Read an Nmap Scan and Compare Two SWEEP
Open the XML or grepable output of an Nmap scan and see every host and open port, with the ones worth a second look picked out. Add an earlier scan to see what changed.
The scan
Or paste it
Or paste it
To make the file: nmap -sV -oX scan.xml 192.0.2.0/24, or -oA scan for all three formats at once. Scan only networks you are allowed to.
What answered
Worth a second look
What changed since the earlier scan
Every host and open port
A scan is a map of the way in
An Nmap scan lists every machine that answered, every port each one left open, and the software and version behind each port. For the people defending a network that is the inventory they need. For anyone attacking it, it is the first thing they would build and the most useful thing they could be handed. Uploading one to a web service to make it readable hands it to that service, its logs and its backups, along with the addresses of the network it describes.
The XML Nmap writes is complete and dense and nobody reads it as it comes. This reads it in the tab: the file is opened with the browser's own file reader and parsed here, and the page makes no request with it. It also reads the grepable output, and a scan that was stopped part way, which leaves XML with no ending; every host Nmap finished before it stopped is kept.
What gets picked out, and what does not
- Logins in the clear: Telnet, FTP, the old r-commands, POP3 and IMAP without TLS, TFTP and SNMP.
- Databases and caches on the network: MySQL, PostgreSQL, SQL Server, Oracle, MongoDB, Redis, Elasticsearch, Memcached, CouchDB, Cassandra and ZooKeeper, which should normally answer only to their own application.
- Remote administration and file sharing: RDP, VNC, WinRM, X11 and SSH; SMB, NFS, rpcbind and Windows RPC.
- Container and cluster control: the Docker API without TLS, the Kubernetes API, the kubelet and etcd.
- What Nmap's own scripts said, where the wording is fixed enough to read reliably: anonymous FTP allowed, SMB signing not required, a certificate that has expired or is about to, the weakest TLS cipher grade, a directory listing.
A service is judged by the name Nmap gave it after talking to it. Where Nmap could only guess from the port number, the page says so. It does not say a version is vulnerable: matching versions to advisories needs a vulnerability database and is where scanners are most often wrong, so the version is shown for a person to look up.
Comparing two scans honestly
The useful question is usually not "what is open" but "what is open that was not last month". Given an earlier scan, SWEEP lists ports newly open, ports no longer open, software whose version changed, and hosts that appeared or went. Nmap lists only the ports it looked at, so a port the earlier scan never covered is reported as not compared rather than as newly open, and scans run with different options are flagged, because then a difference can be the scan rather than the network.
For a packet capture from the same network, WIRE reads it, and BEACON finds what is calling home on a timer. For the certificates a scan turns up, CERTLENS takes them apart.
Questions people ask about SWEEP
Which Nmap output does it read?
The XML from -oX, which carries everything, and the grepable text from -oG. Nmap's normal output (-oN) is written for people rather than programs and changes between versions, so SWEEP asks for the XML instead. -oA name writes all three at once.
Is the scan uploaded anywhere?
No. The file is read by the browser and parsed in the tab, and the page makes no request with it. Turn the network off after the page has loaded and it works the same.
Does it tell me which versions are vulnerable?
No, on purpose. Matching a product and version to security advisories needs a vulnerability database, and it is where scanners go wrong most: backported fixes, distribution version strings and vague banners all produce false alarms. SWEEP shows the product and version Nmap found so they can be looked up.
Why is a port listed as not compared?
Because Nmap only reports the ports it scanned. If the earlier scan covered the top thousand ports and the newer one covered all of them, a port outside the thousand that is open now was never looked at before. Calling it newly open would be a guess, so SWEEP keeps it separate.
Can it read a scan that was stopped part way?
Yes. An interrupted scan leaves an XML file with no ending. SWEEP drops the host that was being written when it stopped and reads every host Nmap had finished.
Why is SSH listed under remote administration?
It is not a fault; SSH is the right way to administer a machine. It is listed because every remote administration service should be reachable only from where administrators actually are, and a scan from the wrong side of a firewall that finds it open is worth knowing about.