Tag Info

Hot answers tagged

33

First of all that would entirely depend on the encryption used by the access point. There are several types of possible encryption. Mostly on consumer wireless access points these are: WEP WPA WPA2 WPS WEP Let's first dive into WEP. WEP was the first algorithm used to secure wireless access points. Unfortunately it was discovered that WEP had some ...


22

First of all go to the police. Tell them your story, tell them you sent them a copy of your passport. Alert your bank and credit card suppliers as well. The biggest problem with sending a copy of your passport is that they can easily do identity theft. I wouldn't use an AV for your computer, I would just re-install your computer from scratch. As we ...


15

The way attackers go about portscans is to first target those with known exploits or commonly weak protection. The list at http://www.iss.net/security_center/advice/Exploits/Ports/default.htm is one typical list. Sure, you get some scanners who go for the entire port range, but as that is far less effective, this list is going to be a pretty good ...


15

Taking into consideration the fact that you are doing these scans in the context of PCI-DSS compliance, your value-add in relation to compliance can be summed up by my personal favorite saying: AviD's Law of Regulatory Compliance: "PCI compliance reduces the risk of the penalties of non-compliance". In other words - the value-add of having an ...


14

You may be getting zero value-add. I suggest finding a new vendor. And when soliciting potential new PCI ASVs, ask them what they do, questions like: Which vulnerability scanners will you use to assess our systems? Do you use the commercial or free versions of the vulnerability scanners? We use Nessus internally, what more will you do to bring ...


14

First of all you need to understand how things actually work, so take a look here: NAT. This is how your router currently makes internet communication for all your hosts possible. So, everything is behind a NAT, and that's exactly why you can't access any host using your public IP address. If you want a machine inside your private home network to be ...


13

Definitely. See http://nmap.org/svn/nmap-services for a listing of ports and the expected chances that they'll be open. Nmap offers two options that relate to that: --top-ports <number>: Scan <number> most common ports --port-ratio <ratio>: Scan ports more common than <ratio> Other methods include ports < 1024, listed in an ...


13

If you can send packets to the target machine, use nmap -O, which provides OS fingerprinting. If you can eavesdrop/intercept network traffic with the target machine, use pof, a tool for passive OS fingerprinting. You didn't provide much information about what are your constraints or why the standard tools (like nmap or pof) didn't work for you. Therefore, ...


13

My guess is that you aren't seeing those open ports is because of the default behavior of nmap to only scan the 1.000 most commonly used ports. If you want to cover all ports you need to explicitly state that you want to scan all ports with the -p parameter. So say I want to scan from port 1 until 5037: nmap -sS 127.0.0.1 -p1-5037 To view which process ...


12

Unless you've got nmap configured not to perform host discovery (-PN or -PN --send-ip on the LAN), if it is indicating that all ports are filtered, then the host is up, but the firewall on that host is dropping traffic to all the scanned ports. Note that a default nmap scan does not probe all ports. It only scans 1000 TCP ports. If you want to check for any ...


11

Sebastein Jeanquier's Master's thesis section 7.1, "Port Knocking in Malware (Backdoors)", states that SAdoor and its predecessor cd00r both used this feature. Tony Bradley writes in About.com that "malware writers of the world have unfortunately ... begun to adopt this technique for opening backdoors on victimized systems" but doesn't provide any ...


11

Nessus is very good at what it does, but a 'proper' security scanning vendor would not just deliver you a Nessus report. At the very least, you need to go through the report and validate to remove false positives - you probably do this internally anyway, but unless you request it a vendor may not. There is a major disconnect in what customers expect and ...


11

A Brief Note On Banner Grabbing The first, biggest, hurdle one faces when getting into vulnerability assessments or penetration testing is understanding the limitations of whatever detection mechanism you're using. Like Rory said, you didn't really say how you got the presented list of ports, however it looks like an NMAP scan using banner grabbing. This Is ...


10

I think that both projects will have their strong and weak points. At the moment I'd say that Nessus appears to have a wider range of plugins available and arguably a better user interface than the standard OpenVAS client/server implementation. In addition Nessus seems to have widened their original focus in unauthenticated vulnerability scanning to ...


10

Unicornscan is a tool known for high-speed scanning of large net blocks (e.g. last I observed was sustained 60+mbps internet-based scans). Nmap in the past definitely had memory consumption issues w/large scans, but I haven't seen those issues in the 5.x/6.x versions when performing 65k ports scans over several /16s. The memory problems I run into are ...


10

All the tracerouting tools rely on the following principle: they send packets with a short life, and wait for ICMP packets reporting the death of these packets. An IP packet has a field called "TTL" (as "Time To Live") which is decremented at each hop; when it reaches 0, the packet dies, and the router on which this happens is supposed to send back a "Time ...


10

To easy your concerns, I recommend looking into the following interesting article: http://research.microsoft.com/pubs/167719/whyfromnigeria.pdf Basically, the scammers send out an immense number of e-mails, and they get money only from a very small percentage of targets. The number of people who reply to them, but figure out half way through that it's a ...


9

Check out The Penetration Testing Execution Standard (PTES). And in particular: http://www.pentest-standard.org/index.php/Intelligence_Gathering This video may interest you as well: http://www.irongeek.com/i.php?page=videos/osint-cyberstalking-footprinting-recon#DNS,_Whois_and_Domain_Tools_Finding_general_Information_about_an_organization_via_the_web (from ...


8

I couldn't agree more with @spinkham's answer. That is the best answer. To add to @ygjb's power tool list, on the web app side, these tools are excellent for extracting data First use the Burp Suite to identify points of opportunity - this tool can be challenging to gain proficiency in if you're new to how web apps work Powertools to help you ...


8

I have a few anecdotes I’d like to share pertaining to the “A network vulnerability scanner in a special way?” question above. Before jumping in though I’d like to note that for most scanning tools speed is the antithesis of accuracy. Speed kills. Port scanning: Tweaking nmap for balls out speed (a la –min-hostgroup, --min-parallelism, and ...


8

Switches are not meant for security. A switch differs from a hub in that it observes packets to deduce where each host is, so that a packet aimed at a given host will be written only on the physical cable leading to that host. This is a performance optimization in that it allows more traffic to happen concurrently on a given network. The side-effect of ...


8

Like bonsaiviking said, it probably belongs to a neighbour. Leave it alone and avoid the risk of getting in trouble with the law. If you really want to find out more though, you can always try a few nmap scans. nmap --traceroute 192.168.2.0/24 nmap -sV -A 192.168.2.0/24 nmap -O 192.168.2.0/24 More information should help you better pinpoint what kind of ...


8

Pay for another cheap VPS and install nmap, w3af, etc and any other tools there. Then you SSH in and run your tests. You could also schedule the tests to happen automatically and email the results. This is not a pre-made service, but it does accomplish what you've asked for with a handful of tiny scripts, done more cheaply and with more control than a paid ...


7

Anyone able to use your printer is a vulnerability. This is a resource that should not be exposed to public networks. I suspect that "scanproxy.net" is well... scanning for proxies. Its likely that they connected to an open port and tried to proxy a GET request for http://www.scanproxy.net:80/p-900.htm, but instead this was interpreted as data to be ...


6

A recent test of Nessus and OpenVAS shows the benefits in using multiple scanners due to the difference in the signatures: Nessus, OpenVAS and Nexpose VS Metasploitable (blog post by Peter at HackerTarget) Out of 15 known security holes in the system used for the test, 4 were spotted by all four tested tools (Nessus, OpenVAS, Nexpose and some Nmap scripts); ...


6

A number of ways, but none of them easy A Browser compromise served from an external site where you can ask a user to view a web page from the inside of the network. Compromising the Router/Firewall/Reverse Proxy box that re-directs the content to the actual internal/dmz web server. Compromising the internal/dmz web server or db server through injection ...


6

The nmap result "filtered" implies that (if you know there is a host with that IP address) access to the port has been blocked by a firewall or similar, which is dropping the traffic. This is as opposed to the "closed" result which indicates that there is a host on that IP but that there is no active service which responds to nmaps probes. If all ports on ...


6

you can check the following links NMap OS Detection and Paper About Nmap Detection you will find on them different methods used for OS detection By Fyodor the Creator of Nmap and if you want to dig dive you can purchase his book from amazon. From NMap OS Detection: ...dozens of tests such as TCP ISN sampling, TCP options support and ordering, IP ID ...


6

Yes, provided the devices are reachable on the network they can be scanned. The accuracy of the results (e.g. fingerprinting) is dependant on the platform, software version, running services and configuration. Example: $ nmap -A -T4 10.1.1.1 Nmap scan report for 10.1.1.1 Host is up (0.020s latency). Not shown: 999 closed ports PORT STATE SERVICE ...



Only top voted, non community-wiki answers of a minimum length are eligible