Tag Info

New answers tagged

1

I used something like this (powershell script) recently to determine simply if the server receives a response back. i know it's not nmap but it is quick and easy. $erroractionpreference = 'silentlycontinue' $import = import-csv 'config-network device.csv' $collection = $() foreach ($HostName in $import) { $status = @{ "ServerName" = ...


4

Consider this command: nmap 127.0.0.1 -T4 -p 111 -sT -oG - | awk | awk '/^Host: .* Status:.*Up/ { print $2" UP" }' A common pattern using shell scripting is to use grepable output. Use the flags "-oG -", the final dash is to redirect output to stdout. Output from "-oG -" in this example outputs the following when I ran it at my own server: Host: ...


3

I would like to remind you that FIN scan does not work on windows operating systems. Furthermore, the existence of firewalls can prevent the scan from returning the correct result. It will work fine on Mac and Linux. (Unless the port has been filtered by a firewall) I tested with Kali Linux-Kernel 3.14 and it works. root@kali:~# nmap -sF 127.0.0.1 -p 80 ...


0

Given that you're in VPC, I would recommend auditing your security group and network ACL configuration using a tool like Security Monkey: http://techblog.netflix.com/2014/06/announcing-security-monkey-aws-security.html If you're interested in using nmap for this, it has a diff feature which may be of interest. I usually use a modified version of this script ...


1

You might try a network monitoring solution like OpenNMS, Zenoss, Observium, or NeDi. They will do more than just discover new systems and open ports.


8

If / is rendered by a cgi script, that script would be called with the User-Agent in an environment variable called HTTP_USER_AGENT. bash would look at all environment variables starting with () { to find function definitions and execute the function definition. In your example the function definition would then be: HTTP_USER_AGENT() { :;} Due to the bug ...


3

The values are just URL encoded, you can decode the query string using this: http://meyerweb.com/eric/tools/dencoder/ The first one: In this case the actual path is encoded. %63%67%69%6E/%70%68%70 -> cgin/php The actual query string decodes to: -d aluon -d mod -d suhon=on -d uncts="" -d dne -d auto_prt -d cgi.force_redirect=0 -d t_=0 -d ut -n The ...


6

It's not scanning for the "shellshock" exploit. It's scanning for an older exploit where a poorly-configured server leaves a copy of the PHP interpreter in the CGI directory, permitting remote execution of arbitrary code.



Top 50 recent answers are included