Programs that map out a network to figure out which computers and services are available to be exploited.

learn more… | top users | synonyms

2
votes
2answers
28 views

Any way to circumvent a 'filtered' response on NMap?

I know that a filtered response on NMap means that the firewall dropped the packets or that NMap just didn't receive a response, but is there any way to circumvent this? Is it possible that the ...
3
votes
4answers
280 views

How to run nmap HTTP scripts on unusual ports

How can I make nmap run the HTTP-scripts on ports that are unusual for HTTP, say TCP port 123? On something like nmap -n --script="http* ..." -p123 target nmap does nothing except to check that port ...
0
votes
1answer
31 views

Caching ARP to avoid L2 detection on switched network?

Using nmap on a very large (/16) switched network can lead to an excessive number of ARP requests which can be detected by simple ARP counters listening to broadcasted ARP requests. Is there a way ...
1
vote
2answers
44 views

How do I check for inside-out open port? [closed]

I'm inside a corporate network and I want to assess which ports are open for outbound connection. There are such tools that do this test? I remember that years ago I used a website which performed ...
1
vote
1answer
43 views

Block An IP Address Scanner On Mac [closed]

I'm working on an prototype that can spot network scanners, which is working and it spits out the IP address of the scanners, but I need to block them now. Is there any way to block an IP address ...
1
vote
1answer
111 views

Tracing stolen android tablet via MAC address [closed]

I lost my tablet , but I can see that the tablet is connected to the network on my router: :So I know the MAC address but I am unable to trace my tablet using this information and I am running out of ...
7
votes
1answer
104 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
0
votes
1answer
191 views

Router detecting constant ack flood attacks and port scans

I first noticed this yesterday in my logs - while I was configuring the router settings, so I don't know how long it's been going on. What should I do? I reconfigured my router with more secure ...
5
votes
2answers
762 views

Why would a stealth scan attract more attention than a connect scan?

I'm reading an Information Security book and am faced with the question: Why may nmap stealth scans(SYN) attract more attention than simple connect scans(TCP connect())? Why might it be?
1
vote
0answers
92 views

Indicator of Compromise Scanners IOC [closed]

I am looking for a scanner that can look for indicator of compromise. Have research some products in the market that could do this, for e.g. Fireeye HX series. However these products seems to be very ...
8
votes
1answer
1k views

How can I find my home network's vulnerabilities when opening it for VPN connections

I want to open my home network so I can connect to it via VPN to do thingsā„¢ while not at home. This concerns me because I am potentially opening doors that I don't know about. What tools can I use ...
1
vote
1answer
103 views

What is the fastest way to scan all ports of a single machine

I am doing some research and I need a very quick way to scan for open ports on a single machine. To provide some context, I know that my machine will have a port open waiting for UDP packets for about ...
3
votes
4answers
546 views

Is there a nmap command to get the top # most common ports?

I understand nmap by default scans the top 1k 'most common' ports (-F reduces to 100) I understand it gets these 'most common' ports based on the nmap-services file, specifically the frequency (3rd ...
0
votes
2answers
108 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
1
vote
1answer
138 views

Is ettercap detectable?

Is Ettercap detectable? It technically shouldn't be because it just reads the data it sees legally through network. Every other computer receives the exact same data, it just doesn't show the data to ...
-3
votes
1answer
104 views

Is there scan-me-for-vulnerabilities services? [closed]

Where can I get more similar to nmap.online-domain-tools.com scan services. Edit: Probably, nobody know what does nmap.online-domain-tools.com is. I'm trying to explain: Network service. For ...
5
votes
2answers
473 views

The effect of hidden or spoofed service banners on vulnerability scanners

The linked question relates to error pages, although the same information is often available in HTTP headers, if I follow best practise of hiding service banners: Is displaying what server I am ...
1
vote
0answers
601 views

What is my router listening for on ports 5555 and 3333? [closed]

I recently discovered nmap and pointed it at my router out of curiosity. It found that ports 3333 and 5555 are open but doesn't recognise either service. I investigated and found: I can successfully ...
1
vote
2answers
149 views

Nmap scan list of domains and provide boolean if up/down

I have a newline separated list of domains that I would like to perform an arbitrary nmap scan on (e.g. aggressive, syn) and I would like to output a boolean that indicates whether or not any ports ...
5
votes
1answer
338 views

Where can I use the TCP FIN scan?

For a coursework i've got to run the various port scans, i'm having trouble with the FIN scan though, I can't seem to find a system where I can try it, everywhere I try it all ports either come back ...
0
votes
2answers
157 views

viability scanner inside AWS

So I have 2 soon to be 3 VPC's within AWS, I want to run a automated nmap scan on all three VPC's every few weeks to make sure nothing has been opened, added etc what would be the best way to achieve ...
1
vote
2answers
322 views

How to decode this exploit scanner?

My server is obviously up to date and not vulnerable to shellshock exploits. However, I am still curious and would like to understand how to decode the following malicious vulnerability scan. I have ...
5
votes
1answer
2k views

How does this shellshock scan work?

My server is obviously up to date and not vulnerable to shellshock exploits. However I am still curious to know how the following shellshock scan work: /var/log/apache2 # cat access.log | grep bash ...
0
votes
2answers
249 views

Does Nmap requires a closed TCP port to do OS fingerprinting?

I was checking the security of a server by running Nmap. Last time it gives me the following results, indicating that OS could not be fingerprinted: PORT STATE SERVICE VERSION 21/tcp ...
0
votes
1answer
1k views

Strange flood of requests to my web server

About an hour ago, strange requests began showing up in my access logs. They are coming in at a rate of ca. 400 req/s and appear to come from IPs all over the place. It started out at a lover rate and ...
1
vote
0answers
161 views

How to keep an internal node from spoofing an internal server's IP and thereby getting the server blocked by active defenses?

In an internal network, all machines are firewalled from each other. The firewall has port scan detection and blocking mechanism (say, psd module of iptables). Question: What are the ways I can block ...
2
votes
2answers
434 views

Nmap scanning computers behind a wireless modem [closed]

Let's suppose that I have a router and three computers connected to Internet through that router. When I tried to get the external IP address for each computer, I got the same address. I think this ...
1
vote
1answer
74 views

Can we build network topology using passive fingerprinting?

Can we use the tools such as P0f, OSSIM and other passive fingerprinting tools to build a comprehensive network topology of how the devices are interconnected ? or is there a passive finger printing ...
5
votes
2answers
824 views

Is it possible to ping a LAN card through its MAC address? [duplicate]

As you can start a PC through its 'WAKE ON LAN' feature on private networks, can you trace someone's online status through their MAC address over the internet ?
2
votes
2answers
2k views

How to block network scans with pfsense?

I am using pfsense as firewall, and I would like to know how I can stop network scans from enumerating open services and ports. Thanks
3
votes
2answers
103 views

Public facing computers in a Media Lab

I've just taken over administering a lab of Apple computers on a university campus. We have about 15 computers and I've discovered that they all have public IPs and domain names. Even our printer is ...
1
vote
2answers
156 views

Is it possible to defeat the OS detection capabilities of network scanning tools?

Network scanning tools such as nmap have the capability to infer operating system version based upon lower-level system details. EG: TCP/IP stack behavior, etc. Are there any known methods to trick ...
0
votes
1answer
131 views

NMAP not reporting open ports with -sS scan

Is there any reason why an -sS scan (or most others) would not report an open port that doesn't have a service attached to it? For example, in a regular -sS scan, the following port will be missing, ...
2
votes
3answers
1k views

How does Network Discovery OFF protect my computer?

Yes, it seems that the computer will not respond to pinging. But any computer with a packet sniffer will be able to see my ip once I send any packet to the router. So basically, if I'm surfing the ...
1
vote
2answers
160 views

Can't successfully do an idle scan

I have kali linux installed in VirtualBox and would like to do an idle scan. For this I need to find a suitable zombie pc. I'm using the ipidseq script to find one. The script finds some ip addresses ...
0
votes
0answers
60 views

How can I get a list of unsigned plugins in openvas?

How can I get a list of unsigned plugins in openvas? Are those plugins safe for use? When I run the scan on a test machine with nasl_no_signature_check = no, I don't get any results(not even any ...
0
votes
3answers
260 views

Practicing pentesting locally

After watching videos and downloading just about every possible pen-testing tool out there to play around with and learn. How do you setup test beds and practice scenarios to crack? With RE people ...
1
vote
1answer
88 views

Are there any tools/methods to probe a web app from diffferent IPs?

I am currently reading "Metasploit: The Penetration Tester's Guide" and I came across the following paragraph in the book (in the 1st chapter) During intelligence gathering, you attempt to ...
1
vote
3answers
350 views

What exactly does one get from a Nmap Scan?

I know nmap is a port scanner and its output shows all the open ports, the services running on those ports, the underlying OS and technology, etc. What should one take from this result in easiest ...
3
votes
1answer
303 views

Can I perform WEP cracking from several laptops against 1 AP

I have successfully being able to perform WEP key cracking attack using aircrack tool. I want to allow my students to test this in a lab environment. They will be working fro their own laptops against ...
2
votes
1answer
1k views

How to detect infected devices on your local network [closed]

Today I read about a researcher who bought a digital TV recorder and connected it to the internet - probably using port forwarding to enable attackers to connect to the recorder. After a while someone ...
1
vote
3answers
111 views

Is it safe to share my hostname

I am using GNU/Linux. Sometimes, I copy/paste code from the terminal (like user@hostname ..) to put it in a forum thread or a blog ..etc And I was always wondering that it is better to hide it . Is ...
0
votes
3answers
187 views

Local network proxy/spoof

Are intruders in a local network able to mask their local IP in any way? Could they 'hijack' another local IP and perform scans and exploits from there?
0
votes
1answer
48 views

Ping response contain subnet ip [closed]

One of my friends site got hacked recently. Now while pinging the site ping zyz.com the response is like From 10.x.0.1 icmp_seq=79 Packet filtered From what I have heard, 10.x.0.1 looks like a ...
3
votes
3answers
410 views

Watching for applications like WireShark and other eaves dropping on corporate network

Are there ways to monitor and check for network monitoring like WireShark? Or would it just be more ideal to ensure every application uses SSL to ensure no employee or anyone could packet sniff ...
3
votes
1answer
535 views

Scan All private subnets with NMAP [closed]

I have a managed switch on my network but I don't remember the subnet. How can I scan all the private network without changing my ip address : 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 Thanks for ...
1
vote
2answers
537 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...
1
vote
5answers
2k views

Increase speed in nmap UDP scan?

How can I get nmap quicker in scanning UDP ports? This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
0
votes
2answers
363 views

How to identify a specific operating system with port scans?

According to the implementation of the TCP/IP stack an attacker is able to identify which operating system is running on a network device. Is there any paper or the like according on this topic?
0
votes
1answer
161 views

Is there a way of determining if tor is running on a remote machine?

In most of the companies, IT guys block some sites and by using TOR or other VPNs people walk around these blocks and gain access to blocked content. My question is, assuming TOR is running on ...