Skip to content

Instantly share code, notes, and snippets.

@tulik

tulik/Full nmap LAN scan

Last active September 19, 2022 13:31
Show Gist options
  • Save tulik/42aa8dc8edfa071496317bb454f88420 to your computer and use it in GitHub Desktop.
Save tulik/42aa8dc8edfa071496317bb454f88420 to your computer and use it in GitHub Desktop.
Download ZIP
Nmap - Example scan of local network services
Raw
Full nmap LAN scan
➜ ~ arp -a | awk '{ print $2 }' | tr -d '()' > /dev/null | sudo xargs nmap -sSV -Pn -A
Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-17 01:10 BST
WARNING: Service 192.168.0.1:5000 had already soft-matched upnp, but now soft-matched rtsp; ignoring second value
Stats: 0:01:02 elapsed; 7 hosts completed (3 up), 3 undergoing Service Scan
Service scan Timing: About 69.23% done; ETC: 01:11 (0:00:05 remaining)
WARNING: Service 192.168.0.1:5000 had already soft-matched upnp, but now soft-matched sip; ignoring second value
Stats: 0:01:17 elapsed; 7 hosts completed (3 up), 3 undergoing Service Scan
Service scan Timing: About 84.62% done; ETC: 01:12 (0:00:05 remaining)
Nmap scan report for 192.168.0.1
Host is up (0.015s latency).
Not shown: 995 closed ports
PORT STATE SERVICE VERSION
80/tcp open http lighttpd
|_http-server-header: lighttpd
|_http-title: Site doesn't have a title (text/html).
443/tcp open ssl/http lighttpd
|_http-title: Site doesn't have a title (text/html).
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=ARRIS Group Inc./stateOrProvinceName=Georgia/countryName=US
| Not valid before: 2015-07-16T02:49:47
|_Not valid after: 2044-09-11T02:49:47
|_ssl-date: TLS randomness does not represent time
5000/tcp open upnp MiniUPnP 1.9 (UPnP 1.1)
| fingerprint-strings:
| FourOhFourRequest, GetRequest:
| HTTP/1.0 404 Not Found
| Content-Type: text/html
| Connection: close
| Content-Length: 134
| Server: RedHatEnterpriseServer/6.10 UPnP/1.1 MiniUPnPd/1.9
| Ext:
| <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>Not Found</H1>The requested URL was not found on this server.</BODY></HTML>
| GenericLines:
| 501 Not Implemented
| Content-Type: text/html
| Connection: close
| Content-Length: 149
| Server: RedHatEnterpriseServer/6.10 UPnP/1.1 MiniUPnPd/1.9
| Ext:
| <HTML><HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>Not Implemented</H1>The HTTP Method is not implemented by this server.</BODY></HTML>
| HTTPOptions:
| HTTP/1.0 501 Not Implemented
| Content-Type: text/html
| Connection: close
| Content-Length: 149
| Server: RedHatEnterpriseServer/6.10 UPnP/1.1 MiniUPnPd/1.9
| Ext:
| <HTML><HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>Not Implemented</H1>The HTTP Method is not implemented by this server.</BODY></HTML>
| RTSPRequest:
| RTSP/1.0 501 Not Implemented
| Content-Type: text/html
| Connection: close
| Content-Length: 149
| Server: RedHatEnterpriseServer/6.10 UPnP/1.1 MiniUPnPd/1.9
| Ext:
|_ <HTML><HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>Not Implemented</H1>The HTTP Method is not implemented by this server.</BODY></HTML>
8081/tcp filtered blackice-icecap
8082/tcp filtered blackice-alerts
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port5000-TCP:V=7.70%I=7%D=5/17%Time=5CDDFC3D%P=x86_64-apple-darwin18.0.
SF:0%r(GenericLines,130,"\x20501\x20Not\x20Implemented\r\nContent-Type:\x2
SF:0text/html\r\nConnection:\x20close\r\nContent-Length:\x20149\r\nServer:
SF:\x20RedHatEnterpriseServer/6\.10\x20UPnP/1\.1\x20MiniUPnPd/1\.9\r\nExt:
SF:\r\n\r\n<HTML><HEAD><TITLE>501\x20Not\x20Implemented</TITLE></HEAD><BOD
SF:Y><H1>Not\x20Implemented</H1>The\x20HTTP\x20Method\x20is\x20not\x20impl
SF:emented\x20by\x20this\x20server\.</BODY></HTML>\r\n")%r(GetRequest,123,
SF:"HTTP/1\.0\x20404\x20Not\x20Found\r\nContent-Type:\x20text/html\r\nConn
SF:ection:\x20close\r\nContent-Length:\x20134\r\nServer:\x20RedHatEnterpri
SF:seServer/6\.10\x20UPnP/1\.1\x20MiniUPnPd/1\.9\r\nExt:\r\n\r\n<HTML><HEA
SF:D><TITLE>404\x20Not\x20Found</TITLE></HEAD><BODY><H1>Not\x20Found</H1>T
SF:he\x20requested\x20URL\x20was\x20not\x20found\x20on\x20this\x20server\.
SF:</BODY></HTML>\r\n")%r(RTSPRequest,138,"RTSP/1\.0\x20501\x20Not\x20Impl
SF:emented\r\nContent-Type:\x20text/html\r\nConnection:\x20close\r\nConten
SF:t-Length:\x20149\r\nServer:\x20RedHatEnterpriseServer/6\.10\x20UPnP/1\.
SF:1\x20MiniUPnPd/1\.9\r\nExt:\r\n\r\n<HTML><HEAD><TITLE>501\x20Not\x20Imp
SF:lemented</TITLE></HEAD><BODY><H1>Not\x20Implemented</H1>The\x20HTTP\x20
SF:Method\x20is\x20not\x20implemented\x20by\x20this\x20server\.</BODY></HT
SF:ML>\r\n")%r(HTTPOptions,138,"HTTP/1\.0\x20501\x20Not\x20Implemented\r\n
SF:Content-Type:\x20text/html\r\nConnection:\x20close\r\nContent-Length:\x
SF:20149\r\nServer:\x20RedHatEnterpriseServer/6\.10\x20UPnP/1\.1\x20MiniUP
SF:nPd/1\.9\r\nExt:\r\n\r\n<HTML><HEAD><TITLE>501\x20Not\x20Implemented</T
SF:ITLE></HEAD><BODY><H1>Not\x20Implemented</H1>The\x20HTTP\x20Method\x20i
SF:s\x20not\x20implemented\x20by\x20this\x20server\.</BODY></HTML>\r\n")%r
SF:(FourOhFourRequest,123,"HTTP/1\.0\x20404\x20Not\x20Found\r\nContent-Typ
SF:e:\x20text/html\r\nConnection:\x20close\r\nContent-Length:\x20134\r\nSe
SF:rver:\x20RedHatEnterpriseServer/6\.10\x20UPnP/1\.1\x20MiniUPnPd/1\.9\r\
SF:nExt:\r\n\r\n<HTML><HEAD><TITLE>404\x20Not\x20Found</TITLE></HEAD><BODY
SF:><H1>Not\x20Found</H1>The\x20requested\x20URL\x20was\x20not\x20found\x2
SF:0on\x20this\x20server\.</BODY></HTML>\r\n");
MAC Address: C0:05:C2:20:91:18 (Arris Group)
Device type: WAP|general purpose
Running: Ubee embedded, Arris embedded, Linux 2.6.X
OS CPE: cpe:/h:ubee:evw3226 cpe:/h:arris:tg1672 cpe:/h:arris:tg862g cpe:/o:linux:linux_kernel:2.6.18
OS details: Ubee EVW3226 or Arris TG1672 or TG862G cable modem (Linux 2.6.18)
Network Distance: 1 hop
TRACEROUTE
HOP RTT ADDRESS
1 14.90 ms 192.168.0.1
Nmap scan report for 192.168.0.18
Host is up (0.020s latency).
Not shown: 995 closed ports
PORT STATE SERVICE VERSION
3689/tcp open daap Apple iTunes DAAP 11.1b37
5000/tcp open rtsp AirTunes rtspd 220.68
|_rtsp-methods: ANNOUNCE, SETUP, RECORD, PAUSE, FLUSH, TEARDOWN, OPTIONS, GET_PARAMETER, SET_PARAMETER, POST, GET, PUT
7000/tcp open rtsp AirTunes rtspd 220.68
|_irc-info: Unable to open connection
|_rtsp-methods: ANNOUNCE, SETUP, RECORD, PAUSE, FLUSH, TEARDOWN, OPTIONS, GET_PARAMETER, SET_PARAMETER, POST, GET, PUT
7100/tcp open http Apple AirPlay httpd
|_http-title: Site doesn't have a title.
62078/tcp open tcpwrapped
MAC Address: A4:31:35:18:96:C2 (Apple)
OS details: Apple Mac OS X 10.7.0 (Lion) - 10.12 (Sierra) or iOS 4.1 - 9.3.3 (Darwin 10.0.0 - 16.4.0)
Network Distance: 1 hop
Service Info: OS: OS X; Device: media device
TRACEROUTE
HOP RTT ADDRESS
1 20.04 ms 192.168.0.18
Nmap scan report for 192.168.0.30
Host is up (0.017s latency).
Not shown: 995 filtered ports
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows 7 Enterprise 7601 Service Pack 1 microsoft-ds (workgroup: HOUSE)
8081/tcp open http Network Associates ePO Agent (Agent ListenServer 1.0)
|_http-server-header: Agent-ListenServer-HttpSvr/1.0
|_http-title: Site doesn't have a title (text/xml).
49163/tcp open msrpc Microsoft Windows RPC
MAC Address: 10:02:B5:B3:B9:74 (Intel Corporate)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|specialized|phone
Running: Microsoft Windows 2008|8.1|7|Phone|Vista
OS CPE: cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1
OS details: Microsoft Windows Server 2008 R2 or Windows 8.1, Microsoft Windows Embedded Standard 7, Microsoft Windows Phone 7.5 or 8.0, Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7, Microsoft Windows Vista SP2, Windows 7 SP1, or Windows Server 2008
Network Distance: 1 hop
Service Info: Host: GENES; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: -20m00s, deviation: 34m37s, median: -1s
|_nbstat: NetBIOS name: GENES, NetBIOS user: <unknown>, NetBIOS MAC: 10:02:b5:b3:b9:74 (Intel Corporate)
| smb-os-discovery:
| OS: Windows 7 Enterprise 7601 Service Pack 1 (Windows 7 Enterprise 6.1)
| OS CPE: cpe:/o:microsoft:windows_7::sp1
| Computer name: Genes
| NetBIOS computer name: GENES\x00
| Workgroup: HOUSE\x00
|_ System time: 2019-05-17T01:12:32+01:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2019-05-17 01:12:33
|_ start_date: 2019-05-16 19:40:51
TRACEROUTE
HOP RTT ADDRESS
1 17.24 ms 192.168.0.30
Nmap scan report for 192.168.0.16
Host is up (0.000050s latency).
All 1000 scanned ports on 192.168.0.16 are closed (500) or filtered (500)
Too many fingerprints match this host to give specific OS details
Network Distance: 0 hops
Nmap scan report for 192.168.162.1
Host is up (0.000083s latency).
All 1000 scanned ports on 192.168.162.1 are closed
Too many fingerprints match this host to give specific OS details
Network Distance: 0 hops
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 12 IP addresses (5 hosts up) scanned in 163.18 seconds
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment