Nmap Service Detection for Nexpose and InsightVM Scan Engines

Click the icon to Follow me:- twitterTelegramRedditDiscord
Nmap Service Detection for Nexpose and InsightVM Scan Engines

As of version 6.6.14 of Nexpose and InsightVM, the Scan Engine can now utilize Nmap service probes in addition to existing detection methods to improve the discovery of previously unsupported protocols and services.

You can enable this Nmap capability on the Service Discovery tab of your scan template configuration within the product.

Note: This setting is not yet enabled by default.

How can it be enabled?

You can enable this Nmap capability on the Service Discovery tab of your scan template configuration within the Nexpose product.

Nmap Service Detection for Nexpose and InsightVM Scan Engines

What can be expected with this change?

With this feature, the Scan Engine will now make use of additional probes within Nmap to detect unsupported protocols and services. This will enable the Scan Engine to use the matches provided from nmap, giving the scan engine 804 new matches when enabled.

These matches coming from Nmap will provide the Scan Engine with new services detected and assist in detecting currently supported services.

In addition to discovering new services and protocols, it will also aid the Scan Engine in detecting services and protocols. This means where the Scan Engine failed to detect, it can now use the results that Nmap has found to uplift any <unknown> found.

Before Enabling Nmap service detection:

Nmap Service Detection for Nexpose and InsightVM Scan Engines

After Enabling Nmap in service detection:

Nmap Service Detection for Nexpose and InsightVM Scan Engines

As you can see in the image above, the Scan Engine used the results from Nmap to detect the HTTP protocol and Apache HTTPD running, which allowed vulnerability checks to trigger. To learn more about Nmap service detection, please refer to these Nmap documents. If there are any issues with the feature, please reach out to support for assistance.

What can I do to tweak the performance of my Scan Engine?

There are a few tweaks that can be made that affect the performance of this feature.  First is increasing the “Maximum scan processes simultaneously used on each asset.” This can be found on the General tab of your scan template configuration.

Nmap Service Detection for Nexpose and InsightVM Scan Engines

Second is adjusting the number of “Simultaneous connection requests.” This can be found on the Discovery Performance tab of your scan template configuration.

Nmap Service Detection for Nexpose and InsightVM Scan Engines

Note: Leaving both the Minimum and Maximum to 0 will allow Nmap to self tune (Nmap – Timing and Performance).

Original Source