It is common to run the same scan twice at different times, or to run two slightly different scans at
the same time
and see how they differ.
Let's see how it works! I’ll start a scan using the fast profile, Quick scan plus, on this host
The scan is running and I'm waiting for the scan to finish!
The scan is over and I'll save the
scan result to a file simply called a.xml!
On the desktop!
Now on the target I'm stopping the ssh server and then scanning the target again: systemctl stop
ssh
I'm scanning it again!
The scan is over and I'm gonna save the scan into a new file
On my desktop directory the new name of the file will be b.xml.
Perfect.
To compare the result we have to install a utility called ndiff: apt install ndiff
This is a utility to compare the results of Nmap scans.
You can run it manually or automatically by zenmap.
Let us see its man page!
First let's compare the results of the two scans manually ndiff the path to the fist file and
the second file.
And this is the difference between the two scans! We notice that that port22 is not open
anymore.
Lines that differ are preceded by - or + indicating that some piece of information was removed
or edited respectively. Let's compare the results in a zenmap!
Tools and compare results! I'm selecting the first scan a.xml and the second scan b.xml
and we see here the comparing result! Color coding also indicates differences: red for deletion and
green or white,
it depends on the color a theme you are using, for addition.
When you save the scan take care to select the correct scan from this drop box here.