Programs that map out a network to figure out which computers and services are available to be exploited.

learn more… | top users | synonyms

37
votes
5answers
4k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
2
votes
3answers
1k views

How to decode this exploit scanner?

My server is obviously up to date and not vulnerable to shellshock exploits. However, I am still curious and would like to understand how to decode the following malicious vulnerability scan. I have ...
2
votes
1answer
62 views

Nmap scan comparison show change in ports

I am going to try explaining my question in the simplest way possible. I have a script which uses nmap to scan for open ports and save the result in a file. The next time it scans a host it moves the ...
1
vote
2answers
75 views

What phases does a network penetration test consist of?

What are common phases of a network infrastructure penetration test? Staring with discovering IP's and ports? A simple vulnerability assessment, checking version information of banners from different ...
4
votes
5answers
2k views

How to run nmap HTTP scripts on unusual ports

How can I make nmap run the HTTP-scripts on ports that are unusual for HTTP, say TCP port 123? On something like nmap -n --script="http* ..." -p123 target nmap does nothing except to check that port ...
0
votes
2answers
30 views

Wondering about open port found while using VPN service

I have noticed during port scanning that my "anonymous" IP has an open port (111) while I am using VPN. Does this make me vulnerable as user or is it the provider's failure? Should I change ...
-1
votes
0answers
34 views

Unable to use port and IP scanner in Windows 7 [migrated]

How do fix this: One day all of my port scanners and IP scanners were working, but then the next day they don't discover any other hosts except my computer and router. The other host that I am trying ...
0
votes
0answers
44 views

How does an attacker compromise a soft switch?

Speaking of soft switches (e.g soft switch in data plane of software defined networking). I've been trying to find a good research paper or article that explains how an attacker can compromise a soft ...
0
votes
0answers
38 views

Frequency of Stealth scan?

Background I am working on snort Portscan Module to detect Stealth scans.Snort uses good amount of datastructures to capture scanning events and to explicitly set the threshold values. typedef ...
3
votes
2answers
52 views

Is there a form to know the PostgreSQL version using nmap?

I tried using the following command: nmap -p 5432 -v --script pgsql-brute myhost But I got no output related to the pgsql script nor the dbms version.
4
votes
2answers
1k views

What is the purpose of subdomain enumeration?

There're a number of security tools out there that enumerate the subdomains of a given domain. I wonder: What's the purpose of that in terms of security / hacking? Is there any way to do that other ...
1
vote
1answer
38 views

Scan detection Tool better than Snort Portscan Preprocessor

I am working on detection of Scanning activities of Bots/Worms. I have found that Snort Portscan Preprocessor detects Scan activities. I have tweaked Snort Portscan Preprocessor to detect different ...
0
votes
1answer
111 views

How can all ports be closed? [closed]

I was faced that, there was an hacker attacking my gmail account. With the help of google service, I got the information about that hacker. Again next day he was attacking my pc. When I scanned ...
-4
votes
2answers
119 views

How do Hackers and Security Researchers Scan The Internet For Vulnerable Servers and Devices? [closed]

I would like to know how Security Researchers and hackers scan the internet to find vulnerable devices. For example in this article here, what sort of request/packets are those researchers sending to ...
0
votes
1answer
84 views

How to access or scan a specific computer in a different network [closed]

I want to scan the ports of my neighbor's computer. I know the global IP address. However I can scan only the router, not the computer in the network. Is it possible to scan a computer in a different ...
1
vote
2answers
47 views

Packet Filter vs Application proxy

http://postimg.org/image/b1w3bujnv/ I don't understand the highlighted part in red. Firstly,Why is a packet filter is enough in a situation where traffic is busy? Secondly,Isn't application proxy ...
1
vote
1answer
58 views

What is a device that scans the network it is connected to called?

Are there any devices (computer, switch, router, etc.) witch integrate licensed software like Nessus or Nexpose in a way that you can just drop them in a network and scan that network remote? If so, ...
1
vote
4answers
14k views

Unknown MAC address connected to router

I found an unknown MAC address connected to my home router. How would I figure out what OS the IP or MAC address is running?
3
votes
1answer
178 views

Scanning private IPs from outside network

Is it possible with Nmap (or other tool) to scan a range of private IPs (let's say 10.0.0.0/8) but being outside any private network (using those IPs) ?
1
vote
1answer
85 views

How do I scan for and discover active IPv6 addresses of devices behind a router?

Usually with IPv4 and NAT you can only access a device behind a router if the router is port-forwarded correctly or is the router's DMZ. When behind the router you can easily scan for the IPs behind ...
-5
votes
1answer
109 views

Benefit of checking TCP port or UDP port [closed]

I'm studying port scanning. How can an attacker benefit from the information of checking TCP ports or UDP ports?
2
votes
1answer
119 views

NMAP Scan Returns Odd OS Detection [closed]

I am new to NMAP but I was using it to troubleshoot some issues I have been having. I ran a scan on a device and I know the device runs some sort of Linux or Ubuntu OS and I was attempting to figure ...
1
vote
1answer
73 views

Denial of Service during scanning [closed]

As I know you can do Denial of Service when footprinting with scanners, like nmap or Maltego. But is it legal? As I know, scanning isn't illegal but doing DoS attacks is. EDIT I meant if you scan ...
3
votes
1answer
181 views

A PC constantly scans my network for IP addresses using ARP

Using wireshark I have found that one PC on my network constantly scans for devices on the network using ARP, e.g. Who has 192.168.0.26? Tell 192.168.0.10 It does that approx. 2 times a second and ...
1
vote
0answers
43 views

Scapy problem in sending packet

I am trying to use Scapy for testing the network. Whenever I send a packet with commands like send, sr ,sr1 I get this message: python.exe has stopped working I am using Scapy 2.2.0 on Windows ...
0
votes
0answers
27 views

Cannot find/create zombie/idle VM

I'm trying to do a "stealthy" net scan using metasploit. The first step is to spoof the ip of a "zombie/iddle" machine in order to not give your own Ip. I try to find a zombie machine on a virtualized ...
5
votes
2answers
226 views

Stop Nmap scan and preserve XML output

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
8
votes
1answer
494 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
8
votes
4answers
9k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
3
votes
2answers
884 views

Nmap through proxy

Using the following command: nmap --proxy socks4://*.*.*.*:25074 -sV -O --reason scanme.nmap.org I'm not sure if nmap is really using the proxy specified Had an idea of scanning "localhost" or "...
1
vote
2answers
110 views

Is an ARP scan stealthy?

If you want to discover the live hosts on your subnetwork how can you exploit the ARP protocol in order to scan stealthily? Would an arp scan be picked up as suspicious activity? Could you spoof ...
0
votes
3answers
198 views

Why is UDP port scanning slower than TCP port scanning?

I can't seem to find an answer for this. Any suggestions?
4
votes
1answer
63 views

Do generic custom scripts avoid detection more than common security applications?

Are scripts coded only using the default API of a high level, interpreted language for generic and meticulous gathering of network device and host software information that are already available ...
0
votes
1answer
61 views

What could an attacker do with informations about devices in my local network?

If a malicious website would scan my local network (via WebRTC) for devices, what could the attacker do it with it? Does it need to be in the same WIFI-Network in order to login to a service? (for ...
7
votes
1answer
127 views

Triangulate a mac adress

Last Sunday my iMac was stolen by a burglar. On Monday it showed up on 'find my mac'. Good police work and a lot of luck ended up in me retrieving my device that was on a location more than 50 meter ...
1
vote
2answers
64 views

How does Nessus know which services are running in a host?

I'd like to know how does a vulnerability scanner such as Nessus know which services are running, once it has scanned the ports. I don't want to know the steps to do this in Nessus, I want to know ...
2
votes
1answer
496 views

What is the fastest way to scan all ports of a single machine

I am doing some research and I need a very quick way to scan for open ports on a single machine. To provide some context, I know that my machine will have a port open waiting for UDP packets for about ...
1
vote
2answers
94 views

How to evaluate a wireless network risk level?

When travelling everyone has to use structural wireless networks (managed by airports, hotels, museums, restaurants…). Some of these only open (80|443)/tcp/ip once you have provided an E-mail or ...
2
votes
1answer
54 views

How to perform an idle scan against a target using Nmap with a list of zombies? [closed]

I want to perform port scan against a target but the firewall at the target only allows traffic to the ports through certain IP address/machines. I tried to perform an idle scan in Nmap but it only ...
3
votes
1answer
132 views

Persistent back door using Netcat

I have found the following command several times in one of the linux servers during an assessment: nc -l -p 3030 -e /bin/bash This enables a hacker to gain control over this sever via bash. By ...
0
votes
2answers
243 views

How to scan for ports opened by TCP/UDP sockets with nmap or any other tool?

I'm new to nmap and I've been digging with it lately to scan some devices on the current LAN for ports opened by socket programs which are running. First I ran a simple UDP server on my machine on ...
27
votes
4answers
4k views

How do you deal with massive port scans?

This morning I was looking through firewall logs and saw there were about 500 packets marked as port scan. The scanning range was from 1000-1200 5000-5200. The IP address is 85.25.217.47 which seems ...
6
votes
2answers
1k views

Discovering IP or Mac address of mobile devices passing by.

Is it possible for someone to discover the IP and/or MAC address of my mobile device, even if I do not attempt to connect to their network?
4
votes
3answers
284 views

Nmap showing ISPs router's DNS port in addition to target's ports

Whenever I do nmap scans my ISP router DNS port like the following. This happens for every IP or target. $ nmap -T4 -A -v stackoverflow.com PORT STATE SERVICE VERSION 53/tcp open domain ...
0
votes
1answer
39 views

Network traffic analyzer for Video [closed]

I am going to be streaming video on an open network. I need the simplest network traffic analyzer that would enable me to know when the video is stopped and started from another system on the same ...
7
votes
2answers
2k views

Initial steps of network mapping

In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question. My Question You ...
1
vote
1answer
416 views

Nessus web client: Error 401 invalid credentials [closed]

Previously I used to scan sites using Nessus web client, but when I tried to login with the same credentials I am able to see a401 (Invalid Credentials) error. I have restarted the service nessusd, ...
2
votes
1answer
58 views

Finding Targets in Foreign Network

Say you popped into a network after exploiting something, and you are looking to further infiltrate the network. When theorizing in my head I realized the local ip's can change themselves. So doing ...
3
votes
1answer
246 views

Automating NIKTO scanner

I am working on NIKTO automation. I have a text file contains list of IP addresses along with their ports open. I have already made nikto script. Script functionality - it takes IP addresses and then ...
0
votes
1answer
65 views

Resuming an interrupted nmap scan:

I need to: --resume <filename>: Resume an aborted interrupted scan. But I didn’t: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, ...