Hot answers tagged network-scanners
13
If you can send packets to the target machine, use nmap -O, which provides OS fingerprinting.
If you can eavesdrop/intercept network traffic with the target machine, use pof, a tool for passive OS fingerprinting.
You didn't provide much information about what are your constraints or why the standard tools (like nmap or pof) didn't work for you. Therefore, ...
12
The way attackers go about portscans is to first target those with known exploits or commonly weak protection.
The list at http://www.iss.net/security_center/advice/Exploits/Ports/default.htm is one typical list.
Sure, you get some scanners who go for the entire port range, but as that is far less effective, this list is going to be a pretty good ...
12
You may be getting zero value-add. I suggest finding a new vendor.
And when soliciting potential new PCI ASVs, ask them what they do, questions like:
Which vulnerability scanners will you use to assess our systems?
Do you use the commercial or free versions of the vulnerability scanners?
We use Nessus internally, what more will you do to bring ...
12
Taking into consideration the fact that you are doing these scans in the context of PCI-DSS compliance, your value-add in relation to compliance can be summed up by my personal favorite saying:
AviD's Law of Regulatory Compliance:
"PCI compliance reduces the risk of the penalties of non-compliance".
In other words - the value-add of having an ...
11
Sebastein Jeanquier's Master's thesis section 7.1, "Port Knocking in Malware (Backdoors)", states that SAdoor and its predecessor cd00r both used this feature.
Tony Bradley writes in About.com that "malware writers of the world have unfortunately ... begun to adopt this technique for opening backdoors on victimized systems" but doesn't provide any ...
11
Unless you've got nmap configured not to perform host discovery (-PN or -PN --send-ip on the LAN), if it is indicating that all ports are filtered, then the host is up, but the firewall on that host is dropping traffic to all the scanned ports.
Note that a default nmap scan does not probe all ports. It only scans 1000 TCP ports. If you want to check for any ...
10
Nessus is very good at what it does, but a 'proper' security scanning vendor would not just deliver you a Nessus report. At the very least, you need to go through the report and validate to remove false positives - you probably do this internally anyway, but unless you request it a vendor may not.
There is a major disconnect in what customers expect and ...
10
A Brief Note On Banner Grabbing
The first, biggest, hurdle one faces when getting into vulnerability assessments or penetration testing is understanding the limitations of whatever detection mechanism you're using. Like Rory said, you didn't really say how you got the presented list of ports, however it looks like an NMAP scan using banner grabbing. This Is ...
10
First of all you need to understand how things actually work, so take a look here: NAT. This is how your router currently makes internet communication for all your hosts possible.
So, everything is behind a NAT, and that's exactly why you can't access any host using your public IP address. If you want a machine inside your private home network to be ...
9
Definitely. See http://nmap.org/svn/nmap-services for a listing of ports and the expected chances that they'll be open.
Nmap offers two options that relate to that:
--top-ports <number>: Scan <number> most common ports
--port-ratio <ratio>: Scan ports more common than <ratio>
Other methods include ports < 1024, listed in an ...
8
Check out The Penetration Testing Execution Standard (PTES).
And in particular: http://www.pentest-standard.org/index.php/Intelligence_Gathering
This video may interest you as well:
http://www.irongeek.com/i.php?page=videos/osint-cyberstalking-footprinting-recon#DNS,_Whois_and_Domain_Tools_Finding_general_Information_about_an_organization_via_the_web (from ...
8
I couldn't agree more with @spinkham's answer. That is the best answer.
To add to @ygjb's power tool list, on the web app side, these tools are excellent for extracting data
First use the Burp Suite to identify points of opportunity - this tool can be challenging to gain proficiency in if you're new to how web apps work
Powertools to help you ...
8
I think that both projects will have their strong and weak points. At the moment I'd say that Nessus appears to have a wider range of plugins available and arguably a better user interface than the standard OpenVAS client/server implementation.
In addition Nessus seems to have widened their original focus in unauthenticated vulnerability scanning to ...
7
Switches are not meant for security. A switch differs from a hub in that it observes packets to deduce where each host is, so that a packet aimed at a given host will be written only on the physical cable leading to that host. This is a performance optimization in that it allows more traffic to happen concurrently on a given network.
The side-effect of ...
7
You can't: Cain and Abel is not a general purpose packet sniffer. Abel captures the packets, and then Cain performs analysis to try and find passwords; you look at the results of the analysis, not the raw packet capture.
If you want to view packets, you should use a more general product such as Wireshark.
7
Like bonsaiviking said, it probably belongs to a neighbour. Leave it alone and avoid the risk of getting in trouble with the law.
If you really want to find out more though, you can always try a few nmap scans.
nmap --traceroute 192.168.2.0/24
nmap -sV -A 192.168.2.0/24
nmap -O 192.168.2.0/24
More information should help you better pinpoint what kind of ...
7
Pay for another cheap VPS and install nmap, w3af, etc and any other tools there. Then you SSH in and run your tests. You could also schedule the tests to happen automatically and email the results.
This is not a pre-made service, but it does accomplish what you've asked for with a handful of tiny scripts, done more cheaply and with more control than a paid ...
6
I have a few anecdotes I’d like to share pertaining to the “A network vulnerability scanner in a special way?” question above.
Before jumping in though I’d like to note that for most scanning tools speed is the antithesis of accuracy. Speed kills.
Port scanning:
Tweaking nmap for balls out speed (a la –min-hostgroup, --min-parallelism, and ...
6
A number of ways, but none of them easy
A Browser compromise served from an external site where you can ask a user to view a web page from the inside of the network.
Compromising the Router/Firewall/Reverse Proxy box that re-directs the content to the actual internal/dmz web server.
Compromising the internal/dmz web server or db server through injection ...
6
The nmap result "filtered" implies that (if you know there is a host with that IP address) access to the port has been blocked by a firewall or similar, which is dropping the traffic. This is as opposed to the "closed" result which indicates that there is a host on that IP but that there is no active service which responds to nmaps probes.
If all ports on ...
6
you can check the following links NMap OS Detection
and Paper About Nmap Detection
you will find on them different methods used for OS detection By Fyodor the Creator of Nmap and if you want to dig dive you can purchase his book from amazon.
From NMap OS Detection:
...dozens of tests such as TCP ISN sampling, TCP options support and
ordering, IP ID ...
6
You can rent an EC2 server fo only 6.5 cents per hour (11.5 cents for Windows). Then run whatever scanning/testing suite you want.
If you're looking for a third-party security scanning service, there's hundreds of them now that these scans are a required part of PCI compliance. Just Google for "PCI Scanning Vendor".
6
Unicornscan is a tool known for high-speed scanning of large net blocks (e.g. last I observed was sustained 60+mbps internet-based scans).
Nmap in the past definitely had memory consumption issues w/large scans, but I haven't seen those issues in the 5.x/6.x versions when performing 65k ports scans over several /16s.
The memory problems I run into are ...
5
You could use the Metasploit Framework HTTP Virtual Host Brute Force Scanner module.
Nmap is best launched from inside Metasploit. See the Metasploit Unleashed (free training available from Offensive-Security) section on Port Scanning for more information.
If the target IP address is available from the global Internet, then I suggest you also check out ...
5
I've now written my own nmap scan parser. Unfortunately the tools listed in the answers, and the tools Ive tried have not been what I've needed. I also been using some nmap script output aswell which needs to be stored in a way to allow easy aggregating of data. I found that writing my own script was easy enough to deal with my situation.
Thank you for ...
5
[What follows is one possible organization of your ISPs internal network. From my experience (~5 years ago), it is/was relatively common at small/medium US ISPs.]
Your computer talks ethernet to your DSL modem.
The modem is connected to a DSLAM (DSL Access Multiplexer). The DSLAM forwards your traffic (possibly through one or more routers) to a BRAS ...
5
Yes, provided the devices are reachable on the network they can be scanned.
The accuracy of the results (e.g. fingerprinting) is dependant on the platform, software version, running services and configuration.
Example:
$ nmap -A -T4 10.1.1.1
Nmap scan report for 10.1.1.1
Host is up (0.020s latency).
Not shown: 999 closed ports
PORT STATE SERVICE ...
5
Some researchers will not let the public download malware, for obvious reasons, but you might be looking for things like:
php shells
java shells
bots
Metasploit
You also have Metasploit as a resource of open-source HTTP/S shells, stagers, and 'malware' to play with:
http://www.metasploit.com/modules/payload/windows/shell/reverse_http
...
4
Some thoughts I had while reading this question...
Penetration Testing is very dependent on the circumstances. Yes, there are automated tools, but even if they help, they cannot do everything. From my experience, automation gets in the way unless applied to a specific step in the pen-testing/auditing process.
I actually just got interested in OpenVAS. ...
4
If I understand what your asking correctly. Then the limitations are not imposed by the sniffer itself, but are limited by what it can see physically going past on the wire.
What you'll be able to sniff is mainly limited by the placement of your sniffer and the type of network you are on. For example on a network using a Hub you'll be able to see all the ...
Only top voted, non community-wiki answers of a minimum length are eligible
