0.00041s latency).
Nmap scan report for 10.0.0.23
Host is up (0.00039s latency).
Nmap scan report for host3.localdomain (10.0.0.24)
Host is up (0.00037s latency).
Nmap scan report for 10.0.0.25 [host down]
Nmap scan report for 10.0.0.26 [host down]
Nmap scan report for 10.0.0.27 [host down]
Nmap scan report for host4.localdomain (10.0.0.28)
Host is up (0.0047s latency).
Nmap scan report for 10.0.0.29 [host down]
Nmap scan report for 10.0.0.30 [host down]
Nmap scan report for 10.0.0.31
Host is up (0.0033s latency).
Nmap scan report for 10.0.0.32
Host is up (0.0031s latency).
Nmap scan report for 10.0.0.33 [host down]
Nmap scan report for 10.0.0.34 [host down]
Nmap scan report for 10.0.0.48 [host down]
[... snip ...]
Nmap scan report for 10.0.0.49 [host down]
Nmap scan report for 10.255.255.255 [host down]
Nmap done: 4096 IP addresses (7 hosts up) scanned in XXX seconds
nmap for windows and other platforms is available on developer's site: http://nmap.org/download.html
nmap is robust tool with many options and has various output modes - is the best (imho) tool out there..
from nmap 5.21 man page:
-oN/-oX/-oS/-oG : Output scan in normal, XML, s|
sudo nmap -F -O 192.168.1.1-255 | grep "Running: " > /tmp/os; echo "$(cat /tmp/os | grep Linux | wc -l) Linux device(s)"; echo "$(cat /tmp/os | grep Windows | wc -l) Window(s) devices"
This is sample output - yours may be different.
3 Linux device(s)
2 Window(s) devices
Shows how many Windows and Linux devices are on your network.
May add support for others, but that's all that are on my network right now.
nmap -R -sL 209.85.229.99/27 | awk '{if($3=="not")print"("$2") no PTR";else print$3" is "$2}' | grep '('
This is sample output - yours may be different.
(209.85.229.96) is ww-in-f96.google.com
(209.85.229.97) is ww-in-f97.google.com
(209.85.229.98) is ww-in-f98.google.com
(209.85.229.99) is ww-in-f99.google.com
(209.85.229.100) is ww-in-f100.google.com
(209.85.229.101) is ww-in-f101.google.com
(209.85.229.102) is ww-in-f102.google.com
(209.85.229.103) is ww-in-f103.google.com
(209.85.229.104) is ww-in-f104.google.com
(209.85.229.105) is ww-in-f105.google.com
(209.85.229.106) is ww-in-f106.google.com
(209.85.229.107) no PTR
(209.85.229.108) no PTR
(209.85.229.109) no PTR
(209.85.229.110) no PTR
(209.85.229.111) no PTR
(209.85.229.112) is ww-in-f112.google.com
(209.85.229.113) is ww-in-f113.google.com
(209.85.229.114) no PTR
(209.85.229.115) is ww-in-f115.google.com
(209.85.229.116) is ww-in-f116.google.com
(209.85.229.117) no PTR
(209.85.229.118) is ww-in-f118.google.com
(209.85.229.119) no PTR
(209.85.229.120) is ww-in-f120.google.com
(209.85.229.121) no PTR
(209.85.229.122) no PTR
(209.85.229.123) is ww-in-f123.google.com
(209.85.229.124) no PTR
(209.85.229.125) is ww-in-f125.google.com
(209.85.229.126) is ww-in-f126.google.com
(209.85.229.127) is ww-in-f127.google.com
This command uses nmap to perform reverse DNS lookups on a subnet. It produces a list of IP addresses with the corresponding PTR record for a given subnet. You can enter the subnet in CDIR notation (i.e. /24 for a Class C)). You could add "--dns-servers x.x.x.x" after the "-sL" if you need the lookups to be performed on a specific DNS server.
On some installations nmap needs sudo I believe. Also I hope awk is standard on most distros.
while true; do clear; nmap ${hostname} -PN -p ${hostport}; sleep 5; done
This is sample output - yours may be different.
Starting Nmap 4.76 ( http://nmap.org ) at 2009-08-14 22:14 CEST
Interesting ports on 192.168.0.1:
PORT STATE SERVICE
80/tcp open http
the command for the impatient sysadmin: simply checks every five secs, if a host or a specific service running on it is up. ideal for hosts that are configured not to respond on pings.
diff <(nmap -sP 192.168.1.0/24 | grep ^Host | sed 's/.appears to be up.//g' | sed 's/Host //g') auth.hosts | sed 's/[0-9][a-z,A-Z][0-9]$//' | sed 's/</UNAUTHORIZED IP -/g'
This is sample output - yours may be different.
UNAUTHORIZED IP - 192.168.1.69
populate the auth.hosts file with a list of IP addresses that are authorized to be in use and when you run this command it will return the addresses that are pingable and not in the authorized list.
Can be combined with the "Command line Twitter" command to tweet unauthorized access.