Programs that map out a network to figure out which computers and services are available to be exploited.

learn more… | top users | synonyms

0
votes
1answer
111 views

Is there a way of determining if tor is running on a remote machine?

In most of the companies, IT guys block some sites and by using TOR or other VPNs people walk around these blocks and gain access to blocked content. My question is, assuming TOR is running on ...
0
votes
1answer
105 views

Strange flood of requests to my web server

About an hour ago, strange requests began showing up in my access logs. They are coming in at a rate of ca. 400 req/s and appear to come from IPs all over the place. It started out at a lover rate and ...
2
votes
2answers
67 views

Nmap scanning computers behind a wireless modem [closed]

Let's suppose that I have a router and three computers connected to Internet through that router. When I tried to get the external IP address for each computer, I got the same address. I think this ...
0
votes
0answers
42 views

How to prevent DDoS via IP spoofing while blocking port scan on internal network?

In an internal network, all machines are firewalled from each other. The firewal has port scan detection and blocking mechanism (say, psd module of iptables). Question: What are the ways I can block ...
2
votes
1answer
206 views

Can I perform WEP cracking from several laptops against 1 AP

I have successfully being able to perform WEP key cracking attack using aircrack tool. I want to allow my students to test this in a lab environment. They will be working fro their own laptops against ...
0
votes
2answers
3k views

Questionable request to /user/soapCaller.bs

My webserver logs revealed a request to /user/soapCaller.bs from 220.226.188.32, which maps to Mumbai, India. The HTTP user agent is called 'Morpheus * Scanner'. My server returned a 404 error. ...
1
vote
1answer
40 views

Can we build network topology using passive fingerprinting?

Can we use the tools such as P0f, OSSIM and other passive fingerprinting tools to build a comprehensive network topology of how the devices are interconnected ? or is there a passive finger printing ...
5
votes
2answers
308 views

Is it possible to ping a LAN card through its MAC address? [duplicate]

As you can start a PC through its 'WAKE ON LAN' feature on private networks, can you trace someone's online status through their MAC address over the internet ?
2
votes
3answers
110 views

How does Network Discovery OFF protect my computer?

Yes, it seems that the computer will not respond to pinging. But any computer with a packet sniffer will be able to see my ip once I send any packet to the router. So basically, if I'm surfing the ...
19
votes
3answers
7k views

What benefits does Nessus have over OpenVAS?

Nessus and OpenVAS appear to have fairly similar features. Why would you choose one over the other, besides the benefit of commercial support (which isn't available for Nessus Home Feed users ...
0
votes
1answer
60 views

NMAP not reporting open ports with -sS scan

Is there any reason why an -sS scan (or most others) would not report an open port that doesn't have a service attached to it? For example, in a regular -sS scan, the following port will be missing, ...
0
votes
1answer
35 views

Can't successfully do an idle scan

I have kali linux installed in VirtualBox and would like to do an idle scan. For this I need to find a suitable zombie pc. I'm using the ipidseq script to find one. The script finds some ip addresses ...
1
vote
2answers
216 views

How to block network scans with pfsense?

I am using pfsense as firewall, and I would like to know how I can stop network scans from enumerating open services and ports. Thanks
1
vote
2answers
97 views

Is it possible to defeat the OS detection capabilities of network scanning tools?

Network scanning tools such as nmap have the capability to infer operating system version based upon lower-level system details. EG: TCP/IP stack behavior, etc. Are there any known methods to trick ...
3
votes
2answers
78 views

Public facing computers in a Media Lab

I've just taken over administering a lab of Apple computers on a university campus. We have about 15 computers and I've discovered that they all have public IPs and domain names. Even our printer is ...
0
votes
0answers
24 views

How can I get a list of unsigned plugins in openvas?

How can I get a list of unsigned plugins in openvas? Are those plugins safe for use? When I run the scan on a test machine with nasl_no_signature_check = no, I don't get any results(not even any ...
1
vote
3answers
215 views

What exactly does one get from a Nmap Scan?

I know nmap is a port scanner and its output shows all the open ports, the services running on those ports, the underlying OS and technology, etc. What should one take from this result in easiest ...
0
votes
3answers
106 views

Practicing pentesting locally

After watching videos and downloading just about every possible pen-testing tool out there to play around with and learn. How do you setup test beds and practice scenarios to crack? With RE people ...
0
votes
1answer
50 views

Are there any tools/methods to probe a web app from diffferent IPs?

I am currently reading "Metasploit: The Penetration Tester's Guide" and I came across the following paragraph in the book (in the 1st chapter) During intelligence gathering, you attempt to ...
2
votes
1answer
173 views

How to detect infected devices on your local network [closed]

Today I read about a researcher who bought a digital TV recorder and connected it to the internet - probably using port forwarding to enable attackers to connect to the recorder. After a while someone ...
1
vote
3answers
94 views

Is it safe to share my hostname

I am using GNU/Linux. Sometimes, I copy/paste code from the terminal (like user@hostname ..) to put it in a forum thread or a blog ..etc And I was always wondering that it is better to hide it . Is ...
0
votes
3answers
83 views

Local network proxy/spoof

Are intruders in a local network able to mask their local IP in any way? Could they 'hijack' another local IP and perform scans and exploits from there?
0
votes
1answer
36 views

Ping response contain subnet ip [closed]

One of my friends site got hacked recently. Now while pinging the site ping zyz.com the response is like From 10.x.0.1 icmp_seq=79 Packet filtered From what I have heard, 10.x.0.1 looks like a ...
3
votes
3answers
375 views

Watching for applications like WireShark and other eaves dropping on corporate network

Are there ways to monitor and check for network monitoring like WireShark? Or would it just be more ideal to ensure every application uses SSL to ensure no employee or anyone could packet sniff ...
1
vote
1answer
134 views

Scan All private subnets with NMAP [closed]

I have a managed switch on my network but I don't remember the subnet. How can I scan all the private network without changing my ip address : 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 Thanks for ...
1
vote
2answers
292 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...
0
votes
4answers
563 views

Increase speed in nmap UDP scan?

How can I get nmap quicker in scanning UDP ports? This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
0
votes
2answers
162 views

How to identify a specific operating system with port scans?

According to the implementation of the TCP/IP stack an attacker is able to identify which operating system is running on a network device. Is there any paper or the like according on this topic?
13
votes
3answers
3k views

Nessus vs third-party scans

As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
1
vote
1answer
101 views

Internet monitoring and DNS encryption

If someone hides their DNS traffic by encrypting it with a service such as OpenDNS's DNSCrypt, would you still be able to see which URLs they're viewing? Also, if that person uses HTTPS 100% of the ...
3
votes
2answers
813 views

Why do multiple IP Addresses in my local network point to the same computer?

I'm new to linux and nmap, and I am attempting to do a scan of my local network. Using nmap I find that there are 4 hosts on my network (10.0.2.2, 10.0.2.3, 10.0.2.4, 10.0.2.15). I am using VirtualBox ...
9
votes
4answers
2k views

nmap showing unknown IPs on private network

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
2
votes
1answer
47 views

Do generic custom scripts avoid detection more than common security applications?

Are scripts coded only using the default API of a high level, interpreted language for generic and meticulous gathering of network device & host software information that are already available ...
-3
votes
1answer
211 views

How to find list of open ports in any given ip without using common scanning tools

Suppose I want to port scan my network. Normally I'll use a tool like nmap or nessus. What if we don't have any tool to perform a Port Scan - how can we find open ports?
0
votes
2answers
583 views

Determining false positives when scanning for live hosts with Nmap

When doing a vulnerability assessment on a large network, it seems general practice to determine which hosts on the network are live. This can be done in various ways. From what I have read it is ...
0
votes
1answer
427 views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
2
votes
1answer
73 views

Does nmap limit probes when using time limiting on decoy scans?

If I set a rate limit (e.g. -T1) on an nmap scan that uses decoys, does the rate limit apply to all probes, or just each individual source? I checked the documentation, but can't see anything ...
0
votes
1answer
139 views

Is it possible to scan a remote host in another network if I know a port that is opened?

First of all, this question is not the same as is it possible to test out remote host by using nmap?, because on that question, the questioner is asking for something impossible due to NAT's nature. ...
14
votes
6answers
3k views

Are some uncommon TCP ports scanned less than others?

Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
5
votes
5answers
981 views

How can I portscan large subnets?

I need to scan several /16 and a /8 subnet to see what hosts are up and additionally, if any services are running on a select few ports. I've tried various tools such as angry IP scanner, Nmap, ...
1
vote
3answers
164 views

Port Scanning Host that has Rate Limiting Enabled

I am trying to enumerate on of my lab machines. It seems that it has rate limiting enabled since I am getting blocked after the first few probes. I need to scan the whole 65535 tcp ports. I tried ...
0
votes
1answer
99 views

Understanding a Zenmap output

I'm running Zenmap on my Windows 7 laptop. I ran an intense scan with UDP targeting my router 192.168.1.1.I realize that I'm probing into the back end of the router from the inside and that any open ...
1
vote
1answer
238 views

Disabling Ping/ICMP Requests [duplicate]

Are there any benefits from disabling Ping/ICMP requests on servers? I've read where people say to do it but I can't seem to find any real benefits with it. Only more likely to cause more problems. ...
0
votes
1answer
132 views

TCP IN connection from another user in my home network. Is it safe?

I'm using Comodo Firewall and I noticed that sometimes I'm getting TCP IN connection from another IP address in my home network (only one router and few wireless users): TCP IN | 192.168.1.50 | ...
2
votes
2answers
4k views

Using Cain and Abel to capture traffic of machine in the same network

I have installed Cain and Able in machine A, which is connected to another machine B via a LAN. Now I want to analyze all the traffic of machine B. Is this possible by installing Cain and Abel on ...
0
votes
0answers
28 views

What is the security value of configuring all machines in the LAN to NOT respond to ping? [duplicate]

I am just learning to use the nmap command. When I scanned a friend's LAN with nmap -sP 192.168.0.0/16, only MY laptop came up (and the wireless AP). They told me that a Windows computer is running, ...
1
vote
1answer
388 views

Wireshark detecting suspicious messages through jabber protocol, It says it is from my website, no idea what it is

I was doing a network scan on my computer with Wireshark and came up with something very suspicious: I found a stream with the jabber protocol. I do not have a jabber server set up nor do I have any ...
0
votes
1answer
129 views

What settings should be entered into the blacklist file for zmap to map a local network instead of the entire internet?

My company has a very large distributed network which we scan monthly for vulnerability assessment. As part of that scanning, we try to find all accessible network hosts with a ping sweep. Since zmap ...
20
votes
2answers
6k views

How is wireless WiFi password cracked?

Let's say I have a wireless network that is password protected. What procedures can an intruder take in order to be able to gain access to my wireless network, or at least be able to decipher the ...
19
votes
5answers
2k views

419 Nigerian scam problem

I fell in a scamming trap. It took me a while to figure it out. Blinded like an idiot. But it is what it is. I can only do as much as I can now. Tell me if there is anything else I should do. After ...