Programs that map out a network to figure out which computers and services are available to be exploited.
15
votes
4answers
1k views
Open-source penetration-test automation
Has anyone built a metascript, or a `script of scripts' useful during a penetration-test?
Do you use Metasploit RC files? A network vulnerability scanner in a special way? A command-line, custom, or ...
12
votes
6answers
1k views
Are some uncommon TCP ports scanned less than others?
Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
12
votes
3answers
2k views
Nessus vs third-party scans
As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
11
votes
3answers
3k views
What benefits does Nessus have over OpenVAS?
Nessus and OpenVAS appear to have fairly similar features. Why would you choose one over the other, besides the benefit of commercial support (which isn't available for Nessus Home Feed users ...
8
votes
2answers
975 views
Bypassing a reverse proxy/NAT
Reverse proxies and NAT would seem to obscure a network behind such technologies to the point where it would be hard if not impossible to identify ports open and services running.
Given that many ...
7
votes
2answers
8k views
nmap scan shows ports are filtered but nessus scan shows no result
I'm performing an port scanning on a range of IPs on our remote site. I tried running nmap scan on that IP range and some of the IP result are shown as filtered
When I perform a nessus scan on the ...
7
votes
5answers
3k views
How to detect hosts running in virtual machines with nmap?
I have to determine if a given subnet has virtual hosts.
Are there any ideas about what switches to use?
7
votes
4answers
418 views
What kind of IT security applications do you guys run on your laptop/desktop?
I know a lot of people run different security applications on their laptops/desktops. I use Little Snitch on my Macbook Pro. I like to know where my applications are sending data and where I am ...
7
votes
4answers
392 views
Wireless Activity Monitoring for PCI DSS Compliance
In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks
Is the presence of wireless access points tested for by using a wireless analyzer at ...
7
votes
2answers
587 views
Malware known to use port knocking to evade detection by network scanners?
Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
6
votes
3answers
1k views
nmap showing unknown IPs on private network
I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
6
votes
2answers
1k views
Initial steps of network mapping
In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question.
My Question
You ...
5
votes
4answers
461 views
Persisting and comparing NMAP scans
Does anyone have any good recommendations on a good tool for persisting NMAP scans to database?
It may be a tool for persisting or simply a java library for easy parsing of the nmap xml scan result ...
5
votes
2answers
155 views
What should a Vulnerability Management System scan on a large scale
On a large scale (~1500 workstations, ~100 servers, ~50 network routers and switches, etc), what should a vulnerability management system be scanning? Should it scan everything, or just samples?
I ...
4
votes
4answers
775 views
Do these ports mean anything?
I'm diving to the world of penetration testing and I decided to port scan my server. My website is completely managed by a friend of mine but he lacks any knowledge of security.
PORT STATE ...
4
votes
2answers
2k views
Scanning my network with NMAP
Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
4
votes
4answers
292 views
Malware that uses http as a covert channel
I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour.
Is there any database of malware, ...
4
votes
3answers
203 views
packet sniffers and segments
Just curious why most packet sniffers are limited to their segment? is it the nature of a gateway to block the attempt outside a subnet?
cheers
4
votes
4answers
625 views
How can I scan open ports without being traced back
I would like to scan open ports of a server. But as far as I know, when I try to scan the open ports with something like nmap in shell they would be able to trace me. Is there a way to secure this ...
4
votes
3answers
133 views
Sharing Nmap scan results in a web page
Is there a tool that allow the sharing of nmap scan results ? I know nmap can produce XML and I can easily convert them in HTML.
I would like to know if there is a tool with more features. For ...
4
votes
4answers
301 views
what scanning tools are unlikely to set off network IDS?
What network scanning tools have a stealth option to avoid detection?
3
votes
4answers
282 views
How can I portscan large subnets?
I need to scan several /16 and a /8 subnet to see what hosts are up and additionally, if any services are running on a select few ports. I've tried various tools such as angry IP scanner, Nmap, ...
3
votes
4answers
189 views
What does a switched network protect us from? What does it not protect us from?
There seems to be some misconceptions regarding what a switched network will protect us from, and what technologies/precautions a secure environment requires when segmenting trusted users from hostile ...
3
votes
2answers
1k views
Using Cain and Abel to capture traffic of machine in the same network
I have installed Cain and Able in machine A, which is connected to another machine B via a LAN. Now I want to analyze all the traffic of machine B. Is this possible by installing Cain and Abel on ...
3
votes
2answers
2k views
Could Nmap scan switches/routers
Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.
3
votes
2answers
295 views
Is it possible to trace fellow nodes on a DSL internet connection?
I'm not in my college campus right now. In campus we had private LAN. There my computer was directly connected to a gateway. Using subnet masks I used to find out fellow nodes on my subnet. There were ...
3
votes
5answers
121 views
How to introduce delay in scanning tools that do not implement delay without touching source code?
Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option.
Is there a way to delay packets from ...
3
votes
1answer
446 views
How does OS detection work in practice?
I was wondering how OS detection really works on Nmap. I know it is about to send different tcp probes to see how the target machine responds to them.
But what kind of probes would distinguish a ...
3
votes
1answer
171 views
tcp seq number prediction
While testing a system, nmap told me that the tcp seq number prediction is really low, (trivial joke). There is only one system in the whole range that gives me that answer. Some papers, e.g. a ...
3
votes
7answers
428 views
Determining network topology from the outside
To what extent can an attacker generate a map of a network from outside of it?
Are network scanning tools such as nmap the only means to do this? Otherwise what other types of tools or techniques ...
2
votes
5answers
195 views
How to bypass Nmap blockage?
I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside?
Also, does blocking nmap on a network provide any security?
...
2
votes
2answers
209 views
Tools/methods helping to determine application/protocol serving specific port
I do blackbox testing of the server and figured out that there is a bunch of listening ports. I need to determine what services/protocols those ports are used for.
What I've tried so far is to use ...
2
votes
1answer
360 views
Good software for IT Infrastructure discovery
Currently, I have an industry attachment project in which my group need to suggest a good tool for Network discovery to a IT service company. The company wants to automate the stage in which they have ...
2
votes
1answer
60 views
SYN scan, determining scan vs large file upload
In a system attempting to detect SYN scans, one technique is to analyze the rate of change of (network packets sent from victim host per second). Processes such as uploading a large file would not be ...
2
votes
2answers
165 views
Suspect Exchange Server appears to be hacked. How to determine if it was a false positive?
Our security vendor detected that our client's CAS server was doing a nessus scan in the internal network.
It's not uncommon for this vendor to issue a false positive, but I'm looking for general ...
2
votes
1answer
90 views
Network abnormally slow during night hours
My network recently the last week as become abnormally slow around 11 pm. Very slow buffering youtube videos during all hours. Ive recently purchased the new router about two months ago but not ...
2
votes
2answers
168 views
Scan Novell NetWare backend with Windows servers and clients
Could anyone provide some insight on performing an internal vulnerability assessment regarding Novell NetWare as the backend with client workstations and servers running various versions of Windows?
...
2
votes
1answer
242 views
What is known about the sirefef/zeroaccess malware/botnet?
There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
2
votes
1answer
3k views
Detected Port Scanning Attack in ESET Smart Security
I receive a number of notifications from ESET Smart Security about Port Scanning attack. But I'm behind a router. But as far as I know, computers behind a router is not accessible from others (Please ...
2
votes
1answer
579 views
Scan for mobile phones?
I'd like to measure queuing time, similar to what they're doing in Finland. Instead of detecting bluetooth (which is disabled in most phones) I thought of detecting EDGE/3G.
I'd like to log the ...
1
vote
3answers
496 views
How to find the OS of the target machine
I am new to this field. Currently I am using Linux OS and
my question is how can I find the OS of another machine to
which I do not have a direct access.
I am interested in any possibilities which ...
1
vote
3answers
289 views
Online security check via command line
My scenario is that I have a VPS with Apache (mostly for development of my own projects) accessed via SSH; and I time to time I would like to do a quick check just to be sure that there's no potential ...
1
vote
3answers
154 views
How to remote monitor a computer network traffic?
I would like to know if it is possible to remote monitor the incoming and outcoming network traffic of a specific IP from my network. I need to log the time, ip numbers and port that contact the ...
1
vote
2answers
87 views
SYN scan, TCP packet question
during SYN scans, many small tcp packets are sent to multiple ports to determine which ports are open or not. But when you're streaming media, aren't you receiving many
One type of ID system, the ...
1
vote
2answers
745 views
TCP / UDP port monitoring programs for mac?
Does anyone know of a free and effective port monitor for mac? Also, can a laymen, in relatively short order, learn to use such software to detect and thus prevent unauthorized remote access/control ...
1
vote
2answers
159 views
Spike in TCP port 5904 activity - what for?
There is an 'Internet Weather Report' on the Threat!Traq video blog by AT&T security researchers. In the March 14th broadcast, at around 31 minutes in, they mention an increase of scanning ...
1
vote
1answer
104 views
how to protect from Network scanner on android?
How can I block and detect network scanners on android platforms to stop scanning vlan of my hot spot.
My question is:
which scanners they use?
how can i detect such scanners?
Can i protect ...
1
vote
0answers
71 views
Which are appropiate tests to perform during an internal/LAN security audit? [closed]
In the internal network we know that controls are less strict than externally but in the other hand we know that lots of attacks come from the internal segment (unhappy workers, etc.)
Which are ...
1
vote
0answers
69 views
Determine deployed 802.3x encryption/authentication protocols? Or, why can't I access Eth0?
Is there any means to identify deployed 802.3x authentication protocols on a wired interface (eth0) under Windows 7 (CLI), or from wlan0 on a *NIX based system?
The scenario is as follows: I am a ...
0
votes
4answers
125 views
SYN scan victim sending back RST
I'm confused on the case of SYN scan and closed ports (the case of open ports makes sense). So, the attacker sends a ~40 byte SYN packet, a "closed port" would send a RST packet back to the attacker ...
