Sign in to follow this  
Followers 0
XxthugstylezxX

nmap...

13 posts in this topic

So this guy that runs this site that has been attacked a few times, has given me permission to pen test it a bit. So i start with a port scan obviously. Well when running nmap on it, it does its thing then after its done doing a stealth syn scan on it, it goes into showing all ports that are filtered. Is there a way i can make it so it excludes the filtered ports? Only reason i ask is because it goest through everyport and everyport is filtered takeing up way more space then the shell allows me to see. So i cant report the whole scan. After its done i can only see the rest of the filtered ports past 760. Thanks for any replys to this.

0

Share this post


Link to post
Share on other sites

i dont know how to exclude the filtered ports, but you can log the whole scan like this

nmap -oN <output file name> <host>

heh if that doesnt work, sorry..

Edited by hbp71605
0

Share this post


Link to post
Share on other sites
i dont know how to exclude the filtered ports, but you can log the whole scan like this

nmap -oN <output file name> <host>

heh if that doesnt work, sorry..

If you're only scanning one host, you can pipe the output through `|grep -i open` to cut down on noise. Of course if you scan multiple hosts this way you'll have no way of knowing from which server the open ports came.

0

Share this post


Link to post
Share on other sites

<nmap commands>|perl -e"foreach(<STDIN>){if($_!~/filtered/i){print $_;}}

Removes ONLY the lines that actually contain the word 'filtered' in any form,

works fine on anything that can run perl (dos,win,lin,mac,etc) :)

0

Share this post


Link to post
Share on other sites
If you're only scanning one host, you can pipe the output through `|grep -i open` to cut down on noise. Of course if you scan multiple hosts this way you'll have no way of knowing from which server the open ports came.

try:

|grep -vi filtered

or also

|grep -iv filtered

Should be the same as the perl command I am running, have not it tested but, assuming I remember the docs that would be it though :)

0

Share this post


Link to post
Share on other sites

ahhhh, now I feel like a a god damned tool for forgetting inverse grep. Good show!

0

Share this post


Link to post
Share on other sites

So your bassicly telling me i need to know some sort of perl in order to get this done?

0

Share this post


Link to post
Share on other sites

Um ya, read over what we posted, nix has a builtin program to do this, read below for windows builtin too..

You can process the output by piping it into grep in linux

original ouput:

Interesting ports on 172.16.1.100:

PORT STATE SERVICE

1/tcp filtered tcpmux

2/tcp filtered

3/..etc..

nmap -sS -p 1-123 -P0 172.168.1.1-200 | grep -i filtered

PORT STATE SERVICE

21/tcp open ftp

22/tcp open ssh

etc..

Removes any line that says 'filtered in it'..

...........................................

I am assuming you are using windows are are too lazy to install perl.. heresy!

Regardless, I shall help ye lost soul:

Windows (xp at least) comes with a CLI tool very similar to grep (though not nearly as powerful) called.. guesswhat?? 'find' :P

nmap -sS -p 1-123 -P0 172.168.1.1-5|find /V /I "filtered"

shows any line that does NOT contain the word 'filtered' in it.. if you really want also go for:

nmap -sS -p 1-123 -P0 172.168.1.1-5|find /V /I "filtered"|find /V /I "closed"|find /V /I "starting nmap"|find /V /I " state "

This will give you:

Interesting ports on 172.168.1.1:

80/tcp open http

Nmap finished: 1 IP address (1 host up) .. :)

---------------

'you are welcome' - 'thank you jabzor' :nono: ^_^

0

Share this post


Link to post
Share on other sites

Hello i dont know much about nmap but www.irongeek.com has some interesting stuff on nmap check his site out.

0

Share this post


Link to post
Share on other sites

Ok first off, you might want to increase the buffer lines in your terminal, what software are you using?

Next its handy to have the output in a file so just redirect it or pipe it through tee:

nmap -sS -p 1-2000 xxx.xxx.xxx.xxx-xxx -P0 | tee scan.log

or if you don't want to watch on the terminal:

nmap -sS -p 1-2000 xxx.xxx.xxx.xxx-xxx -P0 > scan.log

Then you can use what ever you want to filter what text is displayed:

grep -iv filtered scan.log

cat scan.log | sed -e 's/.*filtered.*//gI'

perl -pe 's/.*filtered.*//gi' scan.log

et cetera, et cetera. This assumes you have access to GNU tools and bash for redirection ( comes with any linux distro and cygwin ). If you are pen testing from windows ... well, I can't stop you but I'd recommend you use tools with more transparency with regard to the TCP stack. I don't really want to bring up nessus as it gets whored enough by people that can't appreciate how truely awesome it is, and they end up using it like a shotgun and call themselves professional pen testers ... I'm not saying thats what you are doing, I'm just saying there is enough of that already, and I don't want to contribute to the exploitation of nessus developers.

--ed

0

Share this post


Link to post
Share on other sites

Yes i am on windows, no i do not have linux installed, yes i have perl installed on my windows machine. I'm not that much of a noob i just havent gotten started learning perl yet. Thank you jabar for the insight. But for the love of god please dont pretend like im a child and you have to talk to me as so.

0

Share this post


Link to post
Share on other sites

first: s/jabar/jabzor/

second: Sorry long day combined with the proportion of 13 year old skiddie-wannabes floating around that are kinda getting to me. I automatically grouped you in with them, apologies. :blush:<_<

to summarize and start over:

in nix

<nmap command>|grep -i word_you_don't_want

in windows

<nmap command>|find /V /I "word_you_don't_want"

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0