Tag Info

New answers tagged

6

You can pass in the -p- flag as specified in the nmap help page. For example, nmap -p- 192.168.1.1 Another option would be to pass in the explicit range you want with the -p flag. For example, nmap -p 1-65535 192.168.1.1


5

Use the -p command line parameter, for example: nmap -p 1-65535 192.168.1.150 The above would result in a full scan from port 1 to port 65535 against IP 192.168.1.150.


1

SPF (Smartphone Pentest Framework) is one of the only ones I know of that are open source. Core Impact has some mobile testing modules but Core Impact is very expensive. There is Zimperium's Anti which gobbled up dSploit that performs security audits, and reading-wise, Tripwire has a decent article about pentesting mobile devices. In the end though, Mobile ...


3

It is best to plan out and control each URI (params or not) sent to the active/passive scanning engine. The target analyzer in the engagement tools (typically selected from the Target sitemap tab as "Analyze target") is a great place to select parameters and then "send to Intruder". Typically, you can customize your fault injection strategies in Intruder by ...


5

The first thing to note here is that banner grabbing is an error prone way to check for vulnerabilities in a lot of cases (as OS vendors backport security fixes without updating version numbers). Nessus as an example will try and work around that, but it's not foolproof. The best way to address checking your security with scanners is to get them to do ...


2

This sounds very much like security by obscurity to me. You are trying to hide the vulnerability from automated scanners. While such a measure might throw off simple scans, it does not actually address the actual problem. You would still have to keep up to date with patches to secure your server. As you have mentioned, it might create a false sense of ...


1

Make sure that these attempts won't become a DoS attack when you're under load. Attempting to access a phpMyAdmin page should fail quickly when it's obviously a vulnerability scan (especially if you don't actually use it). Some kind of blacklist of shady GET parameters would do the trick.


2

TLDR: Scan your systems first and build & configure them to be secure. Then continue scanning your systems for vulns and signs of breaches, and build a secure lifecycle. The scans demonstrate that someone, somewhere, is trying to learn about your systems ostensibly to break in. Assuming that you (and your organization) value the servers and/or what they ...


20

I ignore them. There will always be compromised systems continually scanning the entire Internet for arbitrary vulnerabilities. Trying to block them is no more effective than spitting into the wind. You'll get far more value out of focusing on the security of your servers and applications, and keeping an eye out for attackers who seem to specifically ...


1

Im not very talented at coding but used the basics of creating a shell script and printing out outputs to check for configuration standards and write them to a text file. Ive tried to show expected/desired output and then what the output is. You can get the document from CIS here or you may need to fill in a form to get it ...


2

In general, DISA STIGs are more stringent than CIS Benchmarks. Keep in mind that with STIGs, what exact configurations are required depends on the classification of the system based on Mission Assurance Catagory (I-III) and Confidentiality Level (Public-Classified), giving you 9 different possible combinations of config requirements. CIS usually have a Level ...


2

You can search within metasploit using the search command for example : msf>search ms08-067 you can also search by the name of the program that has a vulnerability using: msf>search name:windows http://www.offensive-security.com/metasploit-unleashed/Msfconsole_Commands#search


41

What are the strengths of each team member that I will work with regularly? (i.e. programming, linux, networking, regulations, etc.) Where is our documentation? You hopefully have a wiki, a knowledge base, or set of documents somewhere that explain your processes and policies. If you don't, be a hero and get started on one. What are the current projects the ...


2

Here are some important considerations: What is the reason that you're hardening against a given benchmark or guideline? Are you going to be audited? Is there a preferred route or route the your auditors are more familiar with? What tools will you use for self auditing? Do those tools have polices or plugins to audit your system against a given ...


2

One difference is the ease to find a reliable and automated tool to check for compliance. I believe Nessus has templates available for most of the ones you have listed, but some are dated. In any case, I'd choose one that makes it as easy as possible for you to check and stay in compliance.



Top 50 recent answers are included