Nmap 자가 스캔 :: 불필요한 포트 찾아서 줄이기

Nmap 자가 스캔 :: 불필요한 포트 찾아서 줄이기

* Nmap: 네트워크에 열려있는 포트와 서비스를 한 번에 스캔해주는 도구
지금까지 nc -zv로 포트 하나씩 확인했던 걸, Nmap은 지정한 범위 전체를 한 번에 스캔해줌

필요성: 서버를 운영하다 보면 테스트로 켰다가 안 끈 서비스, 설치 과정에서 자동으로 열린 포트가 남아있는 경우가 흔함
공격자 입장에서 정찰(Reconnaissance) 단계에 Nmap을 쓰는 것과 똑같은 방식으로, 방어자 입장에서 먼저 스캔해서 불필요한 노출을 줄이는 게 목적

설치
sudo apt install nmap -y

기본 포트 스캔
nmap localhost

 
Starting Nmap 7.98 ... at 2026-08-14 16:19
스캔 시작 시각과 사용한 Nmap 버전

Nmap scan report for localhost (127.0.0.1)
스캔 대상, localhost가 127.0.0.1로 해석됨
Host is up (0.0012s latency)
대상 호스트가 살아있고 응답 속도(핑 왕복시간)가 매우 빠름, 로컬이라 당연히 빠름
Other addresses for localhost (not scanned): ::1
IPv6 주소(::1)도 있지만 이번 스캔 대상에는 포함 안 됨
Not shown: 992 closed tcp ports (conn-refused)
기본 스캔 대상 1000개 포트 중 992개는 닫혀있어서(연결 거부) 목록에서 생략, 나머지 8개만 아래 표에 표시

22/tcp open ssh: SSH 접속용 포트
23/tcp open telnet: 텔넷 서비스
80/tcp open http: 웹 서버(비암호화)
631/tcp open ipp: 프린터 관리용 프로토콜(CUPS)
3306/tcp open mysql: MySQL/MariaDB 데이터베이스 포트
8080/tcp open http-proxy: 대체 웹 포트
8081/tcp open blackice-icecap
8200/tcp open trivnet1

Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds
스캔 대상 1개, 살아있는 호스트 1개, 총 소요 시간 0.07초

전체 포트 범위 스캔
sudo nmap -p- localhost

>> 1번부터 65535번까지 모든 포트를 스캔하는 명령어


8201/tcp open trivnet2

39425/tcp open unknown
Not shown: 65525 closed tcp ports (reset)
나머지 65525개 포트는 닫혀있음

서비스 버전까지 확인
sudo nmap -sV localhost

bastion@sieun:~$ sudo nmap -sV localhost
Starting Nmap 7.98 ( https://nmap.org ) at 2026-08-14 16:21 +0900
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000010s latency).
Other addresses for localhost (not scanned): ::1
Not shown: 992 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 10.2p1 Ubuntu 2ubuntu3.5 (Ubuntu Linux; protocol 2.0)
23/tcp   open  telnet
80/tcp   open  http    nginx 1.28.3 (Ubuntu)
631/tcp  open  ipp     CUPS 2.4
3306/tcp open  mysql?
8080/tcp open  http    Apache Tomcat
8081/tcp open  http    Apache httpd 2.4.66 ((Ubuntu))
8200/tcp open  http    Golang net/http server
3 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port23-TCP:V=7.98%I=7%D=8/14%Time=6A7EC1F9%P=aarch64-unknown-linux-gnu%
SF:r(GenericLines,15,"\xff\xfb%\xff\xfb&\xff\xfd\x18\xff\xfd\x20\xff\xfd#\
SF:xff\xfd'\xff\xfd\$");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port3306-TCP:V=7.98%I=7%D=8/14%Time=6A7EC1F4%P=aarch64-unknown-linux-gn
SF:u%r(NULL,6D,"i\0\0\0\n11\.8\.6-MariaDB-5ubuntu0\.1\x20from\x20Ubuntu\0B
SF:\0\0\0WZ>edGs2\0\xfe\xff-\x02\0\xff\x81\x15\0\0\0\0\0\0=\0\0\0:n>'Ht29h
SF:\$r6\0mysql_native_password\0")%r(GenericLines,A5,"i\0\0\0\n11\.8\.6-Ma
SF:riaDB-5ubuntu0\.1\x20from\x20Ubuntu\0B\0\0\0WZ>edGs2\0\xfe\xff-\x02\0\x
SF:ff\x81\x15\0\0\0\0\0\0=\0\0\0:n>'Ht29h\$r6\0mysql_native_password\x004\
SF:0\0\x01\xffj\x04#HY000Proxy\x20header\x20is\x20not\x20accepted\x20from\
SF:x20127\.0\.0\.1")%r(LDAPBindReq,6D,"i\0\0\0\n11\.8\.6-MariaDB-5ubuntu0\
SF:.1\x20from\x20Ubuntu\0S\0\0\0`\*O1EHyH\0\xfe\xff-\x02\0\xff\x81\x15\0\0
SF:\0\0\0\0=\0\0\0=8\?rB4y\*a\+Q5\0mysql_native_password\0")%r(afp,6D,"i\0
SF:\0\0\n11\.8\.6-MariaDB-5ubuntu0\.1\x20from\x20Ubuntu\0\]\0\0\0a;@n,0I\^
SF:\0\xfe\xff-\x02\0\xff\x81\x15\0\0\0\0\0\0=\0\0\0~!#\+Q4Ossh1Z\0mysql_na
SF:tive_password\0");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port8200-TCP:V=7.98%I=7%D=8/14%Time=6A7EC1F8%P=aarch64-unknown-linux-gn
SF:u%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type
SF::\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x2
SF:0Bad\x20Request")%r(GetRequest,115,"HTTP/1\.0\x20307\x20Temporary\x20Re
SF:direct\r\nCache-Control:\x20no-store\r\nContent-Type:\x20text/html;\x20
SF:charset=utf-8\r\nLocation:\x20/ui/\r\nStrict-Transport-Security:\x20max
SF:-age=31536000;\x20includeSubDomains\r\nDate:\x20Fri,\x2014\x20Aug\x2020
SF:26\x2007:21:28\x20GMT\r\nContent-Length:\x2040\r\n\r\n<a\x20href=\"/ui/
SF:\">Temporary\x20Redirect</a>\.\n\n")%r(HTTPOptions,C4,"HTTP/1\.0\x20307
SF:\x20Temporary\x20Redirect\r\nCache-Control:\x20no-store\r\nLocation:\x2
SF:0/ui/\r\nStrict-Transport-Security:\x20max-age=31536000;\x20includeSubD
SF:omains\r\nDate:\x20Fri,\x2014\x20Aug\x202026\x2007:21:28\x20GMT\r\nCont
SF:ent-Length:\x200\r\n\r\n")%r(RTSPRequest,67,"HTTP/1\.1\x20400\x20Bad\x2
SF:0Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection
SF::\x20close\r\n\r\n400\x20Bad\x20Request")%r(Help,67,"HTTP/1\.1\x20400\x
SF:20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nCo
SF:nnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(SSLSessionReq,67,"H
SF:TTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20ch
SF:arset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Fo
SF:urOhFourRequest,115,"HTTP/1\.0\x20307\x20Temporary\x20Redirect\r\nCache
SF:-Control:\x20no-store\r\nContent-Type:\x20text/html;\x20charset=utf-8\r
SF:\nLocation:\x20/ui/\r\nStrict-Transport-Security:\x20max-age=31536000;\
SF:x20includeSubDomains\r\nDate:\x20Fri,\x2014\x20Aug\x202026\x2007:21:43\
SF:x20GMT\r\nContent-Length:\x2040\r\n\r\n<a\x20href=\"/ui/\">Temporary\x2
SF:0Redirect</a>\.\n\n")%r(LPDString,67,"HTTP/1\.1\x20400\x20Bad\x20Reques
SF:t\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20cl
SF:ose\r\n\r\n400\x20Bad\x20Request")%r(SIPOptions,67,"HTTP/1\.1\x20400\x2
SF:0Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nCon
SF:nection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Socks5,67,"HTTP/1\.1
SF:\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=ut
SF:f-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 46.30 seconds
bastion@sieun:~$

>> 22/tcp ssh OpenSSH 10.2p1 (Ubuntu)

23/tcp telnet
80/tcp http nginx 1.28.3 (Ubuntu)
631/tcp ipp CUPS 2.4
3306/tcp mysql
8080/tcp http Apache Tomcat
8081/tcp http Apache httpd 2.4.66 (Ubuntu) Apache 웹서버
8200/tcp http Golang net/http server

스캔 결과에서 불필요한 서비스 찾아내기
스캔 결과 목록을 보면서, 실제로 이 서버에 필요 없는 서비스가 열려있는지 하나씩 점검

bastion@sieun:~$ sudo nmap --script vuln localhost
Starting Nmap 7.98 ( https://nmap.org ) at 2026-08-14 16:27 +0900
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000070s latency).
Other addresses for localhost (not scanned): ::1
Not shown: 992 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
23/tcp   open  telnet
80/tcp   open  http
|_http-csrf: Couldn't find any CSRF vulnerabilities.
| http-vuln-cve2011-3192: 
|   VULNERABLE:
|   Apache byterange filter DoS
|     State: VULNERABLE
|     IDs:  BID:49303  CVE:CVE-2011-3192
|       The Apache web server is vulnerable to a denial of service attack when numerous
|       overlapping byte ranges are requested.
|     Disclosure date: 2011-08-19
|     References:
|       https://www.tenable.com/plugins/nessus/55976
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192
|       https://www.securityfocus.com/bid/49303
|_      https://seclists.org/fulldisclosure/2011/Aug/175
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-enum: 
|   /test.html: Test page
|_  /app/: Potentially interesting folder
631/tcp  open  ipp
| http-enum: 
|   /admin.php: Possible admin folder (401 Unauthorized)
|   /admin/: Possible admin folder (401 Unauthorized)
|   /admin/admin/: Possible admin folder (401 Unauthorized)
|   /administrator/: Possible admin folder (401 Unauthorized)
|   /adminarea/: Possible admin folder (401 Unauthorized)
|   /adminLogin/: Possible admin folder (401 Unauthorized)
|   /admin_area/: Possible admin folder (401 Unauthorized)
|   /administratorlogin/: Possible admin folder (401 Unauthorized)
|   /admin/account.php: Possible admin folder (401 Unauthorized)
|   /admin/index.php: Possible admin folder (401 Unauthorized)
|   /admin/login.php: Possible admin folder (401 Unauthorized)
|   /admin/admin.php: Possible admin folder (401 Unauthorized)
|   /admin_area/admin.php: Possible admin folder (401 Unauthorized)
|   /admin_area/login.php: Possible admin folder (401 Unauthorized)
|   /admin/index.html: Possible admin folder (401 Unauthorized)
|   /admin/login.html: Possible admin folder (401 Unauthorized)
|   /admin/admin.html: Possible admin folder (401 Unauthorized)
|   /admin_area/index.php: Possible admin folder (401 Unauthorized)
|   /admin/home.php: Possible admin folder (401 Unauthorized)
|   /admin_area/login.html: Possible admin folder (401 Unauthorized)
|   /admin_area/index.html: Possible admin folder (401 Unauthorized)
|   /admin/controlpanel.php: Possible admin folder (401 Unauthorized)
|   /admincp/: Possible admin folder (401 Unauthorized)
|   /admincp/index.asp: Possible admin folder (401 Unauthorized)
|   /admincp/index.html: Possible admin folder (401 Unauthorized)
|   /admincp/login.php: Possible admin folder (401 Unauthorized)
|   /admin/account.html: Possible admin folder (401 Unauthorized)
|   /adminpanel.html: Possible admin folder (401 Unauthorized)
|   /admin/admin_login.html: Possible admin folder (401 Unauthorized)
|   /admin_login.html: Possible admin folder (401 Unauthorized)
|   /admin/cp.php: Possible admin folder (401 Unauthorized)
|   /administrator/index.php: Possible admin folder (401 Unauthorized)
|   /administrator/login.php: Possible admin folder (401 Unauthorized)
|   /admin/admin_login.php: Possible admin folder (401 Unauthorized)
|   /admin_login.php: Possible admin folder (401 Unauthorized)
|   /administrator/account.php: Possible admin folder (401 Unauthorized)
|   /administrator.php: Possible admin folder (401 Unauthorized)
|   /admin_area/admin.html: Possible admin folder (401 Unauthorized)
|   /admin/admin-login.php: Possible admin folder (401 Unauthorized)
|   /admin-login.php: Possible admin folder (401 Unauthorized)
|   /admin/home.html: Possible admin folder (401 Unauthorized)
|   /admin/admin-login.html: Possible admin folder (401 Unauthorized)
|   /admin-login.html: Possible admin folder (401 Unauthorized)
|   /admincontrol.php: Possible admin folder (401 Unauthorized)
|   /admin/adminLogin.html: Possible admin folder (401 Unauthorized)
|   /adminLogin.html: Possible admin folder (401 Unauthorized)
|   /adminarea/index.html: Possible admin folder (401 Unauthorized)
|   /adminarea/admin.html: Possible admin folder (401 Unauthorized)
|   /admin/controlpanel.html: Possible admin folder (401 Unauthorized)
|   /admin.html: Possible admin folder (401 Unauthorized)
|   /admin/cp.html: Possible admin folder (401 Unauthorized)
|   /adminpanel.php: Possible admin folder (401 Unauthorized)
|   /administrator/index.html: Possible admin folder (401 Unauthorized)
|   /administrator/login.html: Possible admin folder (401 Unauthorized)
|   /administrator/account.html: Possible admin folder (401 Unauthorized)
|   /administrator.html: Possible admin folder (401 Unauthorized)
|   /adminarea/login.html: Possible admin folder (401 Unauthorized)
|   /admincontrol/login.html: Possible admin folder (401 Unauthorized)
|   /admincontrol.html: Possible admin folder (401 Unauthorized)
|   /adminLogin.php: Possible admin folder (401 Unauthorized)
|   /admin/adminLogin.php: Possible admin folder (401 Unauthorized)
|   /adminarea/index.php: Possible admin folder (401 Unauthorized)
|   /adminarea/admin.php: Possible admin folder (401 Unauthorized)
|   /adminarea/login.php: Possible admin folder (401 Unauthorized)
|   /admincontrol/login.php: Possible admin folder (401 Unauthorized)
|   /admin2.php: Possible admin folder (401 Unauthorized)
|   /admin2/login.php: Possible admin folder (401 Unauthorized)
|   /admin2/index.php: Possible admin folder (401 Unauthorized)
|   /administratorlogin.php: Possible admin folder (401 Unauthorized)
|   /admin/account.cfm: Possible admin folder (401 Unauthorized)
|   /admin/index.cfm: Possible admin folder (401 Unauthorized)
|   /admin/login.cfm: Possible admin folder (401 Unauthorized)
|   /admin/admin.cfm: Possible admin folder (401 Unauthorized)
|   /admin.cfm: Possible admin folder (401 Unauthorized)
|   /admin/admin_login.cfm: Possible admin folder (401 Unauthorized)
|   /admin_login.cfm: Possible admin folder (401 Unauthorized)
|   /adminpanel.cfm: Possible admin folder (401 Unauthorized)
|   /admin/controlpanel.cfm: Possible admin folder (401 Unauthorized)
|   /admincontrol.cfm: Possible admin folder (401 Unauthorized)
|   /admin/cp.cfm: Possible admin folder (401 Unauthorized)
|   /admincp/index.cfm: Possible admin folder (401 Unauthorized)
|   /admincp/login.cfm: Possible admin folder (401 Unauthorized)
|   /admin_area/admin.cfm: Possible admin folder (401 Unauthorized)
|   /admin_area/login.cfm: Possible admin folder (401 Unauthorized)
|   /administrator/login.cfm: Possible admin folder (401 Unauthorized)
|   /administratorlogin.cfm: Possible admin folder (401 Unauthorized)
|   /administrator.cfm: Possible admin folder (401 Unauthorized)
|   /administrator/account.cfm: Possible admin folder (401 Unauthorized)
|   /adminLogin.cfm: Possible admin folder (401 Unauthorized)
|   /admin2/index.cfm: Possible admin folder (401 Unauthorized)
|   /admin_area/index.cfm: Possible admin folder (401 Unauthorized)
|   /admin2/login.cfm: Possible admin folder (401 Unauthorized)
|   /admincontrol/login.cfm: Possible admin folder (401 Unauthorized)
|   /administrator/index.cfm: Possible admin folder (401 Unauthorized)
|   /adminarea/login.cfm: Possible admin folder (401 Unauthorized)
|   /adminarea/admin.cfm: Possible admin folder (401 Unauthorized)
|   /adminarea/index.cfm: Possible admin folder (401 Unauthorized)
|   /admin/adminLogin.cfm: Possible admin folder (401 Unauthorized)
|   /admin-login.cfm: Possible admin folder (401 Unauthorized)
|   /admin/admin-login.cfm: Possible admin folder (401 Unauthorized)
|   /admin/home.cfm: Possible admin folder (401 Unauthorized)
|   /admin/account.asp: Possible admin folder (401 Unauthorized)
|   /admin/index.asp: Possible admin folder (401 Unauthorized)
|   /admin/login.asp: Possible admin folder (401 Unauthorized)
|   /admin/admin.asp: Possible admin folder (401 Unauthorized)
|   /admin_area/admin.asp: Possible admin folder (401 Unauthorized)
|   /admin_area/login.asp: Possible admin folder (401 Unauthorized)
|   /admin_area/index.asp: Possible admin folder (401 Unauthorized)
|   /admin/home.asp: Possible admin folder (401 Unauthorized)
|   /admin/controlpanel.asp: Possible admin folder (401 Unauthorized)
|   /admin.asp: Possible admin folder (401 Unauthorized)
|   /admin/admin-login.asp: Possible admin folder (401 Unauthorized)
|   /admin-login.asp: Possible admin folder (401 Unauthorized)
|   /admin/cp.asp: Possible admin folder (401 Unauthorized)
|   /administrator/account.asp: Possible admin folder (401 Unauthorized)
|   /administrator.asp: Possible admin folder (401 Unauthorized)
|   /administrator/login.asp: Possible admin folder (401 Unauthorized)
|   /admincp/login.asp: Possible admin folder (401 Unauthorized)
|   /admincontrol.asp: Possible admin folder (401 Unauthorized)
|   /adminpanel.asp: Possible admin folder (401 Unauthorized)
|   /admin/admin_login.asp: Possible admin folder (401 Unauthorized)
|   /admin_login.asp: Possible admin folder (401 Unauthorized)
|   /adminLogin.asp: Possible admin folder (401 Unauthorized)
|   /admin/adminLogin.asp: Possible admin folder (401 Unauthorized)
|   /adminarea/index.asp: Possible admin folder (401 Unauthorized)
|   /adminarea/admin.asp: Possible admin folder (401 Unauthorized)
|   /adminarea/login.asp: Possible admin folder (401 Unauthorized)
|   /administrator/index.asp: Possible admin folder (401 Unauthorized)
|   /admincontrol/login.asp: Possible admin folder (401 Unauthorized)
|   /admin2.asp: Possible admin folder (401 Unauthorized)
|   /admin2/login.asp: Possible admin folder (401 Unauthorized)
|   /admin2/index.asp: Possible admin folder (401 Unauthorized)
|   /administratorlogin.asp: Possible admin folder (401 Unauthorized)
|   /admin/account.aspx: Possible admin folder (401 Unauthorized)
|   /admin/index.aspx: Possible admin folder (401 Unauthorized)
|   /admin/login.aspx: Possible admin folder (401 Unauthorized)
|   /admin/admin.aspx: Possible admin folder (401 Unauthorized)
|   /admin_area/admin.aspx: Possible admin folder (401 Unauthorized)
|   /admin_area/login.aspx: Possible admin folder (401 Unauthorized)
|   /admin_area/index.aspx: Possible admin folder (401 Unauthorized)
|   /admin/home.aspx: Possible admin folder (401 Unauthorized)
|   /admin/controlpanel.aspx: Possible admin folder (401 Unauthorized)
|   /admin.aspx: Possible admin folder (401 Unauthorized)
|   /admin/admin-login.aspx: Possible admin folder (401 Unauthorized)
|   /admin-login.aspx: Possible admin folder (401 Unauthorized)
|   /admin/cp.aspx: Possible admin folder (401 Unauthorized)
|   /administrator/account.aspx: Possible admin folder (401 Unauthorized)
|   /administrator.aspx: Possible admin folder (401 Unauthorized)
|   /administrator/login.aspx: Possible admin folder (401 Unauthorized)
|   /admincp/index.aspx: Possible admin folder (401 Unauthorized)
|   /admincp/login.aspx: Possible admin folder (401 Unauthorized)
|   /admincontrol.aspx: Possible admin folder (401 Unauthorized)
|   /adminpanel.aspx: Possible admin folder (401 Unauthorized)
|   /admin/admin_login.aspx: Possible admin folder (401 Unauthorized)
|   /admin_login.aspx: Possible admin folder (401 Unauthorized)
|   /adminLogin.aspx: Possible admin folder (401 Unauthorized)
|   /admin/adminLogin.aspx: Possible admin folder (401 Unauthorized)
|   /adminarea/index.aspx: Possible admin folder (401 Unauthorized)
|   /adminarea/admin.aspx: Possible admin folder (401 Unauthorized)
|   /adminarea/login.aspx: Possible admin folder (401 Unauthorized)
|   /administrator/index.aspx: Possible admin folder (401 Unauthorized)
|   /admincontrol/login.aspx: Possible admin folder (401 Unauthorized)
|   /admin2.aspx: Possible admin folder (401 Unauthorized)
|   /admin2/login.aspx: Possible admin folder (401 Unauthorized)
|   /admin2/index.aspx: Possible admin folder (401 Unauthorized)
|   /administratorlogin.aspx: Possible admin folder (401 Unauthorized)
|   /admin/index.jsp: Possible admin folder (401 Unauthorized)
|   /admin/login.jsp: Possible admin folder (401 Unauthorized)
|   /admin/admin.jsp: Possible admin folder (401 Unauthorized)
|   /admin_area/admin.jsp: Possible admin folder (401 Unauthorized)
|   /admin_area/login.jsp: Possible admin folder (401 Unauthorized)
|   /admin_area/index.jsp: Possible admin folder (401 Unauthorized)
|   /admin/home.jsp: Possible admin folder (401 Unauthorized)
|   /admin/controlpanel.jsp: Possible admin folder (401 Unauthorized)
|   /admin.jsp: Possible admin folder (401 Unauthorized)
|   /admin/admin-login.jsp: Possible admin folder (401 Unauthorized)
|   /admin-login.jsp: Possible admin folder (401 Unauthorized)
|   /admin/cp.jsp: Possible admin folder (401 Unauthorized)
|   /administrator/account.jsp: Possible admin folder (401 Unauthorized)
|   /administrator.jsp: Possible admin folder (401 Unauthorized)
|   /administrator/login.jsp: Possible admin folder (401 Unauthorized)
|   /admincp/index.jsp: Possible admin folder (401 Unauthorized)
|   /admincp/login.jsp: Possible admin folder (401 Unauthorized)
|   /admincontrol.jsp: Possible admin folder (401 Unauthorized)
|   /admin/account.jsp: Possible admin folder (401 Unauthorized)
|   /adminpanel.jsp: Possible admin folder (401 Unauthorized)
|   /admin/admin_login.jsp: Possible admin folder (401 Unauthorized)
|   /admin_login.jsp: Possible admin folder (401 Unauthorized)
|   /adminLogin.jsp: Possible admin folder (401 Unauthorized)
|   /admin/adminLogin.jsp: Possible admin folder (401 Unauthorized)
|   /adminarea/index.jsp: Possible admin folder (401 Unauthorized)
|   /adminarea/admin.jsp: Possible admin folder (401 Unauthorized)
|   /adminarea/login.jsp: Possible admin folder (401 Unauthorized)
|   /administrator/index.jsp: Possible admin folder (401 Unauthorized)
|   /admincontrol/login.jsp: Possible admin folder (401 Unauthorized)
|   /admin2.jsp: Possible admin folder (401 Unauthorized)
|   /admin2/login.jsp: Possible admin folder (401 Unauthorized)
|   /admin2/index.jsp: Possible admin folder (401 Unauthorized)
|   /administratorlogin.jsp: Possible admin folder (401 Unauthorized)
|   /admin1.php: Possible admin folder (401 Unauthorized)
|   /administr8.asp: Possible admin folder (401 Unauthorized)
|   /administr8.php: Possible admin folder (401 Unauthorized)
|   /administr8.jsp: Possible admin folder (401 Unauthorized)
|   /administr8.aspx: Possible admin folder (401 Unauthorized)
|   /administr8.cfm: Possible admin folder (401 Unauthorized)
|   /administr8/: Possible admin folder (401 Unauthorized)
|   /administer/: Possible admin folder (401 Unauthorized)
|   /administracao.php: Possible admin folder (401 Unauthorized)
|   /administracao.asp: Possible admin folder (401 Unauthorized)
|   /administracao.aspx: Possible admin folder (401 Unauthorized)
|   /administracao.cfm: Possible admin folder (401 Unauthorized)
|   /administracao.jsp: Possible admin folder (401 Unauthorized)
|   /administracion.php: Possible admin folder (401 Unauthorized)
|   /administracion.asp: Possible admin folder (401 Unauthorized)
|   /administracion.aspx: Possible admin folder (401 Unauthorized)
|   /administracion.jsp: Possible admin folder (401 Unauthorized)
|   /administracion.cfm: Possible admin folder (401 Unauthorized)
|   /administrators/: Possible admin folder (401 Unauthorized)
|   /adminpro/: Possible admin folder (401 Unauthorized)
|   /admins/: Possible admin folder (401 Unauthorized)
|   /admins.cfm: Possible admin folder (401 Unauthorized)
|   /admins.php: Possible admin folder (401 Unauthorized)
|   /admins.jsp: Possible admin folder (401 Unauthorized)
|   /admins.asp: Possible admin folder (401 Unauthorized)
|   /admins.aspx: Possible admin folder (401 Unauthorized)
|   /administracion-sistema/: Possible admin folder (401 Unauthorized)
|   /admin108/: Possible admin folder (401 Unauthorized)
|   /admin_cp.asp: Possible admin folder (401 Unauthorized)
|   /admin/backup/: Possible backup (401 Unauthorized)
|   /admin/download/backup.sql: Possible database backup (401 Unauthorized)
|   /robots.txt: Robots file
|   /admin/upload.php: Admin File Upload (401 Unauthorized)
|   /admin/CiscoAdmin.jhtml: Cisco Collaboration Server (401 Unauthorized)
|   /admin-console/: JBoss Console (401 Unauthorized)
|   /admin4.nsf: Lotus Domino (401 Unauthorized)
|   /admin5.nsf: Lotus Domino (401 Unauthorized)
|   /admin.nsf: Lotus Domino (401 Unauthorized)
|   /administrator/wp-login.php: Wordpress login page. (401 Unauthorized)
|   /admin/libraries/ajaxfilemanager/ajaxfilemanager.php: Log1 CMS (401 Unauthorized)
|   /admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html: OpenCart/FCKeditor File upload (401 Unauthorized)
|   /admin/includes/tiny_mce/plugins/tinybrowser/upload.php: CompactCMS or B-Hind CMS/FCKeditor File upload (401 Unauthorized)
|   /admin/includes/FCKeditor/editor/filemanager/upload/test.html: ASP Simple Blog / FCKeditor File Upload (401 Unauthorized)
|   /admin/jscript/upload.php: Lizard Cart/Remote File upload (401 Unauthorized)
|   /admin/jscript/upload.html: Lizard Cart/Remote File upload (401 Unauthorized)
|   /admin/jscript/upload.pl: Lizard Cart/Remote File upload (401 Unauthorized)
|   /admin/jscript/upload.asp: Lizard Cart/Remote File upload (401 Unauthorized)
|   /admin/environment.xml: Moodle files (401 Unauthorized)
|   /classes/: Potentially interesting folder
|   /es/: Potentially interesting folder
|   /help/: Potentially interesting folder
|_  /printers/: Potentially interesting folder
| http-method-tamper: 
|   VULNERABLE:
|   Authentication bypass by HTTP verb tampering
|     State: VULNERABLE (Exploitable)
|       This web server contains password protected resources vulnerable to authentication bypass
|       vulnerabilities via HTTP verb tampering. This is often found in web servers that only limit access to the
|        common HTTP methods and in misconfigured .htaccess files.
|              
|     Extra information:
|       
|   URIs suspected to be vulnerable to HTTP verb tampering:
|     /admin [GENERIC]
|   
|     References:
|       https://www.owasp.org/index.php/Testing_for_HTTP_Methods_and_XST_%28OWASP-CM-008%29
|       http://capec.mitre.org/data/definitions/274.html
|       http://www.mkit.com.ar/labs/htexploit/
|_      http://www.imperva.com/resources/glossary/http_verb_tampering.html
|_http-aspnet-debug: ERROR: Script execution failed (use -d to debug)
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_      http://ha.ckers.org/slowloris/
3306/tcp open  mysql
8080/tcp open  http-proxy
| http-enum: 
|_  /examples/: Sample scripts
8081/tcp open  blackice-icecap
8200/tcp open  trivnet1

Nmap done: 1 IP address (1 host up) scanned in 518.33 seconds
bastion@sieun:~$

>> 결과
80/tcp (nginx)
http-vuln-cve2011-3192 (Apache byterange filter DoS)
VULNERABLE로 확실히 잡힘, 겹치는 바이트 범위 요청으로 서비스 거부를 유발하는 오래된 취약점
CVE-2011-3192
http-enum으로 /test.html, /app/ 폴더 노출 확인
http-method-tamper (HTTP 검증 우회)
VULNERABLE(Exploitable), /admin 경로가 HTTP 메서드 조작으로 인증을 우회당할 수 있음, 실제 서비스라면 심각한 문제
http-slowloris-check
LIKELY VULNERABLE, CVE-2007-6750, 연결을 계속 열어둔 채로 리소스를 고갈시키는 DoS 공격에 취약할 가능성
http-csrf, http-dombased-xss, http-stored-xss
이 세 개는 취약점 못 찾음(Couldn't find)
631/tcp (CUPS)
http-enum으로 /admin 계열 경로들이 대량으로 401 Unauthorized 응답
이건 실제 취약점이라기보다 CUPS 관리 페이지가 인증으로 막혀 있다는 뜻
8080/tcp (Tomcat)
http-enum으로 /examples/ 폴더 노출

스캔 결과에서 불필요한 서비스 찾아내기

암호화 없이 평문으로 통신하는 telnet(23번 포트)이 SSH와 함께 방치되어 있는 경우 >> 23번 포트 중지
 
 

서비스가 어떤 방식으로 실행되고 있는지 확인
sudo ss -tlnp | grep :23
해당 포트를 실제로 리스닝하고 있는 프로세스명 확인
systemctl로 관리되는 독립 서비스인지, inetd 같은 슈퍼서버를 통해 실행되는지에 따라 종료 방법이 다름

 
1) systemd 서비스로 직접 떠 있는 경우
sudo systemctl stop 서비스명
sudo systemctl disable 서비스명
서비스를 중지하고, 재부팅해도 다시 켜지지 않도록 설정
 
2) inetd(슈퍼서버)를 통해 실행되는 경우
cat /etc/inetd.conf | grep 서비스명

설정 파일에서 해당 서비스 줄 위치 확인
sudo sed -i 's/^telnet/#telnet/' /etc/inetd.conf
inetd.conf 안의 telnet 줄 맨 앞에 #을 붙여서 주석 처리(비활성화)
 

 
sudo systemctl restart inetutils-inetd
설정 변경 내용을 반영하기 위해 inetd 서비스 재시작

종료 후 재스캔으로 확인

다시 스캔해서 해당 포트가 목록에서 사라졌는지 확인

결과: 23번 포트가 더 이상 열려있지 않은 것으로 확인