Programs that map out a network to figure out which computers and services are available to be exploited.

learn more… | top users | synonyms

1
vote
2answers
29 views

Packet Filter vs Application proxy

http://postimg.org/image/b1w3bujnv/ I don't understand the highlighted part in red. Firstly,Why is a packet filter is enough in a situation where traffic is busy? Secondly,Isn't application proxy ...
1
vote
0answers
17 views

Is there a form to know the PostgreSQL version using nmap?

I tried using the following command: nmap -p 5432 -v --script pgsql-brute myhost But I got no output related to the pgsql script nor the dbms version.
1
vote
1answer
50 views

What is a device that scans the network it is connected to called?

Are there any devices (computer, switch, router, etc.) witch integrate licensed software like Nessus or Nexpose in a way that you can just drop them in a network and scan that network remote? If so, ...
1
vote
4answers
13k views

Unknown MAC address connected to router

I found an unknown MAC address connected to my home router. How would I figure out what OS the IP or MAC address is running?
3
votes
1answer
127 views

Scanning private IPs from outside network

Is it possible with Nmap (or other tool) to scan a range of private IPs (let's say 10.0.0.0/8) but being outside any private network (using those IPs) ?
1
vote
1answer
67 views

How do I scan for and discover active IPv6 addresses of devices behind a router?

Usually with IPv4 and NAT you can only access a device behind a router if the router is port-forwarded correctly or is the router's DMZ. When behind the router you can easily scan for the IPs behind ...
-5
votes
1answer
106 views

Benefit of checking TCP port or UDP port [closed]

I'm studying port scanning. How can an attacker benefit from the information of checking TCP ports or UDP ports?
1
vote
1answer
111 views

NMAP Scan Returns Odd OS Detection [closed]

I am new to NMAP but I was using it to troubleshoot some issues I have been having. I ran a scan on a device and I know the device runs some sort of Linux or Ubuntu OS and I was attempting to figure ...
1
vote
1answer
73 views

Denial of Service during scanning [closed]

As I know you can do Denial of Service when footprinting with scanners, like nmap or Maltego. But is it legal? As I know, scanning isn't illegal but doing DoS attacks is. EDIT I meant if you scan ...
3
votes
1answer
168 views

A PC constantly scans my network for IP addresses using ARP

Using wireshark I have found that one PC on my network constantly scans for devices on the network using ARP, e.g. Who has 192.168.0.26? Tell 192.168.0.10 It does that approx. 2 times a second and ...
1
vote
0answers
24 views

Scapy problem in sending packet

I am trying to use Scapy for testing the network. Whenever I send a packet with commands like send, sr ,sr1 I get this message: python.exe has stopped working I am using Scapy 2.2.0 on Windows ...
0
votes
0answers
27 views

Cannot find/create zombie/idle VM

I'm trying to do a "stealthy" net scan using metasploit. The first step is to spoof the ip of a "zombie/iddle" machine in order to not give your own Ip. I try to find a zombie machine on a virtualized ...
5
votes
2answers
148 views

Stop Nmap scan and preserve XML output

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
35
votes
5answers
4k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
8
votes
1answer
435 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
8
votes
4answers
9k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
3
votes
2answers
218 views

Nmap through proxy

Using the following command: nmap --proxy socks4://*.*.*.*:25074 -sV -O --reason scanme.nmap.org I'm not sure if nmap is really using the proxy specified Had an idea of scanning "localhost" or ...
1
vote
2answers
96 views

Is an ARP scan stealthy?

If you want to discover the live hosts on your subnetwork how can you exploit the ARP protocol in order to scan stealthily? Would an arp scan be picked up as suspicious activity? Could you spoof ...
0
votes
3answers
154 views

Why is UDP port scanning slower than TCP port scanning?

I can't seem to find an answer for this. Any suggestions?
4
votes
1answer
62 views

Do generic custom scripts avoid detection more than common security applications?

Are scripts coded only using the default API of a high level, interpreted language for generic and meticulous gathering of network device and host software information that are already available ...
0
votes
1answer
58 views

What could an attacker do with informations about devices in my local network?

If a malicious website would scan my local network (via WebRTC) for devices, what could the attacker do it with it? Does it need to be in the same WIFI-Network in order to login to a service? (for ...
7
votes
1answer
113 views

Triangulate a mac adress

Last Sunday my iMac was stolen by a burglar. On Monday it showed up on 'find my mac'. Good police work and a lot of luck ended up in me retrieving my device that was on a location more than 50 meter ...
1
vote
2answers
43 views

How does Nessus know which services are running in a host?

I'd like to know how does a vulnerability scanner such as Nessus know which services are running, once it has scanned the ports. I don't want to know the steps to do this in Nessus, I want to know ...
2
votes
1answer
436 views

What is the fastest way to scan all ports of a single machine

I am doing some research and I need a very quick way to scan for open ports on a single machine. To provide some context, I know that my machine will have a port open waiting for UDP packets for about ...
1
vote
2answers
89 views

How to evaluate a wireless network risk level?

When travelling everyone has to use structural wireless networks (managed by airports, hotels, museums, restaurants…). Some of these only open (80|443)/tcp/ip once you have provided an E-mail or ...
2
votes
1answer
50 views

How to perform an idle scan against a target using Nmap with a list of zombies? [closed]

I want to perform port scan against a target but the firewall at the target only allows traffic to the ports through certain IP address/machines. I tried to perform an idle scan in Nmap but it only ...
3
votes
1answer
72 views

Persistent back door using Netcat

I have found the following command several times in one of the linux servers during an assessment: nc -l -p 3030 -e /bin/bash This enables a hacker to gain control over this sever via bash. By ...
0
votes
2answers
161 views

How to scan for ports opened by TCP/UDP sockets with nmap or any other tool?

I'm new to nmap and I've been digging with it lately to scan some devices on the current LAN for ports opened by socket programs which are running. First I ran a simple UDP server on my machine on ...
27
votes
4answers
4k views

How do you deal with massive port scans?

This morning I was looking through firewall logs and saw there were about 500 packets marked as port scan. The scanning range was from 1000-1200 5000-5200. The IP address is 85.25.217.47 which seems ...
6
votes
2answers
899 views

Discovering IP or Mac address of mobile devices passing by.

Is it possible for someone to discover the IP and/or MAC address of my mobile device, even if I do not attempt to connect to their network?
4
votes
3answers
204 views

Nmap showing ISPs router's DNS port in addition to target's ports

Whenever I do nmap scans my ISP router DNS port like the following. This happens for every IP or target. $ nmap -T4 -A -v stackoverflow.com PORT STATE SERVICE VERSION 53/tcp open domain ...
0
votes
1answer
39 views

Network traffic analyzer for Video [closed]

I am going to be streaming video on an open network. I need the simplest network traffic analyzer that would enable me to know when the video is stopped and started from another system on the same ...
7
votes
2answers
2k views

Initial steps of network mapping

In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question. My Question You ...
1
vote
1answer
280 views

Nessus web client: Error 401 invalid credentials [closed]

Previously I used to scan sites using Nessus web client, but when I tried to login with the same credentials I am able to see a401 (Invalid Credentials) error. I have restarted the service nessusd, ...
2
votes
1answer
57 views

Finding Targets in Foreign Network

Say you popped into a network after exploiting something, and you are looking to further infiltrate the network. When theorizing in my head I realized the local ip's can change themselves. So doing ...
3
votes
1answer
223 views

Automating NIKTO scanner

I am working on NIKTO automation. I have a text file contains list of IP addresses along with their ports open. I have already made nikto script. Script functionality - it takes IP addresses and then ...
0
votes
1answer
49 views

Resuming an interrupted nmap scan:

I need to: --resume <filename>: Resume an aborted interrupted scan. But I didn’t: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, ...
-1
votes
1answer
339 views

Netdiscover running on NAT interface not finding IP addresses on host-only network?

I am practicing penetration testing techniques using Kali Linux (most recent distro) and various vulnerable virtual machines (DVWA, Metasplotiable). My attack and targets are all running via ...
-4
votes
1answer
31 views

network port registry

I am planning to build an app which gives information about the network port and the service name for non-opensource based products. Is there a legal implication of building such apps? because someone ...
1
vote
2answers
92 views

Is a Windows (fresh installation) 7 really this safe against NMAP or am I missing something?

I am playing with NMAP in my small private network performing port scanning. So far I went through scanning the following OSs (Unaltered new installations - Meaning no extra software installed!): ...
2
votes
1answer
89 views

Hiding packets, requests, traffic from my PC through Ethernet connected to workplace network

Before everyone jumps on the bandwagon, as I so often see, of saying you shouldn't do anything on a workplace network that is to be done annonymously on your own home network, I want to know an actual ...
1
vote
1answer
63 views

What local ethernet-accessible resources can be accessed on a PC through a USB cable?

Clarification: this is about scanning the network resources on computer B from computer A in a situation where: Computer A is connected to Computer B through a USB cable Computer A has some scanning ...
2
votes
0answers
135 views

nmap OS scan showing DD-WRT when I'm not running it?

This weekend, I set up pfSense on a spare box that I had sitting in the garage. It seems cool and powerful, but I haven't messed with it much yet. Was doing some basic nmap scanning from work against ...
2
votes
1answer
178 views

NMAP DNS Resolution

By default NMAP does reverse DNS resolution for a given IP which responds to the host discovery probes. My question is, what are the benefits of getting the host name when performing a network scan?
2
votes
0answers
50 views

Does hping support FTP Bounce scanning?

Does hping support FTP Bounce scanning? I googled it, but I couldn't find its command, so I think it didn't support it. I just find command for nmap not hping.
6
votes
1answer
265 views

Port Scanning - States definition

I am currently reading the "NMAP Network Scanning" book by Gordon Fyodor Lyon. On page 77 there is a description on how NMAP categorizes the ports based on host's responses (or not). What would help ...
0
votes
2answers
283 views

Can't successfully do an idle scan

I have Kali Linux installed in VirtualBox and would like to do an idle scan. For this I need to find a suitable zombie PC. I'm using the ipidseq script to find one. The script finds some IP addresses ...
2
votes
2answers
2k views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
2
votes
2answers
95 views

Legally port scanning (Whitelist)

I am attempting to set up a security vulnerability scanning server. I have several customers interested in using it to scan their systems. I will be port scanning and carrying out intrusion detection, ...
0
votes
2answers
715 views

Vulnerability scanner inside AWS

I have three VPC's within AWS and I want to run an automated Nmap scan on all three VPC's every few weeks to make sure nothing has been opened, added, etc. What would be the best way to achieve this? ...