Hot answers tagged

46

I ignore them. And if you have a reasonable security posture, you should too. Your servers should have no ports open to the general public other than those that you use to serve the general public. For example, your web server should have open port 80, 443, and maybe 22; everything else should be SSH-tunneled or otherwise VPN'ed if you need to connect to ...


27

All the tracerouting tools rely on the following principle: they send packets with a short life, and wait for ICMP packets reporting the death of these packets. An IP packet has a field called "TTL" (as "Time To Live") which is decremented at each hop; when it reaches 0, the packet dies, and the router on which this happens is supposed to send back a "Time ...


26

Unless you've got nmap configured not to perform host discovery (-PN or -PN --send-ip on the LAN), if it is indicating that all ports are filtered, then the host is up, but the firewall on that host is dropping traffic to all the scanned ports. Note that a default nmap scan does not probe all ports. It only scans 1000 TCP ports. If you want to check for any ...


23

The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as Loki (or the older Yersinia tool), intrace, Chiron, mana-toolkit, mitmf, bettercap, and Responder.py that must be run outside of the Metasploit framework, but so many ...


23

First of all go to the police. Tell them your story, tell them you sent them a copy of your passport. Alert your bank and credit card suppliers as well. The biggest problem with sending a copy of your passport is that they can easily do identity theft. I wouldn't use an AV for your computer, I would just re-install your computer from scratch. As we ...


18

I have a few anecdotes I’d like to share pertaining to the “A network vulnerability scanner in a special way?” question above. Before jumping in though I’d like to note that for most scanning tools speed is the antithesis of accuracy. Speed kills. Port scanning: Tweaking nmap for balls out speed (a la –min-hostgroup, --min-parallelism, and friends)...


18

I don't believe in enumerating badness. If you have infrastructure sitting on the internet it's going to get scanned all the time by numerous IPs. For example, I created an AWS app that turns up spot instances, scans blocks of IPs from a list, and turns them off once the results are shipped to the master server. If I was scanning your range daily you ...


16

Taking into consideration the fact that you are doing these scans in the context of PCI-DSS compliance, your value-add in relation to compliance can be summed up by my personal favorite saying: AviD's Law of Regulatory Compliance: "PCI compliance reduces the risk of the penalties of non-compliance". In other words - the value-add of having an ...


16

The way attackers go about portscans is to first target those with known exploits or commonly weak protection. The list at http://www.iss.net/security_center/advice/Exploits/Ports/default.htm is one typical list. Sure, you get some scanners who go for the entire port range, but as that is far less effective, this list is going to be a pretty good ...


16

First of all you need to understand how things actually work, so take a look here: NAT. This is how your router currently makes internet communication for all your hosts possible. So, everything is behind a NAT, and that's exactly why you can't access any host using your public IP address. If you want a machine inside your private home network to be ...


15

You may be getting zero value-add. I suggest finding a new vendor. And when soliciting potential new PCI ASVs, ask them what they do, questions like: Which vulnerability scanners will you use to assess our systems? Do you use the commercial or free versions of the vulnerability scanners? We use Nessus internally, what more will you do to bring ...


15

Definitely. See http://nmap.org/svn/nmap-services for a listing of ports and the expected chances that they'll be open. Nmap offers two options that relate to that: --top-ports <number>: Scan <number> most common ports --port-ratio <ratio>: Scan ports more common than <ratio> Other methods include ports < 1024, listed in an /...


14

Nessus is very good at what it does, but a 'proper' security scanning vendor would not just deliver you a Nessus report. At the very least, you need to go through the report and validate to remove false positives - you probably do this internally anyway, but unless you request it a vendor may not. There is a major disconnect in what customers expect and ...


13

My guess is that you aren't seeing those open ports is because of the default behavior of nmap to only scan the 1.000 most commonly used ports. If you want to cover all ports you need to explicitly state that you want to scan all ports with the -p parameter. So say I want to scan from port 1 until 5037: nmap -sS 127.0.0.1 -p1-5037 To view which process ...


13

Well, open port does not necessary mean that anyone can enter. If you have an open port on a router/modem with nothing listening behind, then there is nothing to compromise. Of course, this won't let you work from outside your home either. For this to happen, you have to put the VPN server and make it listen to this open port. What are the ...


12

I think that both projects will have their strong and weak points. At the moment I'd say that Nessus appears to have a wider range of plugins available and arguably a better user interface than the standard OpenVAS client/server implementation. In addition Nessus seems to have widened their original focus in unauthenticated vulnerability scanning to ...


12

Sebastein Jeanquier's Master's thesis section 7.1, "Port Knocking in Malware (Backdoors)", states that SAdoor and its predecessor cd00r both used this feature. Tony Bradley writes in About.com that "malware writers of the world have unfortunately ... begun to adopt this technique for opening backdoors on victimized systems" but doesn't provide any examples.


12

A Brief Note On Banner Grabbing The first, biggest, hurdle one faces when getting into vulnerability assessments or penetration testing is understanding the limitations of whatever detection mechanism you're using. Like Rory said, you didn't really say how you got the presented list of ports, however it looks like an NMAP scan using banner grabbing. This Is ...


12

If you can send packets to the target machine, use nmap -O, which provides OS fingerprinting. If you can eavesdrop/intercept network traffic with the target machine, use pof, a tool for passive OS fingerprinting. You didn't provide much information about what are your constraints or why the standard tools (like nmap or pof) didn't work for you. Therefore, ...


11

Unicornscan is a tool known for high-speed scanning of large net blocks (e.g. last I observed was sustained 60+mbps internet-based scans). Nmap in the past definitely had memory consumption issues w/large scans, but I haven't seen those issues in the 5.x/6.x versions when performing 65k ports scans over several /16s. The memory problems I run into are ...


11

To easy your concerns, I recommend looking into the following interesting article: http://research.microsoft.com/pubs/167719/whyfromnigeria.pdf Basically, the scammers send out an immense number of e-mails, and they get money only from a very small percentage of targets. The number of people who reply to them, but figure out half way through that it's a ...


10

Try SET from Social-Engineer.org. Whole site is a great resource.


10

In Addition to @RoryAlsop 's answer, the NMAP project maintains a list of ports along with the likelihood that it will be found to be open here,


10

Nmap, like any adversary tool, can be fingerprinted by Intrusion Detection Systems (IDS). As such, any of Nmap's techniques are generally classified as an attack by these modern tools -- especially Next-generation Firewall (NGFW) technologies, or the bleeding-edge equivalents of NGFWs. Additionally, information sharing alliance centers (ISACs) are sharing ...


10

What's the purpose of that in terms of security / hacking? The hostname(s) of resources can provide valuable information to narrow the scope of an attacker's task by providing information about available machines and resources. The underlying space of network (IP) addresses is sparsely populated (and IP:port combinations even more so), so narrowing down ...


9

A recent test of Nessus and OpenVAS shows the benefits in using multiple scanners due to the difference in the signatures: Nessus, OpenVAS and Nexpose VS Metasploitable (blog post by Peter at HackerTarget) Out of 15 known security holes in the system used for the test, 4 were spotted by all four tested tools (Nessus, OpenVAS, Nexpose and some Nmap scripts); ...


9

Check out The Penetration Testing Execution Standard (PTES). And in particular: Intelligence gathering This video may interest you as well: Finding general information about an organization via the web (from the show notes he covers how to use Backtrack 5 to do a lot of reconnaissance type work) Popular tools for quick (i.e. just interested in IPs) ...


9

I'm assuming that what you're doing is related to ethical pen. testing. If you have no legitimate control over your target, you have 3 options Haxoring your target: Attempt to gain access to the target machine by exploiting some vulnerabilities in the machine itself, or the operator of the machine. Big Man in the Middle (Between your target and the servers ...


8

I couldn't agree more with @spinkham's answer. That is the best answer. To add to @ygjb's power tool list, on the web app side, these tools are excellent for extracting data First use the Burp Suite to identify points of opportunity - this tool can be challenging to gain proficiency in if you're new to how web apps work Powertools to help you ...



Only top voted, non community-wiki answers of a minimum length are eligible