New answers tagged

3

When I engage in penetration testing, my goals go above beyond finding open ports, to finding "information" that could be used to gain access, or negatively impact the company. If you solely focus on ports (services), or CVE information, you will likely miss common indicators, and information that an attacker will not miss. Usually my penetration tests, ...


0

End point protection may not be sufficient and is often seen as a last line of Defence. You need a WAF solution yes. May I ask specifically what routing challenges do you face within the same subnet? Default gateway issue that may by pass return traffic away from a LB or IPS? To minimise the impact of so many network appliances, you can choose WAF, LB, ...


0

Looks like you already have a Load Balancer that hosts the certificate on behalf of your web servers so inbound SSL can be inspected after they are decrypted. Your load balancer should have a public facing interface to decrypt your own SSL cert so your IPS can inspect. However for outbound, your clients directly connects to a public website which may be ...


2

Yes this is a known issue, you can also route all sorts of attacks to servers via a variety of encrypted protocols using SSL/TLS client-side proxies, or other client side services just to make attacks easier. This does create a situation where on some networks attacks against an http listener would not be effective (detected/blocked by a security control) ...


0

The port might be consumed by rpcbind. What rpcbind does, is described here An excerpt: When a client signs up for a given interface on a particular host, usually with a clnt_create() call, the stub code asks rpcbind on that host a question, something like "on what UDP or TCP port is protocol number X listening?" rpcbind, unlike most other ONC ...


1

NOTE: All of this assumes you are talking about TCP 111 (vs UDP). If you are using a VPN service, you are sharing that Public IP with many customers and being NAT'd somewhere along the way. This Public IP is generally not directly routable to you as a user of the service, as such, there isn't much to worry about. That being said, it's hard to know (...


1

In addition to the book references left in my comment, I think you can set the following as your high-level steps. OSINT (includes recon on the company, DNS records recon, etc) IP Scans Banner checking for vulnerabilities Web application scans & testing (Burp, Nikto, etc) Social engineering of employees Privilege escalation (if required because ...


0

Bandwidth requirements System requirements Training offerings Reporting Accuracy (number of false positives) Time to scan Extra offerings Example: Nessus has web app tool; Nexpose doesn't Vulnerabilities detected (make a vulnerable device have all three scan it)


1

Try looking into Scanlogd http://www.openwall.com/scanlogd/ Also look into psad (Port Scan Attack detector) http://cipherdyne.org/psad/ I havent tried using either of them. Though I am not sure how much better than Snort these will be, I am sure these allow for much higher degree of customization, which may help.



Top 50 recent answers are included