Skip to main content

Questions tagged [network-scanners]

Programs that map out a network to figure out which computers and services are available to be exploited.

Filter by
Sorted by
Tagged with
49 votes
5 answers
8k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
atdre's user avatar
  • 19.1k
46 votes
3 answers
11k views

Does a fake SSH server have any purpose security-wise?

I stumbled upon this sshesame software which appears to imitate an SSH server accepting any username/password, only instead of executing the subsequent shell commands it logs them in a file. What I ...
Dmitry Grigoryev's user avatar
31 votes
5 answers
13k views

How do you deal with massive port scans?

This morning I was looking through firewall logs and saw there were about 500 packets marked as port scan. The scanning range was from 1000-1200 5000-5200. The IP address is 85.25.217.47 which seems ...
PaddyKim's user avatar
  • 479
29 votes
3 answers
65k views

How does "traceroute over TCP" work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve traceroute ...
makerofthings7's user avatar
28 votes
4 answers
29k views

What benefits does Nessus have over OpenVAS?

Nessus and OpenVAS appear to have fairly similar features. Why would you choose one over the other, besides the benefit of commercial support (which isn't available for Nessus Home Feed users anyways)?...
atdre's user avatar
  • 19.1k
27 votes
4 answers
4k views

Web sites executing local port scans: Is this coming from a library? Can it be blocked?

I recently read a piece by an infosec analyst who observed ebay.com doing a local port scan. I could not believe my eyes, but it was quickly reproduced by me (see below for my observation). I surfed ...
Jonesome Reinstate Monica's user avatar
24 votes
3 answers
5k views

How wise is it to use a tool for portspoofing at your server to confuse attackers?

I came across this tool recently https://github.com/drk1wi/portspoof How efficient will it be to use it to confuse hackers doing port scanning? If it's actually going to be pretty efficient, why ...
jerry's user avatar
  • 355
22 votes
7 answers
37k views

Nmap reporting almost every port as open

I have noticed during some assesments when doing a TCP port scan, Nmap will report almost every port as open for a machine. Using for example nmap -sS -PN -T4 target -p0-65535, over 20,000 ports will ...
Sonny Ordell's user avatar
  • 3,596
20 votes
1 answer
27k views

Nmap - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why Nmap decides to tell ...
Ryan B's user avatar
  • 303
19 votes
5 answers
3k views

419 Nigerian scam problem

I fell in a scamming trap. It took me a while to figure it out. Blinded like an idiot. But it is what it is. I can only do as much as I can now. Tell me if there is anything else I should do. After ...
eternalidiot's user avatar
19 votes
6 answers
20k views

Are some uncommon TCP ports scanned less than others?

Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
Brian M. Hunt's user avatar
19 votes
2 answers
124k views

nmap scan shows ports are filtered but nessus scan shows no result

I'm performing an port scanning on a range of IPs on our remote site. I tried running nmap scan on that IP range and some of the IP result are shown as filtered When I perform a nessus scan on the ...
J. Caballero's user avatar
16 votes
5 answers
290k views

Unknown MAC address connected to router

I found an unknown MAC address connected to my home router. How would I figure out what OS the IP or MAC address is running?
Sean's user avatar
  • 411
14 votes
3 answers
6k views

Nessus vs third-party scans

As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
sysadmin1138's user avatar
  • 2,053
14 votes
5 answers
30k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
py_script's user avatar
  • 781
13 votes
5 answers
36k views

Is there a nmap command to get the top # most common ports?

I understand nmap by default scans the top 1k 'most common' ports (-F reduces to 100) I understand it gets these 'most common' ports based on the nmap-services file, specifically the frequency (3rd ...
gregg's user avatar
  • 293
13 votes
2 answers
82k views

Nmap through proxy

Using the following command: nmap --proxy socks4://*.*.*.*:25074 -sV -O --reason scanme.nmap.org I'm not sure if nmap is really using the proxy specified Had an idea of scanning "localhost" or "127....
SilverShadow's user avatar
13 votes
2 answers
5k views

Bypassing a reverse proxy/NAT

Reverse proxies and NAT would seem to obscure a network behind such technologies to the point where it would be hard if not impossible to identify ports open and services running. Given that many ...
Sonny Ordell's user avatar
  • 3,596
13 votes
4 answers
1k views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks: Is the presence of wireless access points tested for by using a wireless analyzer at ...
user avatar
12 votes
5 answers
10k views

How to run nmap HTTP scripts on unusual ports

How can I make nmap run the HTTP-scripts on ports that are unusual for HTTP, say TCP port 123? On something like nmap -n --script="http* ..." -p123 target nmap does nothing except to check that port ...
countermode's user avatar
12 votes
4 answers
3k views

Powerful security tools to use in penetration testing

I want to ask you about some good security tools you've used or heard about, please let us know the ability in every tool and the difficulty to use it and which is the best situation to use this tool ....
Mohamad Alhamoud's user avatar
12 votes
2 answers
3k views

Malware known to use port knocking to evade detection by network scanners?

Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
sdanelson's user avatar
  • 1,287
11 votes
1 answer
9k views

How can a webpage scan my local, internal network from the Internet?

http://webkay.robinlinus.com/ It was on Reddit. In the middle is a Scan My Computer button. Yeah, I clicked it. It already knew my internal IP anyway without my permission. But I was never ...
johnny's user avatar
  • 641
11 votes
4 answers
25k views

Filtered ports - What exactly filters them?

By the NMAP definition, unfiltered ports are the ones which cannot be determined to be open or closed since packet filtering prevents its probes from reaching the port. (ISBN 9780979958717 pag. 77) ...
user avatar
11 votes
2 answers
21k views

Stop Nmap scan and preserve XML output

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
KDEx's user avatar
  • 5,009
10 votes
5 answers
42k views

Increase speed in nmap UDP scan?

How can I get nmap quicker in scanning UDP ports? This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
asdf's user avatar
  • 239
10 votes
1 answer
2k views

How can I find my home network's vulnerabilities when opening it for VPN connections

I want to open my home network so I can connect to it via VPN to do things™ while not at home. This concerns me because I am potentially opening doors that I don't know about. What tools can I use ...
F.P's user avatar
  • 878
10 votes
3 answers
22k views

nmap to scan all resolved ip addresses for a given domain name?

I'm using nmap to scan a given domain name example.com, which resolves to 2 ip addresses, then nmap chooses only one ip address to scan for example: #nmap -vv -sV scanme.nmap.org Starting Nmap 7.01 (...
ksr's user avatar
  • 101
9 votes
6 answers
26k views

How to bypass Nmap blockage?

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside? Also, does blocking nmap on a network provide any security? ...
marcoo's user avatar
  • 894
9 votes
4 answers
8k views

nmap showing unknown IPs on private network

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
fduff's user avatar
  • 725
9 votes
4 answers
2k views

Persisting and comparing NMAP scans

Does anyone have any good recommendations on a good tool for persisting NMAP scans to database? It may be a tool for persisting or simply a java library for easy parsing of the nmap xml scan result ...
Chris Dale's user avatar
  • 16.1k
9 votes
2 answers
18k views

/hnap1/ scans router compromised or worm?

Recently, I saw some strange entries on my local-only webserver. The thing is I don't know if the attack came from outside the network or from an infected machine. I have read up a little on the hnap ...
James's user avatar
  • 555
8 votes
2 answers
8k views

Scanning my network with NMAP

Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
Daniel's user avatar
  • 135
8 votes
2 answers
23k views

Port scanning legal or not? [closed]

Is port scanning legal ? In which countries ? my option : I think port scanning is like a short-walk( or a long-walk) in the neighbourhood, just curious about neighbours are up to. I think that ...
Stelios Joseph Karras's user avatar
8 votes
3 answers
1k views

What are some instant red flags when scanning an network with nmap

When doing an Nmap scan from an external network, what open ports should be an instant red flag? For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
Lone Ronin's user avatar
8 votes
2 answers
4k views

Initial steps of network mapping

In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question. My Question You ...
k to the z's user avatar
  • 1,125
8 votes
4 answers
60k views

With Nmap it is possible to scan according mac address?

I would like to know if it's possible to use Nmap in order to scan hosts according to their mac address. Or if it's not possible to do it directly, is there an option (i didn't find) to select only ...
mric750's user avatar
  • 83
8 votes
1 answer
2k views

Triangulate a MAC address

Last Sunday my iMac was stolen by a burglar. On Monday it showed up on 'find my mac'. Good police work and a lot of luck ended up in me retrieving my device that was on a location more than 50 meter ...
Dagwin's user avatar
  • 81
8 votes
1 answer
4k views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
tis's user avatar
  • 275
7 votes
4 answers
47k views

Could Nmap scan switches/routers

Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.
SIFE's user avatar
  • 173
7 votes
4 answers
14k views

How to remote monitor a computer network traffic?

I would like to know if it is possible to remote monitor the incoming and outcoming network traffic of a specific IP from my network. I need to log the time, ip numbers and port that contact the ...
Winter's user avatar
  • 183
7 votes
1 answer
801 views

different portscan tools give different results

I have different results as of my open TCP ports. When using nmap -sS 127.0.0.1, I get some 5 usual open ports, but when using osx built-in tool as stroke, I get those 5 ports plus 5 extra ports. How ...
epsilones's user avatar
  • 327
7 votes
1 answer
4k views

How does OS detection work in practice?

I was wondering how OS detection really works on Nmap. I know it is about to send different tcp probes to see how the target machine responds to them. But what kind of probes would distinguish a ...
Rox's user avatar
  • 801
7 votes
1 answer
379 views

Port Scanning - States definition

I am currently reading the "NMAP Network Scanning" book by Gordon Fyodor Lyon. On page 77 there is a description on how NMAP categorizes the ports based on host's responses (or not). What would help ...
user avatar
7 votes
4 answers
28k views

Can I get a virus from connecting to a WiFi network?

Let's say I connect to a local WiFi hotspot with a particularly bad security. I am aware that a hacker may be able to perform the following: Man-in-the-middle attack Snoop on an unencrypted network ...
User1's user avatar
  • 3,041
7 votes
2 answers
4k views

Discovering IP or Mac address of mobile devices passing by.

Is it possible for someone to discover the IP and/or MAC address of my mobile device, even if I do not attempt to connect to their network?
ari's user avatar
  • 71
7 votes
3 answers
45k views

How does Network Discovery OFF protect my computer?

Yes, it seems that the computer will not respond to pinging. But any computer with a packet sniffer will be able to see my ip once I send any packet to the router. So basically, if I'm surfing the ...
ispiro's user avatar
  • 793
7 votes
3 answers
11k views

Nessus Port scan Vs NMAP Port scan

My objective is to find network vulnerabilities. I have used Nessus and NMAP both for vulnerability scan. I have to verify if I can use only "Nessus" rather than using "NMAP". According to my ...
tech_enthusiast's user avatar
7 votes
2 answers
12k views

Using Nmap to Scan Port Forwarding?

I have enabled port forwarding on my router to do some testing with Nmap. The internal IP address 10.0.0.10 on port 4245 is being sent to my public IP address on port 4245. I can access this with x.x....
Gavin Youker's user avatar
  • 1,300
6 votes
4 answers
2k views

Do these ports mean anything?

I'm diving to the world of penetration testing and I decided to port scan my server. My website is completely managed by a friend of mine but he lacks any knowledge of security. PORT STATE ...
SecurityEnthusiast's user avatar

1
2 3 4 5
8