[maverickuk82]

Hello All,

I have a question about port scanning.

I have a test network that I all practising with.
I have remote access to the router.
There are many clients behind the router, two of which are are PCs with static ips which I assume are running Windows 10. I have registered the router with a ddns service so I can maintain access if the IP address changes

Initial nmap scan using -Pn and -p- only bring up the remote access port and FTP port, which I have set up, as expected.

So for my first test I have port forwarded all connections with exception of the remote router access port to static computer #1 The same nmap scan only shows one port open. The same for static computer #2. It's port 7680 which nmap says the service is panda something.

There are quite a few windows ports open as default why isn't my scan showing these? I'm assuming it's because I'm sending the requests from the internet and defender is blocking them - there must be a way to get round this. I'm assuming it's a different type of scan required...

Any ideas?

[Fedd77]

Nmap will not scan the 65535 ports by default, only a list of common ports. To instruct Nmap to scan ALL ports, use the parameter -p, like -p 1-65535.

[M L T]

There are quite a few windows ports open as default why isn't my scan showing these? I'm assuming it's because I'm sending the requests from the internet and defender is blocking them - there must be a way to get round this. I'm assuming it's a different type of scan required...

Any ideas?

nmap will only scan commonly-utilized ports by default unless you add additional flags (as in, more than -Pn, iirc the -Pn flags just help deal w/ dns resolution? pretty sure you use -p then specify the port range.. the -n flag is "no dns resolution" if i remember correctly, so with -Pn you're specifying a port scan on limited ports, as in, only common ports, with no DNS resolution. You should specify the p flag followed by the port range e.g. -p 1-1337 to scan ports 1 through to 1337)

So, I'm guessing the Windows apps you're discussing aren't frequently used ports (at least not as frequent as you think), so as a result, it's not including them in the scan because you havent specified the flags to scan all ports as a command-line arg while running nmap.

EDIT: YUP. What this guy said

Nmap will not scan the 65535 ports by default, only a list of common ports. To instruct Nmap to scan ALL ports, use the parameter -p, like -p 1-65535.

[Sigma]

Yeah just use Nmap as a base and scan multiple ports. Then you will know what to do from there judging off the open ports.

[maverickuk82]

Nmap will not scan the 65535 ports by default, only a list of common ports. To instruct Nmap to scan ALL ports, use the parameter -p,  like -p 1-65535.

Hi ya thanks for the message. I used the -p- tag which sets it to scan all ports. This is how I found the 7680 p port. I am going to try ezperimentng with different types of scans tonight see if I can find the other open ones

[Fedd77]

Hi ya thanks for the message. I used the -p- tag which sets it to scan all ports. This is how I found the 7680 p port. I am going to try ezperimentng with different types of scans tonight see if I can find the other open ones

You can play with different techniques , like SYN, FIN, NULL, XMAS ... also you can use -sV switch to analyze discovered services, and query for info, banner etc. Nmap is a very nice tool, and you can learn a lot from it. Try to capture network traffic during the scan to see what's really happens at network level when you scan a host ... have a lot fun!

[Apricus]

use netcat its free on github man

[Nomad.Null]

More than likely, the cause is actually the router firewall. Most ports are blocked externally by default which is desirable behavior. However you may also be right in assuming that the Windows firewall is blocking the traffic based on its's source. If the host firewall is configured not to trust inbound traffic from the internet or non-domain hosts, it will likely be dropped.

If you want to assign specific host ports to the router via port forwarding and set up firewall ezceptions, you can do that, but a more effective and less painful approach would be to set up an OpenVPN server on your network and connect to that. This would give you access to the local network as if your machine was physically connected, provided you configure your subnets and routes correctly. You'll need to do a bit of research, but this is the best and safest way to set up an external security lab. It will be good practice for you as well. :)

[maverickuk82]

Thanks for the great feedback guys!

I'm not sure it's the router firewall, since I forwarded all ports to the machine I wanted to scan apart from the remote access port.

There is an option to set a machine to a dmz which forwards all ports but I'm scared I might lose access and I'm a few hundred miles away from the router.

With regards to OpenVPN that was my initial idea however the router does not support it, or at least, there's no option for it on the router admin page... Any ideas round this? Is there a way to remote install dd-wrt on the router without losing remote access?

[Mariano Gregorio]

I'm In need of help on how to use SMTP via a SSH tunnel i need someone to teach me. CONFIGURE SSH TUNNEL/ROOT FOR ANY MASS-SENDER. How to do it, from anydesk or something. I Will pay for you to teach me in BTC. Please help me if anyone know about that.