Programs that map out a network to figure out which computers and services are available to be exploited.

learn more… | top users | synonyms

13
votes
4answers
2k views

How do you deal with massive port scans?

This morning I was looking through firewall logs and saw there were about 500 packets marked as port scan. The scanning range was from 1000-1200 5000-5200. The IP address is 85.25.217.47 which seems ...
0
votes
0answers
28 views

Detecting specific running application of types chatting,multimedia,gaming,etc [closed]

I'm implementing a network monitoring system using JADE (Java Agent Development Framework) to classify malicious and un-malicious activities within network. At this stage, we are only considering a ...
4
votes
3answers
68 views

Nmap showing ISPs router's DNS port in addition to target's ports

Whenever I do nmap scans my ISP router DNS port like the following. This happens for every IP or target. $ nmap -T4 -A -v stackoverflow.com PORT STATE SERVICE VERSION 53/tcp open domain ...
0
votes
1answer
34 views

Network traffic analyzer for Video [closed]

I am going to be streaming video on an open network. I need the simplest network traffic analyzer that would enable me to know when the video is stopped and started from another system on the same ...
1
vote
1answer
83 views

Nessus web client: Error 401 invalid credentials [closed]

Previously I used to scan sites using Nessus web client, but when I tried to login with the same credentials I am able to see a401 (Invalid Credentials) error. I have restarted the service nessusd, ...
2
votes
1answer
52 views

Finding Targets in Foreign Network

Say you popped into a network after exploiting something, and you are looking to further infiltrate the network. When theorizing in my head I realized the local ip's can change themselves. So doing ...
0
votes
1answer
34 views

Resuming an interrupted nmap scan:

I need to: --resume <filename>: Resume an aborted interrupted scan. But I didn’t: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, ...
-4
votes
1answer
30 views

network port registry

I am planning to build an app which gives information about the network port and the service name for non-opensource based products. Is there a legal implication of building such apps? because someone ...
4
votes
2answers
72 views

Stop Nmap scan and preserve XML output

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
1
vote
2answers
80 views

Is a Windows (fresh installation) 7 really this safe against NMAP or am I missing something?

I am playing with NMAP in my small private network performing port scanning. So far I went through scanning the following OSs (Unaltered new installations - Meaning no extra software installed!): ...
-1
votes
1answer
156 views

Netdiscover running on NAT interface not finding IP addresses on host-only network?

I am practicing penetration testing techniques using Kali Linux (most recent distro) and various vulnerable virtual machines (DVWA, Metasplotiable). My attack and targets are all running via ...
2
votes
1answer
73 views

Hiding packets, requests, traffic from my PC through Ethernet connected to workplace network

Before everyone jumps on the bandwagon, as I so often see, of saying you shouldn't do anything on a workplace network that is to be done annonymously on your own home network, I want to know an actual ...
1
vote
1answer
52 views

What local ethernet-accessible resources can be accessed on a PC through a USB cable?

Clarification: this is about scanning the network resources on computer B from computer A in a situation where: Computer A is connected to Computer B through a USB cable Computer A has some scanning ...
2
votes
0answers
71 views

nmap OS scan showing DD-WRT when I'm not running it?

This weekend, I set up pfSense on a spare box that I had sitting in the garage. It seems cool and powerful, but I haven't messed with it much yet. Was doing some basic nmap scanning from work against ...
1
vote
0answers
44 views

Does hping support FTP Bounce scanning?

Does hping support FTP Bounce scanning? I googled it, but I couldn't find its command, so I think it didn't support it. I just find command for nmap not hping.
6
votes
2answers
602 views

Discovering IP or Mac address of mobile devices passing by.

Is it possible for someone to discover the IP and/or MAC address of my mobile device, even if I do not attempt to connect to their network?
3
votes
2answers
80 views

Legally port scanning (Whitelist)

I am attempting to set up a security vulnerability scanning server. I have several customers interested in using it to scan their systems. I will be port scanning and carrying out intrusion detection, ...
2
votes
2answers
36 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...
7
votes
1answer
260 views

Port Scanning - States definition

I am currently reading the "NMAP Network Scanning" book by Gordon Fyodor Lyon. On page 77 there is a description on how NMAP categorizes the ports based on host's responses (or not). What would help ...
0
votes
1answer
32 views

hping3 - Ignoring not responding ports

Is there a way to ignore the not responding ports in the scan report? james@ahoi:~$ sudo hping3 -q --scan 1-1000 -S 192.168.0.1 Scanning 192.168.0.1 (192.168.0.1), port 1-1000 1000 ports to scan, use ...
10
votes
4answers
1k views

Filtered ports - What exactly filters them?

By the NMAP definition, unfiltered ports are the ones which cannot be determined to be open or closed since packet filtering prevents its probes from reaching the port. (ISBN 9780979958717 pag. 77) ...
1
vote
1answer
130 views

NMAP DNS Resolution

By default NMAP does reverse DNS resolution for a given IP which responds to the host discovery probes. My question is, what are the benefits of getting the host name when performing a network scan?
3
votes
2answers
422 views

Scanning multiple subnets with nmap to determine open services & ports

First off, I know nmap's documentation is very powerful and I have been reading through it rather extensively. I will be scanning externally, with permission, to determine ports & services that ...
4
votes
3answers
1k views

Enumerate the subdomains of a given domain - what's the point?

There're a number of security tools out there that enumerate the subdomains of a given domain. I wonder: What's the purpose of that in terms of security / hacking? Is there any way to do that other ...
0
votes
2answers
85 views

Client misunderstanding nmap [closed]

My client wants their public facing IP addresses to be secure, but thinks that running nmap port scans will draw attention from hackers. To settle this once and for all, what do you say?
1
vote
1answer
86 views

What this type of attack called? (gaining peripheral information)

When the intruder looks at the transmitted data and finds information about the sender and the receiver of the data or other peripheral information that won't help him hack the system but know more ...
0
votes
1answer
154 views

Snort - Rule: Alert all php requests

I am trying to understand writing rules for snort. Further goal is detection of sql injections like here. I've read the documentation of snort rules and created this rule: alert tcp any any -> ...
3
votes
1answer
207 views

Automating NIKTO scanner

I am working on NIKTO automation. I have a text file contains list of IP addresses along with their ports open. I have already made nikto script. Script functionality - it takes IP addresses and then ...
2
votes
2answers
573 views

nmap detects opened port but can't connect with telnet

I've made an scan to one single IP with nmap and it reports that the port 65301 is opened, and even it detects that it's maybe the service pcanywhere. sudo nmap -p 65000-65535 -sV x.x.x.x Starting ...
2
votes
2answers
52 views

Any way to circumvent a 'filtered' response on NMap?

I know that a filtered response on NMap means that the firewall dropped the packets or that NMap just didn't receive a response, but is there any way to circumvent this? Is it possible that the ...
4
votes
4answers
985 views

How to run nmap HTTP scripts on unusual ports

How can I make nmap run the HTTP-scripts on ports that are unusual for HTTP, say TCP port 123? On something like nmap -n --script="http* ..." -p123 target nmap does nothing except to check that port ...
1
vote
1answer
112 views

Caching ARP to avoid L2 detection on switched network?

Using nmap on a very large (/16) switched network can lead to an excessive number of ARP requests which can be detected by simple ARP counters listening to broadcasted ARP requests. Is there a way ...
1
vote
2answers
208 views

How do I check for inside-out open port? [closed]

I'm inside a corporate network and I want to assess which ports are open for outbound connection. There are such tools that do this test? I remember that years ago I used a website which performed ...
1
vote
1answer
78 views

Block An IP Address Scanner On Mac [closed]

I'm working on an prototype that can spot network scanners, which is working and it spits out the IP address of the scanners, but I need to block them now. Is there any way to block an IP address ...
1
vote
1answer
1k views

Tracing stolen android tablet via MAC address [closed]

I lost my tablet , but I can see that the tablet is connected to the network on my router: :So I know the MAC address but I am unable to trace my tablet using this information and I am running out of ...
7
votes
1answer
333 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
1
vote
1answer
3k views

Router detecting constant ack flood attacks and port scans

I first noticed this yesterday in my logs - while I was configuring the router settings, so I don't know how long it's been going on. What should I do? I reconfigured my router with more secure ...
5
votes
2answers
910 views

Why would a stealth scan attract more attention than a connect scan?

I'm reading an Information Security book and am faced with the question: Why may nmap stealth scans(SYN) attract more attention than simple connect scans(TCP connect())? Why might it be?
1
vote
0answers
333 views

Indicator of Compromise Scanners IOC [closed]

I am looking for a scanner that can look for indicator of compromise. Have research some products in the market that could do this, for e.g. Fireeye HX series. However these products seems to be very ...
9
votes
1answer
1k views

How can I find my home network's vulnerabilities when opening it for VPN connections

I want to open my home network so I can connect to it via VPN to do things™ while not at home. This concerns me because I am potentially opening doors that I don't know about. What tools can I use ...
2
votes
1answer
327 views

What is the fastest way to scan all ports of a single machine

I am doing some research and I need a very quick way to scan for open ports on a single machine. To provide some context, I know that my machine will have a port open waiting for UDP packets for about ...
3
votes
4answers
2k views

Is there a nmap command to get the top # most common ports?

I understand nmap by default scans the top 1k 'most common' ports (-F reduces to 100) I understand it gets these 'most common' ports based on the nmap-services file, specifically the frequency (3rd ...
0
votes
2answers
159 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
1
vote
1answer
246 views

Is ettercap detectable?

Is Ettercap detectable? It technically shouldn't be because it just reads the data it sees legally through network. Every other computer receives the exact same data, it just doesn't show the data to ...
-3
votes
1answer
186 views

Is there scan-me-for-vulnerabilities services? [closed]

Where can I get more similar to nmap.online-domain-tools.com scan services. Edit: Probably, nobody know what does nmap.online-domain-tools.com is. I'm trying to explain: Network service. For ...
5
votes
2answers
559 views

The effect of hidden or spoofed service banners on vulnerability scanners

The linked question relates to error pages, although the same information is often available in HTTP headers, if I follow best practise of hiding service banners: Is displaying what server I am ...
1
vote
0answers
1k views

What is my router listening for on ports 5555 and 3333? [closed]

I recently discovered nmap and pointed it at my router out of curiosity. It found that ports 3333 and 5555 are open but doesn't recognise either service. I investigated and found: I can successfully ...
1
vote
2answers
252 views

Nmap scan list of domains and provide boolean if up/down

I have a newline separated list of domains that I would like to perform an arbitrary nmap scan on (e.g. aggressive, syn) and I would like to output a boolean that indicates whether or not any ports ...
5
votes
1answer
515 views

Where can I use the TCP FIN scan?

For a coursework i've got to run the various port scans, i'm having trouble with the FIN scan though, I can't seem to find a system where I can try it, everywhere I try it all ports either come back ...
0
votes
2answers
474 views

Vulnerability scanner inside AWS

I have three VPC's within AWS and I want to run an automated Nmap scan on all three VPC's every few weeks to make sure nothing has been opened, added, etc. What would be the best way to achieve this? ...