Programs that map out a network to figure out which computers and services are available to be exploited.

learn more… | top users | synonyms

34
votes
5answers
4k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
8
votes
1answer
415 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
8
votes
4answers
8k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
1
vote
0answers
11 views

Why is the maximum port range 65535 in the TCP/IP Suite ? [migrated]

My doubt is that - a port is just logical, so why such restriction ? Why can't I have a port of 9924593 or something like that ?
3
votes
2answers
70 views

Nmap through proxy

Using the following command: nmap --proxy socks4://*.*.*.*:25074 -sV -O --reason scanme.nmap.org I'm not sure if nmap is really using the proxy specified Had an idea of scanning "localhost" or ...
1
vote
2answers
75 views

Is an ARP scan stealthy?

If you want to discover the live hosts on your subnetwork how can you exploit the ARP protocol in order to scan stealthily? Would an arp scan be picked up as suspicious activity? Could you spoof ...
0
votes
3answers
123 views

Why is UDP port scanning slower than TCP port scanning?

I can't seem to find an answer for this. Any suggestions?
4
votes
1answer
61 views

Do generic custom scripts avoid detection more than common security applications?

Are scripts coded only using the default API of a high level, interpreted language for generic and meticulous gathering of network device and host software information that are already available ...
0
votes
1answer
58 views

What could an attacker do with informations about devices in my local network?

If a malicious website would scan my local network (via WebRTC) for devices, what could the attacker do it with it? Does it need to be in the same WIFI-Network in order to login to a service? (for ...
2
votes
1answer
83 views

Scanning private IPs from outside network

My question is only for informative purposes: Is it possible with Nmap (or other tool) to scan a range of private IPs (let's say 10.0.0.0/8) but being outside any private network (using those IPs) ? ...
6
votes
1answer
103 views

Triangulate a mac adress

Last Sunday my iMac was stolen by a burglar. On Monday it showed up on 'find my mac'. Good police work and a lot of luck ended up in me retrieving my device that was on a location more than 50 meter ...
1
vote
2answers
37 views

How does Nessus know which services are running in a host?

I'd like to know how does a vulnerability scanner such as Nessus know which services are running, once it has scanned the ports. I don't want to know the steps to do this in Nessus, I want to know ...
2
votes
1answer
411 views

What is the fastest way to scan all ports of a single machine

I am doing some research and I need a very quick way to scan for open ports on a single machine. To provide some context, I know that my machine will have a port open waiting for UDP packets for about ...
1
vote
2answers
88 views

How to evaluate a wireless network risk level?

When travelling everyone has to use structural wireless networks (managed by airports, hotels, museums, restaurants…). Some of these only open (80|443)/tcp/ip once you have provided an E-mail or ...
2
votes
1answer
49 views

How to perform an idle scan against a target using Nmap with a list of zombies? [closed]

I want to perform port scan against a target but the firewall at the target only allows traffic to the ports through certain IP address/machines. I tried to perform an idle scan in Nmap but it only ...
3
votes
1answer
55 views

Persistent back door using Netcat

I have found the following command several times in one of the linux servers during an assessment: nc -l -p 3030 -e /bin/bash This enables a hacker to gain control over this sever via bash. By ...
0
votes
2answers
116 views

How to scan for ports opened by TCP/UDP sockets with nmap or any other tool?

I'm new to nmap and I've been digging with it lately to scan some devices on the current LAN for ports opened by socket programs which are running. First I ran a simple UDP server on my machine on ...
27
votes
4answers
4k views

How do you deal with massive port scans?

This morning I was looking through firewall logs and saw there were about 500 packets marked as port scan. The scanning range was from 1000-1200 5000-5200. The IP address is 85.25.217.47 which seems ...
6
votes
2answers
781 views

Discovering IP or Mac address of mobile devices passing by.

Is it possible for someone to discover the IP and/or MAC address of my mobile device, even if I do not attempt to connect to their network?
4
votes
3answers
167 views

Nmap showing ISPs router's DNS port in addition to target's ports

Whenever I do nmap scans my ISP router DNS port like the following. This happens for every IP or target. $ nmap -T4 -A -v stackoverflow.com PORT STATE SERVICE VERSION 53/tcp open domain ...
0
votes
1answer
38 views

Network traffic analyzer for Video [closed]

I am going to be streaming video on an open network. I need the simplest network traffic analyzer that would enable me to know when the video is stopped and started from another system on the same ...
7
votes
2answers
2k views

Initial steps of network mapping

In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question. My Question You ...
1
vote
1answer
220 views

Nessus web client: Error 401 invalid credentials [closed]

Previously I used to scan sites using Nessus web client, but when I tried to login with the same credentials I am able to see a401 (Invalid Credentials) error. I have restarted the service nessusd, ...
2
votes
1answer
56 views

Finding Targets in Foreign Network

Say you popped into a network after exploiting something, and you are looking to further infiltrate the network. When theorizing in my head I realized the local ip's can change themselves. So doing ...
3
votes
1answer
220 views

Automating NIKTO scanner

I am working on NIKTO automation. I have a text file contains list of IP addresses along with their ports open. I have already made nikto script. Script functionality - it takes IP addresses and then ...
0
votes
1answer
40 views

Resuming an interrupted nmap scan:

I need to: --resume <filename>: Resume an aborted interrupted scan. But I didn’t: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, ...
-1
votes
1answer
270 views

Netdiscover running on NAT interface not finding IP addresses on host-only network?

I am practicing penetration testing techniques using Kali Linux (most recent distro) and various vulnerable virtual machines (DVWA, Metasplotiable). My attack and targets are all running via ...
-4
votes
1answer
31 views

network port registry

I am planning to build an app which gives information about the network port and the service name for non-opensource based products. Is there a legal implication of building such apps? because someone ...
4
votes
2answers
116 views

Stop Nmap scan and preserve XML output

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
1
vote
2answers
90 views

Is a Windows (fresh installation) 7 really this safe against NMAP or am I missing something?

I am playing with NMAP in my small private network performing port scanning. So far I went through scanning the following OSs (Unaltered new installations - Meaning no extra software installed!): ...
2
votes
1answer
86 views

Hiding packets, requests, traffic from my PC through Ethernet connected to workplace network

Before everyone jumps on the bandwagon, as I so often see, of saying you shouldn't do anything on a workplace network that is to be done annonymously on your own home network, I want to know an actual ...
1
vote
1answer
63 views

What local ethernet-accessible resources can be accessed on a PC through a USB cable?

Clarification: this is about scanning the network resources on computer B from computer A in a situation where: Computer A is connected to Computer B through a USB cable Computer A has some scanning ...
2
votes
0answers
114 views

nmap OS scan showing DD-WRT when I'm not running it?

This weekend, I set up pfSense on a spare box that I had sitting in the garage. It seems cool and powerful, but I haven't messed with it much yet. Was doing some basic nmap scanning from work against ...
2
votes
1answer
169 views

NMAP DNS Resolution

By default NMAP does reverse DNS resolution for a given IP which responds to the host discovery probes. My question is, what are the benefits of getting the host name when performing a network scan?
2
votes
0answers
49 views

Does hping support FTP Bounce scanning?

Does hping support FTP Bounce scanning? I googled it, but I couldn't find its command, so I think it didn't support it. I just find command for nmap not hping.
6
votes
1answer
265 views

Port Scanning - States definition

I am currently reading the "NMAP Network Scanning" book by Gordon Fyodor Lyon. On page 77 there is a description on how NMAP categorizes the ports based on host's responses (or not). What would help ...
0
votes
2answers
270 views

Can't successfully do an idle scan

I have Kali Linux installed in VirtualBox and would like to do an idle scan. For this I need to find a suitable zombie PC. I'm using the ipidseq script to find one. The script finds some IP addresses ...
2
votes
2answers
1k views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
2
votes
2answers
90 views

Legally port scanning (Whitelist)

I am attempting to set up a security vulnerability scanning server. I have several customers interested in using it to scan their systems. I will be port scanning and carrying out intrusion detection, ...
0
votes
2answers
638 views

Vulnerability scanner inside AWS

I have three VPC's within AWS and I want to run an automated Nmap scan on all three VPC's every few weeks to make sure nothing has been opened, added, etc. What would be the best way to achieve this? ...
5
votes
5answers
2k views

Sharing Nmap scan results in a web page [closed]

Is there a tool that allow the sharing of nmap scan results ? I know nmap can produce XML and I can easily convert them in HTML. I would like to know if there is a tool with more features. For ...
2
votes
2answers
39 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...
11
votes
4answers
866 views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks: Is the presence of wireless access points tested for by using a wireless analyzer at ...
1
vote
1answer
4k views

Router detecting constant ack flood attacks and port scans

I first noticed this yesterday in my logs - while I was configuring the router settings, so I don't know how long it's been going on. What should I do? I reconfigured my router with more secure ...
0
votes
1answer
44 views

hping3 - Ignoring not responding ports

Is there a way to ignore the not responding ports in the scan report? james@ahoi:~$ sudo hping3 -q --scan 1-1000 -S 192.168.0.1 Scanning 192.168.0.1 (192.168.0.1), port 1-1000 1000 ports to scan, use ...
10
votes
4answers
1k views

Filtered ports - What exactly filters them?

By the NMAP definition, unfiltered ports are the ones which cannot be determined to be open or closed since packet filtering prevents its probes from reaching the port. (ISBN 9780979958717 pag. 77) ...
2
votes
4answers
3k views

Is there a nmap command to get the top # most common ports?

I understand nmap by default scans the top 1k 'most common' ports (-F reduces to 100) I understand it gets these 'most common' ports based on the nmap-services file, specifically the frequency (3rd ...
3
votes
2answers
696 views

Scanning multiple subnets with nmap to determine open services & ports

First off, I know nmap's documentation is very powerful and I have been reading through it rather extensively. I will be scanning externally, with permission, to determine ports & services that ...
4
votes
3answers
1k views

Enumerate the subdomains of a given domain - what's the point?

There're a number of security tools out there that enumerate the subdomains of a given domain. I wonder: What's the purpose of that in terms of security / hacking? Is there any way to do that other ...
0
votes
2answers
88 views

Client misunderstanding nmap [closed]

My client wants their public facing IP addresses to be secure, but thinks that running nmap port scans will draw attention from hackers. To settle this once and for all, what do you say?