New answers tagged

1

You can decode this by using the following shell command: echo "%2D%64+%61%6C%6C" | sed "s@+@ @g;s@%@\\\\x@g" | xargs -0 printf "%b" This is basically URL-encodes string which is used in a query part of a URL. Each part with a percent (%) sign followed by two hex digits and spaces encoded as plus (+) signs.


3

When I engage in penetration testing, my goals go above beyond finding open ports, to finding "information" that could be used to gain access, or negatively impact the company. If you solely focus on ports (services), or CVE information, you will likely miss common indicators, and information that an attacker will not miss. Usually my penetration tests, ...


0

Set "portrule = shortport.http" Open http-enum.nse to find the relevant line. Read the documentation here: https://nmap.org/nsedoc/lib/shortport.html


2

1) Nmap Timeout I do not know how Nmap determines that but I'm fairly sure that it takes respond time into account while deciding if the target port is open or not. Depending on various factors, a port may not be able to respond immediately so maybe Nmap decides that the port is closed. Lets say that the threshold is 100ms. At first Nmap gets a response in ...


0

The port might be consumed by rpcbind. What rpcbind does, is described here An excerpt: When a client signs up for a given interface on a particular host, usually with a clnt_create() call, the stub code asks rpcbind on that host a question, something like "on what UDP or TCP port is protocol number X listening?" rpcbind, unlike most other ONC ...


1

NOTE: All of this assumes you are talking about TCP 111 (vs UDP). If you are using a VPN service, you are sharing that Public IP with many customers and being NAT'd somewhere along the way. This Public IP is generally not directly routable to you as a user of the service, as such, there isn't much to worry about. That being said, it's hard to know (...


1

In addition to the book references left in my comment, I think you can set the following as your high-level steps. OSINT (includes recon on the company, DNS records recon, etc) IP Scans Banner checking for vulnerabilities Web application scans & testing (Burp, Nikto, etc) Social engineering of employees Privilege escalation (if required because ...


0

In nmap, you should know the following: When you want to run a protocol-specific NSE script, such as pgsql-brute (or the generic brute NSE script), nmap will need the version information to match the port or be able to detect it, i.e., nmap -v --script brute -sV -p 5432 <ip> or nmap can skip version detection if the + character is utilized -- thus ...



Top 50 recent answers are included