Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [network-scanners]

Programs that map out a network to figure out which computers and services are available to be exploited.

Filter by
Sorted by
Tagged with
19 votes
1 answer
27k views

Nmap - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why Nmap decides to tell ...
Ryan B's user avatar
  • 193
13 votes
2 answers
81k views

Nmap through proxy

Using the following command: nmap --proxy socks4://*.*.*.*:25074 -sV -O --reason scanme.nmap.org I'm not sure if nmap is really using the proxy specified Had an idea of scanning "localhost" or "127....
SilverShadow's user avatar
31 votes
5 answers
13k views

How do you deal with massive port scans?

This morning I was looking through firewall logs and saw there were about 500 packets marked as port scan. The scanning range was from 1000-1200 5000-5200. The IP address is 85.25.217.47 which seems ...
PaddyKim's user avatar
  • 479
6 votes
1 answer
11k views

Scanning private IPs from outside network

Is it possible with Nmap (or other tool) to scan a range of private IPs (let's say 10.0.0.0/8) but being outside any private network (using those IPs) ?
aurelien75000's user avatar
5 votes
1 answer
4k views

How does this shellshock scan work?

My server is obviously up to date and not vulnerable to shellshock exploits. However I am still curious to know how the following shellshock scan work: /var/log/apache2 # cat access.log | grep bash ...
augustin's user avatar
  • 185
14 votes
3 answers
6k views

Nessus vs third-party scans

As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
sysadmin1138's user avatar
  • 2,053
27 votes
4 answers
4k views

Web sites executing local port scans: Is this coming from a library? Can it be blocked?

I recently read a piece by an infosec analyst who observed ebay.com doing a local port scan. I could not believe my eyes, but it was quickly reproduced by me (see below for my observation). I surfed ...
Jonesome Reinstate Monica's user avatar
16 votes
5 answers
286k views

Unknown MAC address connected to router

I found an unknown MAC address connected to my home router. How would I figure out what OS the IP or MAC address is running?
Sean's user avatar
  • 411
12 votes
2 answers
3k views

Malware known to use port knocking to evade detection by network scanners?

Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
sdanelson's user avatar
  • 1,287
4 votes
2 answers
5k views

What is the purpose of subdomain enumeration?

There're a number of security tools out there that enumerate the subdomains of a given domain. I wonder: What's the purpose of that in terms of security / hacking? Is there any way to do that other ...
Oskar K.'s user avatar
  • 149
4 votes
2 answers
3k views

Is it possible to defeat the OS detection capabilities of network scanning tools?

Network scanning tools such as nmap have the capability to infer operating system version based upon lower-level system details. EG: TCP/IP stack behavior, etc. Are there any known methods to trick ...
Justin Ethier's user avatar
3 votes
2 answers
6k views

nmap - Difference between "Filtered" and "Admin-Prohibited"

I am a rather new user to nmap. By using some Google-Fu, I am still not able to ascertain what is the criteria used in order to distinguish "filtered" ports from "admin-prohibited" as they both seem ...
Alessandro's user avatar
-2 votes
2 answers
2k views

How do Hackers and Security Researchers Scan The Internet For Vulnerable Servers and Devices? [closed]

I would like to know how Security Researchers and hackers scan the internet to find vulnerable devices. For example in this article here, what sort of request/packets are those researchers sending to ...
J.Paddock's user avatar
48 votes
5 answers
8k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
atdre's user avatar
  • 19.1k
14 votes
5 answers
30k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
py_script's user avatar
  • 781
13 votes
4 answers
1k views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks: Is the presence of wireless access points tested for by using a wireless analyzer at ...
user avatar
13 votes
5 answers
36k views

Is there a nmap command to get the top # most common ports?

I understand nmap by default scans the top 1k 'most common' ports (-F reduces to 100) I understand it gets these 'most common' ports based on the nmap-services file, specifically the frequency (3rd ...
gregg's user avatar
  • 293
12 votes
4 answers
3k views

Powerful security tools to use in penetration testing

I want to ask you about some good security tools you've used or heard about, please let us know the ability in every tool and the difficulty to use it and which is the best situation to use this tool ....
Mohamad Alhamoud's user avatar
11 votes
4 answers
25k views

Filtered ports - What exactly filters them?

By the NMAP definition, unfiltered ports are the ones which cannot be determined to be open or closed since packet filtering prevents its probes from reaching the port. (ISBN 9780979958717 pag. 77) ...
user avatar
11 votes
1 answer
9k views

How can a webpage scan my local, internal network from the Internet?

http://webkay.robinlinus.com/ It was on Reddit. In the middle is a Scan My Computer button. Yeah, I clicked it. It already knew my internal IP anyway without my permission. But I was never ...
johnny's user avatar
  • 641
10 votes
5 answers
42k views

Increase speed in nmap UDP scan?

How can I get nmap quicker in scanning UDP ports? This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
asdf's user avatar
  • 239
9 votes
6 answers
26k views

How to bypass Nmap blockage?

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside? Also, does blocking nmap on a network provide any security? ...
marcoo's user avatar
  • 894
9 votes
4 answers
8k views

nmap showing unknown IPs on private network

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
fduff's user avatar
  • 725
8 votes
3 answers
1k views

What are some instant red flags when scanning an network with nmap

When doing an Nmap scan from an external network, what open ports should be an instant red flag? For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
Lone Ronin's user avatar
8 votes
2 answers
23k views

Port scanning legal or not? [closed]

Is port scanning legal ? In which countries ? my option : I think port scanning is like a short-walk( or a long-walk) in the neighbourhood, just curious about neighbours are up to. I think that ...
Stelios Joseph Karras's user avatar
8 votes
2 answers
8k views

Scanning my network with NMAP

Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
Daniel's user avatar
  • 135
7 votes
1 answer
4k views

How does OS detection work in practice?

I was wondering how OS detection really works on Nmap. I know it is about to send different tcp probes to see how the target machine responds to them. But what kind of probes would distinguish a ...
Rox's user avatar
  • 801
7 votes
1 answer
378 views

Port Scanning - States definition

I am currently reading the "NMAP Network Scanning" book by Gordon Fyodor Lyon. On page 77 there is a description on how NMAP categorizes the ports based on host's responses (or not). What would help ...
user avatar
6 votes
5 answers
6k views

What are the best pratices to avoid my server being port scanned

The title probably says it all. I just want to know the best techniques to avoid having a port scanner detecting open ports on my server. I'm using a Linux distro as my OS (Ubuntu Server). Please, don'...
My kutje's user avatar
6 votes
4 answers
16k views

what scanning tools are unlikely to set off network IDS?

What network scanning tools have a stealth option to avoid detection?
Karmic Catti's user avatar
4 votes
3 answers
392 views

packet sniffers and segments

Just curious why most packet sniffers are limited to their segment? is it the nature of a gateway to block the attempt outside a subnet? cheers
piagetblix's user avatar
3 votes
4 answers
578 views

What does a switched network protect us from? What does it not protect us from?

There seems to be some misconceptions regarding what a switched network will protect us from, and what technologies/precautions a secure environment requires when segmenting trusted users from hostile ...
makerofthings7's user avatar
3 votes
1 answer
869 views

What is known about the sirefef/zeroaccess malware/botnet?

There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
Duncan's user avatar
  • 503
3 votes
2 answers
8k views

Using Cain and Abel to capture traffic of machine in the same network

I have installed Cain and Able in machine A, which is connected to another machine B via a LAN. Now I want to analyze all the traffic of machine B. Is this possible by installing Cain and Abel on ...
Ashwin's user avatar
  • 1,657
2 votes
3 answers
13k views

Which tool (apart from nmap) can I use to scan a range of IPv6 addresses? [closed]

When I try to use nmap: # nmap -sP -6 FE80::1-234 [...] Failed to resolve given IPv6 hostname/IP: FE80::1-234. Note that you can't use '/mask' or '[1-4,7,100-]' style ranges for IPv6.[...] What ...
seymourbirkoff's user avatar
2 votes
2 answers
3k views

Nmap scanning computers behind a wireless modem [closed]

Let's suppose that I have a router and three computers connected to Internet through that router. When I tried to get the external IP address for each computer, I got the same address. I think this ...
computerSPro's user avatar
1 vote
1 answer
2k views

How to detect a scan on a local machine?

Is there any way to detect a scan on the local machine ( the pc that I'm using with a linux os -ubuntu-) from the network that I'm connected to? I know that for the webservers we could check the ...
Barttttt's user avatar
  • 459
0 votes
2 answers
362 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
Pacerier's user avatar
  • 3,313