Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I had a debate recently regarding whether conducting an Nmap scan through a 3rd party such as pentest-tools.net is considered active or passive. I argued that it is passive since there is no link between the scan and myself.
On the other hand, my friend argued that Shodan and Censys are considered passive which to me is the same as an external Nmap scan.
Is an external Nmap scan active or passive?
I tend to take a legal eye when I look that this (IANAL).
An NMAP scan of a target will always be active regardless of who performs the scan. Just because you shift the scanning responsibility to a third party doesn't change that fact.
You might be able to argue that you retrieved the scan data passively, but I would argue otherwise based on the post. From a legal stand point, it doesn't matter if you proxy the attack, if the attack as illegal it would just add another defendant. Would you consider C&C agents for something like a DDOS attack as passive? I sure as hell wouldn't.
It would however be different if you came across scan data on a third party site. You would have to prove that you didn't initiate the attack. From a legal perspective, you simply possessing scan data that was widely available (arguable), damning or not, would be different.
The first question to ask is, "Why does it matter?" What is the reason for needing to label something "active" or "passive"? If the answer is that your Rules of Engagement place some restriction on "active" measures, then you need to improve your rules of engagement to reduce ambiguity about that term.
The action of an Nmap scan is "active" in that it is causing observable effects to the target while it is going on. Shodan and Censys searches can be considered "passive" because they are showing you results of a scan that took place some time in the past; the scan itself was "active," but retrieving the results is "passive." From a legal standpoint, launching a scan via a 3rd party can still be linked back to you, because that 3rd party likely has logs of which addresses/browsers requested which scans.
