ハニーポット構築(nmapによるハニーポットの検出確認①)

本日2つ目の投稿。先日構築したT-Potが攻撃者からどう見えるのかを確認するためにnmapで確認してみる。

root@kali:~# nmap -sS -sV <公開IPアドレス>

Host is up (0.14s latency).
Not shown: 134 filtered ports
PORT      STATE  SERVICE               VERSION
21/tcp    open   ftp                   vsftpd 2.0.8 or later
22/tcp    open   ssh                   OpenSSH 7.9p1 (protocol 2.0)
23/tcp    open   telnet?
25/tcp    open   smtp?
42/tcp    open   nameserver?
53/tcp    closed domain
80/tcp    open   http                  nginx 1.3.8
81/tcp    open   http                  nginx
110/tcp   open   pop3?
111/tcp   closed rpcbind
113/tcp   closed ident
119/tcp   open   nntp?
135/tcp   open   msrpc?
143/tcp   open   imap?
199/tcp   closed smux
256/tcp   closed fw1-secureremote
443/tcp   open   ssl/https?
465/tcp   open   tcpwrapped
554/tcp   closed rtsp
563/tcp   open   tcpwrapped
587/tcp   open   submission?
993/tcp   open   ssl/imaps?
995/tcp   open   ssl/pop3s?

<中略>

1433/tcp  open   ms-sql-s              Dionaea honeypot MS-SQL server

<中略>
9 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============

<中略>

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .