Re: help interpreting the nmap output

[miguel.dilaj () pharma novartis com]

Hi Ivan,

Good! Yes, you guess correctly, it seems that Apache was setup to show 
only its name.
For other ports, like services that don't have a text banner, you've 2 
very nice options:

a) use the -sV option in nmap. Read The Fine Manual, and also the article 
at http://www.insecure.org/nmap/versionscan.html
Take into account that this is not stealth (like -sS), it establishes the 
full TCP connection.
Be sure to use latest nmap, this option is quite new (>=3.45).
There's also a good article by Brian Hatch at InfoSec News: 
http://lists.virus.org/isn-0310/msg00030.html

b) use amap (http://www.thc.org/releases.php)
Amap is a next-generation scanning tool, which identifies applications and 
services even if they are not listening on the default port by creating a 
bogus-communication and analyzing the responses. Changes: more 
identifications, SSL bugix. Voted into the top-50 security tool list!

There're other tools out there to do the identification, Nessus for 
example can do some detection, but the 2 tools above are the preferred 
ones by most people (in my case: plain nmap, but I recognize the merits of 
amap as well).

Cheers,

Miguel Dilaj (Nekromancer)
Vice-President of IT Security Research, OISSG







"Ivan Fratric" <hacky_2001 () hotmail com>
16/12/2004 19:57

 
        To:     Miguel Dilaj/PH/Novartis@PH, security-basics () securityfocus com
        cc: 
        Subject:        Re: help interpreting the nmap output


Thanks for the reply. I tried using netcat, and I get the following

nc -vv xxx.xxx.xxx.xxx 80
xxxxxxxxxxxx.com [xxx.xxx.xxx.xxx] 80 (http) open
HEAD / HTTP/1.1
Host: www.xxxxxxxxxxx.com

HTTP/1.1 200 OK
Date: Thu, 16 Dec 2004 19:41:45 GMT
Server: Apache
Content-Type: text/html; charset=iso-8859-1

So I guess the apache is configured not to show its version? When I try 
using netcat on the other mentioned ports I get something like

nc -vv xxx.xxx.xxx.xxx 23
xxxxxxxxxxxx.com [xxx.xxx.xxx.xxx] 23 (telnet) open
sent 0, rcvd 0: NOTSOCK

Is there anything else that can be done regarding the ports giving output 
like this?