Programs that map out a network to figure out which computers and services are available to be exploited.

learn more… | top users | synonyms

1
vote
0answers
11 views

Why is the maximum port range 65535 in the TCP/IP Suite ? [migrated]

My doubt is that - a port is just logical, so why such restriction ? Why can't I have a port of 9924593 or something like that ?
3
votes
2answers
67 views

Nmap through proxy

Using the following command: nmap --proxy socks4://*.*.*.*:25074 -sV -O --reason scanme.nmap.org I'm not sure if nmap is really using the proxy specified Had an idea of scanning "localhost" or ...
1
vote
2answers
71 views

Is an ARP scan stealthy?

If you want to discover the live hosts on your subnetwork how can you exploit the ARP protocol in order to scan stealthily? Would an arp scan be picked up as suspicious activity? Could you spoof ...
0
votes
3answers
123 views

Why is UDP port scanning slower than TCP port scanning?

I can't seem to find an answer for this. Any suggestions?
0
votes
1answer
58 views

What could an attacker do with informations about devices in my local network?

If a malicious website would scan my local network (via WebRTC) for devices, what could the attacker do it with it? Does it need to be in the same WIFI-Network in order to login to a service? (for ...
2
votes
1answer
82 views

Scanning private IPs from outside network

My question is only for informative purposes: Is it possible with Nmap (or other tool) to scan a range of private IPs (let's say 10.0.0.0/8) but being outside any private network (using those IPs) ? ...
6
votes
1answer
103 views

Triangulate a mac adress

Last Sunday my iMac was stolen by a burglar. On Monday it showed up on 'find my mac'. Good police work and a lot of luck ended up in me retrieving my device that was on a location more than 50 meter ...
1
vote
2answers
37 views

How does Nessus know which services are running in a host?

I'd like to know how does a vulnerability scanner such as Nessus know which services are running, once it has scanned the ports. I don't want to know the steps to do this in Nessus, I want to know ...
1
vote
2answers
86 views

How to evaluate a wireless network risk level?

When travelling everyone has to use structural wireless networks (managed by airports, hotels, museums, restaurants…). Some of these only open (80|443)/tcp/ip once you have provided an E-mail or ...
2
votes
1answer
48 views

How to perform an idle scan against a target using Nmap with a list of zombies? [closed]

I want to perform port scan against a target but the firewall at the target only allows traffic to the ports through certain IP address/machines. I tried to perform an idle scan in Nmap but it only ...
3
votes
1answer
55 views

Persistent back door using Netcat

I have found the following command several times in one of the linux servers during an assessment: nc -l -p 3030 -e /bin/bash This enables a hacker to gain control over this sever via bash. By ...
0
votes
2answers
115 views

How to scan for ports opened by TCP/UDP sockets with nmap or any other tool?

I'm new to nmap and I've been digging with it lately to scan some devices on the current LAN for ports opened by socket programs which are running. First I ran a simple UDP server on my machine on ...
27
votes
4answers
4k views

How do you deal with massive port scans?

This morning I was looking through firewall logs and saw there were about 500 packets marked as port scan. The scanning range was from 1000-1200 5000-5200. The IP address is 85.25.217.47 which seems ...
4
votes
3answers
165 views

Nmap showing ISPs router's DNS port in addition to target's ports

Whenever I do nmap scans my ISP router DNS port like the following. This happens for every IP or target. $ nmap -T4 -A -v stackoverflow.com PORT STATE SERVICE VERSION 53/tcp open domain ...
0
votes
1answer
38 views

Network traffic analyzer for Video [closed]

I am going to be streaming video on an open network. I need the simplest network traffic analyzer that would enable me to know when the video is stopped and started from another system on the same ...
1
vote
1answer
219 views

Nessus web client: Error 401 invalid credentials [closed]

Previously I used to scan sites using Nessus web client, but when I tried to login with the same credentials I am able to see a401 (Invalid Credentials) error. I have restarted the service nessusd, ...
2
votes
1answer
56 views

Finding Targets in Foreign Network

Say you popped into a network after exploiting something, and you are looking to further infiltrate the network. When theorizing in my head I realized the local ip's can change themselves. So doing ...
0
votes
1answer
40 views

Resuming an interrupted nmap scan:

I need to: --resume <filename>: Resume an aborted interrupted scan. But I didn’t: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, ...
-4
votes
1answer
31 views

network port registry

I am planning to build an app which gives information about the network port and the service name for non-opensource based products. Is there a legal implication of building such apps? because someone ...
4
votes
2answers
115 views

Stop Nmap scan and preserve XML output

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
1
vote
2answers
90 views

Is a Windows (fresh installation) 7 really this safe against NMAP or am I missing something?

I am playing with NMAP in my small private network performing port scanning. So far I went through scanning the following OSs (Unaltered new installations - Meaning no extra software installed!): ...
-1
votes
1answer
267 views

Netdiscover running on NAT interface not finding IP addresses on host-only network?

I am practicing penetration testing techniques using Kali Linux (most recent distro) and various vulnerable virtual machines (DVWA, Metasplotiable). My attack and targets are all running via ...
2
votes
1answer
85 views

Hiding packets, requests, traffic from my PC through Ethernet connected to workplace network

Before everyone jumps on the bandwagon, as I so often see, of saying you shouldn't do anything on a workplace network that is to be done annonymously on your own home network, I want to know an actual ...
1
vote
1answer
63 views

What local ethernet-accessible resources can be accessed on a PC through a USB cable?

Clarification: this is about scanning the network resources on computer B from computer A in a situation where: Computer A is connected to Computer B through a USB cable Computer A has some scanning ...
2
votes
0answers
111 views

nmap OS scan showing DD-WRT when I'm not running it?

This weekend, I set up pfSense on a spare box that I had sitting in the garage. It seems cool and powerful, but I haven't messed with it much yet. Was doing some basic nmap scanning from work against ...
2
votes
0answers
49 views

Does hping support FTP Bounce scanning?

Does hping support FTP Bounce scanning? I googled it, but I couldn't find its command, so I think it didn't support it. I just find command for nmap not hping.
6
votes
2answers
780 views

Discovering IP or Mac address of mobile devices passing by.

Is it possible for someone to discover the IP and/or MAC address of my mobile device, even if I do not attempt to connect to their network?
2
votes
2answers
90 views

Legally port scanning (Whitelist)

I am attempting to set up a security vulnerability scanning server. I have several customers interested in using it to scan their systems. I will be port scanning and carrying out intrusion detection, ...
2
votes
2answers
39 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...
6
votes
1answer
265 views

Port Scanning - States definition

I am currently reading the "NMAP Network Scanning" book by Gordon Fyodor Lyon. On page 77 there is a description on how NMAP categorizes the ports based on host's responses (or not). What would help ...
0
votes
1answer
44 views

hping3 - Ignoring not responding ports

Is there a way to ignore the not responding ports in the scan report? james@ahoi:~$ sudo hping3 -q --scan 1-1000 -S 192.168.0.1 Scanning 192.168.0.1 (192.168.0.1), port 1-1000 1000 ports to scan, use ...
10
votes
4answers
1k views

Filtered ports - What exactly filters them?

By the NMAP definition, unfiltered ports are the ones which cannot be determined to be open or closed since packet filtering prevents its probes from reaching the port. (ISBN 9780979958717 pag. 77) ...
2
votes
1answer
169 views

NMAP DNS Resolution

By default NMAP does reverse DNS resolution for a given IP which responds to the host discovery probes. My question is, what are the benefits of getting the host name when performing a network scan?
3
votes
2answers
693 views

Scanning multiple subnets with nmap to determine open services & ports

First off, I know nmap's documentation is very powerful and I have been reading through it rather extensively. I will be scanning externally, with permission, to determine ports & services that ...
4
votes
3answers
1k views

Enumerate the subdomains of a given domain - what's the point?

There're a number of security tools out there that enumerate the subdomains of a given domain. I wonder: What's the purpose of that in terms of security / hacking? Is there any way to do that other ...
0
votes
2answers
88 views

Client misunderstanding nmap [closed]

My client wants their public facing IP addresses to be secure, but thinks that running nmap port scans will draw attention from hackers. To settle this once and for all, what do you say?
1
vote
1answer
88 views

What this type of attack called? (gaining peripheral information)

When the intruder looks at the transmitted data and finds information about the sender and the receiver of the data or other peripheral information that won't help him hack the system but know more ...
0
votes
1answer
202 views

Snort - Rule: Alert all php requests

I am trying to understand writing rules for snort. Further goal is detection of sql injections like here. I've read the documentation of snort rules and created this rule: alert tcp any any -> ...
3
votes
1answer
220 views

Automating NIKTO scanner

I am working on NIKTO automation. I have a text file contains list of IP addresses along with their ports open. I have already made nikto script. Script functionality - it takes IP addresses and then ...
2
votes
2answers
759 views

nmap detects opened port but can't connect with telnet

I've made an scan to one single IP with nmap and it reports that the port 65301 is opened, and even it detects that it's maybe the service pcanywhere. sudo nmap -p 65000-65535 -sV x.x.x.x Starting ...
2
votes
2answers
64 views

Any way to circumvent a 'filtered' response on NMap?

I know that a filtered response on NMap means that the firewall dropped the packets or that NMap just didn't receive a response, but is there any way to circumvent this? Is it possible that the ...
4
votes
4answers
1k views

How to run nmap HTTP scripts on unusual ports

How can I make nmap run the HTTP-scripts on ports that are unusual for HTTP, say TCP port 123? On something like nmap -n --script="http* ..." -p123 target nmap does nothing except to check that port ...
1
vote
1answer
146 views

Caching ARP to avoid L2 detection on switched network?

Using nmap on a very large (/16) switched network can lead to an excessive number of ARP requests which can be detected by simple ARP counters listening to broadcasted ARP requests. Is there a way ...
1
vote
2answers
289 views

How do I check for inside-out open port? [closed]

I'm inside a corporate network and I want to assess which ports are open for outbound connection. There are such tools that do this test? I remember that years ago I used a website which performed ...
1
vote
1answer
98 views

Block An IP Address Scanner On Mac [closed]

I'm working on an prototype that can spot network scanners, which is working and it spits out the IP address of the scanners, but I need to block them now. Is there any way to block an IP address ...
1
vote
1answer
2k views

Tracing stolen android tablet via MAC address [closed]

I lost my tablet , but I can see that the tablet is connected to the network on my router: :So I know the MAC address but I am unable to trace my tablet using this information and I am running out of ...
8
votes
1answer
414 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
1
vote
1answer
4k views

Router detecting constant ack flood attacks and port scans

I first noticed this yesterday in my logs - while I was configuring the router settings, so I don't know how long it's been going on. What should I do? I reconfigured my router with more secure ...
5
votes
2answers
954 views

Why would a stealth scan attract more attention than a connect scan?

I'm reading an Information Security book and am faced with the question: Why may nmap stealth scans(SYN) attract more attention than simple connect scans(TCP connect())? Why might it be?
1
vote
0answers
411 views

Indicator of Compromise Scanners IOC [closed]

I am looking for a scanner that can look for indicator of compromise. Have research some products in the market that could do this, for e.g. Fireeye HX series. However these products seems to be very ...