Programs that map out a network to figure out which computers and services are available to be exploited.

learn more… | top users | synonyms

1
vote
1answer
105 views

Are there any tools/methods to probe a web app from diffferent IPs?

I am currently reading "Metasploit: The Penetration Tester's Guide" and I came across the following paragraph in the book (in the 1st chapter) During intelligence gathering, you attempt to ...
1
vote
3answers
434 views

What exactly does one get from a Nmap Scan?

I know nmap is a port scanner and its output shows all the open ports, the services running on those ports, the underlying OS and technology, etc. What should one take from this result in easiest ...
3
votes
1answer
324 views

Can I perform WEP cracking from several laptops against 1 AP

I have successfully being able to perform WEP key cracking attack using aircrack tool. I want to allow my students to test this in a lab environment. They will be working fro their own laptops against ...
2
votes
1answer
2k views

How to detect infected devices on your local network [closed]

Today I read about a researcher who bought a digital TV recorder and connected it to the internet - probably using port forwarding to enable attackers to connect to the recorder. After a while someone ...
1
vote
3answers
117 views

Is it safe to share my hostname

I am using GNU/Linux. Sometimes, I copy/paste code from the terminal (like user@hostname ..) to put it in a forum thread or a blog ..etc And I was always wondering that it is better to hide it . Is ...
0
votes
3answers
215 views

Local network proxy/spoof

Are intruders in a local network able to mask their local IP in any way? Could they 'hijack' another local IP and perform scans and exploits from there?
0
votes
1answer
54 views

Ping response contain subnet ip [closed]

One of my friends site got hacked recently. Now while pinging the site ping zyz.com the response is like From 10.x.0.1 icmp_seq=79 Packet filtered From what I have heard, 10.x.0.1 looks like a ...
3
votes
3answers
425 views

Watching for applications like WireShark and other eaves dropping on corporate network

Are there ways to monitor and check for network monitoring like WireShark? Or would it just be more ideal to ensure every application uses SSL to ensure no employee or anyone could packet sniff ...
3
votes
1answer
672 views

Scan All private subnets with NMAP [closed]

I have a managed switch on my network but I don't remember the subnet. How can I scan all the private network without changing my ip address : 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 Thanks for ...
1
vote
2answers
589 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...
2
votes
5answers
4k views

Increase speed in nmap UDP scan?

How can I get nmap quicker in scanning UDP ports? This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
0
votes
2answers
480 views

How to identify a specific operating system with port scans?

According to the implementation of the TCP/IP stack an attacker is able to identify which operating system is running on a network device. Is there any paper or the like according on this topic?
0
votes
1answer
168 views

Is there a way of determining if tor is running on a remote machine?

In most of the companies, IT guys block some sites and by using TOR or other VPNs people walk around these blocks and gain access to blocked content. My question is, assuming TOR is running on ...
1
vote
2answers
160 views

Internet monitoring and DNS encryption

If someone hides their DNS traffic by encrypting it with a service such as OpenDNS's DNSCrypt, would you still be able to see which URLs they're viewing? Also, if that person uses HTTPS 100% of the ...
3
votes
2answers
2k views

Why do multiple IP Addresses in my local network point to the same computer?

I'm new to linux and nmap, and I am attempting to do a scan of my local network. Using nmap I find that there are 4 hosts on my network (10.0.2.2, 10.0.2.3, 10.0.2.4, 10.0.2.15). I am using VirtualBox ...
2
votes
1answer
55 views

Do generic custom scripts avoid detection more than common security applications?

Are scripts coded only using the default API of a high level, interpreted language for generic and meticulous gathering of network device & host software information that are already available ...
-3
votes
1answer
468 views

How to find list of open ports in any given ip without using common scanning tools

Suppose I want to port scan my network. Normally I'll use a tool like nmap or nessus. What if we don't have any tool to perform a Port Scan - how can we find open ports?
0
votes
1answer
908 views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
2
votes
1answer
100 views

Does nmap limit probes when using time limiting on decoy scans?

If I set a rate limit (e.g. -T1) on an nmap scan that uses decoys, does the rate limit apply to all probes, or just each individual source? I checked the documentation, but can't see anything ...
0
votes
1answer
295 views

Is it possible to scan a remote host in another network if I know a port that is opened?

First of all, this question is not the same as is it possible to test out remote host by using nmap?, because on that question, the questioner is asking for something impossible due to NAT's nature. ...
1
vote
3answers
2k views

Determining false positives when scanning for live hosts with Nmap

When doing a vulnerability assessment on a large network, it seems general practice to determine which hosts on the network are live. This can be done in various ways. From what I have read it is ...
1
vote
3answers
375 views

Port Scanning Host that has Rate Limiting Enabled

I am trying to enumerate on of my lab machines. It seems that it has rate limiting enabled since I am getting blocked after the first few probes. I need to scan the whole 65535 tcp ports. I tried ...
0
votes
1answer
155 views

Understanding a Zenmap output

I'm running Zenmap on my Windows 7 laptop. I ran an intense scan with UDP targeting my router 192.168.1.1.I realize that I'm probing into the back end of the router from the inside and that any open ...
1
vote
1answer
488 views

Disabling Ping/ICMP Requests [duplicate]

Are there any benefits from disabling Ping/ICMP requests on servers? I've read where people say to do it but I can't seem to find any real benefits with it. Only more likely to cause more problems. ...
0
votes
1answer
181 views

TCP IN connection from another user in my home network. Is it safe?

I'm using Comodo Firewall and I noticed that sometimes I'm getting TCP IN connection from another IP address in my home network (only one router and few wireless users): TCP IN | 192.168.1.50 | ...
0
votes
1answer
222 views

What settings should be entered into the blacklist file for zmap to map a local network instead of the entire internet?

My company has a very large distributed network which we scan monthly for vulnerability assessment. As part of that scanning, we try to find all accessible network hosts with a ping sweep. Since zmap ...
22
votes
2answers
9k views

How is wireless WiFi password cracked?

Let's say I have a wireless network that is password protected. What procedures can an intruder take in order to be able to gain access to my wireless network, or at least be able to decipher the ...
1
vote
1answer
708 views

Wireshark detecting suspicious messages through jabber protocol, It says it is from my website, no idea what it is

I was doing a network scan on my computer with Wireshark and came up with something very suspicious: I found a stream with the jabber protocol. I do not have a jabber server set up nor do I have any ...
20
votes
5answers
2k views

419 Nigerian scam problem

I fell in a scamming trap. It took me a while to figure it out. Blinded like an idiot. But it is what it is. I can only do as much as I can now. Tell me if there is anything else I should do. After ...
-1
votes
1answer
1k views

IP packet generate manually? [closed]

I have heard that we can create ip-packets by our own and send it to a network or a host. How this Can Be Done ?Please Explain step by step??
1
vote
1answer
158 views

Network enumeration protection [closed]

I was reading about DNS security, and readed about Zone Transfer and how can be used to retrieve host information of a network, so not allowing Zone Tranfer from external sources will be the solution ...
1
vote
1answer
95 views

Nessus Report Total 0?

This may seem like a slightly esoteric question but, I am wondering if it possible to achieve a result summary in Nessus where the Total is 0 for a windows server? Things that have no risk factors ...
3
votes
1answer
440 views

Is this a security threat?

So at my business our receipt printer randomly printed some questionable looking data. I looked into scanproxy.net and it's clearly not something legitimate. Can anyone give me a better idea of ...
10
votes
3answers
19k views

How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve ...
7
votes
1answer
507 views

different portscan tools give different results

I have different results as of my open TCP ports. When using nmap -sS 127.0.0.1, I get some 5 usual open ports, but when using osx built-in tool as stroke, I get those 5 ports plus 5 extra ports. How ...
0
votes
1answer
110 views

What is connect() method in NScan?

While reading about NScan tool, I came across the connect() method. This article about the NScan says NScan itself is a port scanner, which uses connect() method to find the list of the host's ...
4
votes
4answers
5k views

How to remote monitor a computer network traffic?

I would like to know if it is possible to remote monitor the incoming and outcoming network traffic of a specific IP from my network. I need to log the time, ip numbers and port that contact the ...
5
votes
5answers
2k views

Sharing Nmap scan results in a web page [closed]

Is there a tool that allow the sharing of nmap scan results ? I know nmap can produce XML and I can easily convert them in HTML. I would like to know if there is a tool with more features. For ...
1
vote
4answers
1k views

SYN scan victim sending back RST

I'm confused on the case of SYN scan and closed ports (the case of open ports makes sense). So, the attacker sends a ~40 byte SYN packet, a "closed port" would send a RST packet back to the attacker ...
1
vote
2answers
562 views

SYN scan, TCP packet question

during SYN scans, many small tcp packets are sent to multiple ports to determine which ports are open or not. But when you're streaming media, aren't you receiving many One type of ID system, the ...
3
votes
1answer
112 views

SYN scan, determining scan vs large file upload

In a system attempting to detect SYN scans, one technique is to analyze the rate of change of (network packets sent from victim host per second). Processes such as uploading a large file would not be ...
7
votes
6answers
2k views

How to bypass Nmap blockage?

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside? Also, does blocking nmap on a network provide any security? ...
1
vote
2answers
707 views

Spike in TCP port 5904 activity - what for?

There is an 'Internet Weather Report' on the Threat!Traq video blog by AT&T security researchers. In the March 14th broadcast, at around 31 minutes in, they mention an increase of scanning ...
6
votes
5answers
2k views

How can I portscan large subnets?

I need to scan several /16 and a /8 subnet to see what hosts are up and additionally, if any services are running on a select few ports. I've tried various tools such as angry IP scanner, Nmap, ...
-1
votes
3answers
2k views

Why doesn't Advanced IP Scanner show machine name? [closed]

I am using Advanced IP scanner to view all the machines at my home. However, it just shows me only one machine but not the other. However, I am able to ping to the other machine. The network discovery ...
1
vote
0answers
184 views

Which are appropiate tests to perform during an internal/LAN security audit? [closed]

In the internal network we know that controls are less strict than externally but in the other hand we know that lots of attacks come from the internal segment (unhappy workers, etc.) Which are ...
2
votes
2answers
384 views

Suspect Exchange Server appears to be hacked. How to determine if it was a false positive?

Our security vendor detected that our client's CAS server was doing a nessus scan in the internal network. It's not uncommon for this vendor to issue a false positive, but I'm looking for general ...
3
votes
5answers
249 views

How to introduce delay in scanning tools that do not implement delay without touching source code?

Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option. Is there a way to delay packets from ...
1
vote
1answer
289 views

Packet-filtering firewall evasion (Scanning)

Context I'm very familiar with different applications of scanning tools (. . . and you can use -mtu to specify the size of the fragments in nmap . . .) but every piece of information I read about ...
2
votes
0answers
180 views

Determine deployed 802.3x encryption/authentication protocols? Or, why can't I access Eth0?

Is there any means to identify deployed 802.3x authentication protocols on a wired interface (eth0) under Windows 7 (CLI), or from wlan0 on a *NIX based system? The scenario is as follows: I am a ...