Read an Nmap scan and compare two SWEEP

A scan is a map of the way in

An Nmap scan lists every machine that answered, every port each one left open, and the software and version behind each port. For the people defending a network that is the inventory they need. For anyone attacking it, it is the first thing they would build and the most useful thing they could be handed. Uploading one to a web service to make it readable hands it to that service, its logs and its backups, along with the addresses of the network it describes.

The XML Nmap writes is complete and dense and nobody reads it as it comes. This reads it in the tab: the file is opened with the browser's own file reader and parsed here, and the page makes no request with it. It also reads the grepable output, and a scan that was stopped part way, which leaves XML with no ending; every host Nmap finished before it stopped is kept.

What gets picked out, and what does not

• Logins in the clear: Telnet, FTP, the old r-commands, POP3 and IMAP without TLS, TFTP and SNMP.
• Databases and caches on the network: MySQL, PostgreSQL, SQL Server, Oracle, MongoDB, Redis, Elasticsearch, Memcached, CouchDB, Cassandra and ZooKeeper, which should normally answer only to their own application.
• Remote administration and file sharing: RDP, VNC, WinRM, X11 and SSH; SMB, NFS, rpcbind and Windows RPC.
• Container and cluster control: the Docker API without TLS, the Kubernetes API, the kubelet and etcd.
• What Nmap's own scripts said, where the wording is fixed enough to read reliably: anonymous FTP allowed, SMB signing not required, a certificate that has expired or is about to, the weakest TLS cipher grade, a directory listing.

A service is judged by the name Nmap gave it after talking to it. Where Nmap could only guess from the port number, the page says so. It does not say a version is vulnerable: matching versions to advisories needs a vulnerability database and is where scanners are most often wrong, so the version is shown for a person to look up.

Comparing two scans honestly

The useful question is usually not "what is open" but "what is open that was not last month". Given an earlier scan, SWEEP lists ports newly open, ports no longer open, software whose version changed, and hosts that appeared or went. Nmap lists only the ports it looked at, so a port the earlier scan never covered is reported as not compared rather than as newly open, and scans run with different options are flagged, because then a difference can be the scan rather than the network.

For a packet capture from the same network, WIRE reads it, and BEACON finds what is calling home on a timer. For the certificates a scan turns up, CERTLENS takes them apart.