How is possible to determine if someone make requests with tools for pentesting? Is there any linux command?
Is your system publicly accessible?
Yes: Someone is probably scanning it.
No: Are you scanning the server?
- Yes: Well, you've just answered your own question now haven't you?
- No: It's probably not getting scanned.
- I don't know: Wait... what?
- I don't know: You've got bigger problems. And yes, you're probably getting scanned.
Short version : there is no central / unique command to check this by default on linux
.. but you could rely on several tools, depending on the kind of scanning that you would like to find :
- Fail2ban to parse log file (ssh server, web server, ftp, vpn, etc.) in order to find any brute force / irregular login attempt (and trigger some firewall rules)
- On network level, you could use an NIPS/NIDS solutions (Network Intrusion Prevention System / Network Intrusion Detection System) like snort. For the network, you could also use some iptables rules to detect an ongoing scan (like this one)
But, like every cat and mouse game, there are lots of possibilities for the attacker to avoid your iptables rules (reduce speed, random port scanning, increase source ip, etc.). One good way to handle this would be to have a strict control on opened ports (control IN and OUT flow, restrict access, etc.)
If you are running a web sever, you might also want to set up a honeypot in your web application and trap automated scans. This can be done by configuring a section of your site, and disallow it in robots.txt. Any automated scans will ignore this, and will actually try to scan it. Any IPs accessing the disallowed area can be blacklisted using fail2ban for example.