Questions tagged [network-scanners]
Programs that map out a network to figure out which computers and services are available to be exploited.
334
questions
48
votes
5answers
7k views
Open-source penetration-test automation
What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them?
Does one simply use Metasploit RC files? A network vulnerability ...
44
votes
3answers
10k views
Does a fake SSH server have any purpose security-wise?
I stumbled upon this sshesame software which appears to imitate an SSH server accepting any username/password, only instead of executing the subsequent shell commands it logs them in a file.
What I ...
29
votes
5answers
11k views
How do you deal with massive port scans?
This morning I was looking through firewall logs and saw there were about 500 packets marked as port scan. The scanning range was from 1000-1200 5000-5200.
The IP address is 85.25.217.47 which seems ...
28
votes
4answers
27k views
What benefits does Nessus have over OpenVAS?
Nessus and OpenVAS appear to have fairly similar features. Why would you choose one over the other, besides the benefit of commercial support (which isn't available for Nessus Home Feed users anyways)?...
27
votes
4answers
3k views
Web sites executing local port scans: Is this coming from a library? Can it be blocked?
I recently read a piece by an infosec analyst who observed ebay.com doing a local port scan.
I could not believe my eyes, but it was quickly reproduced by me (see below for my observation).
I surfed ...
25
votes
3answers
57k views
How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?
There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP.
How is the syn flag in TCP used to achieve traceroute ...
25
votes
3answers
5k views
How wise is it to use a tool for portspoofing at your server to confuse attackers?
I came across this tool recently https://github.com/drk1wi/portspoof
How efficient will it be to use it to confuse hackers doing port scanning? If it's actually going to be pretty efficient, why ...
19
votes
5answers
3k views
419 Nigerian scam problem
I fell in a scamming trap. It took me a while to figure it out. Blinded like an idiot. But it is what it is. I can only do as much as I can now. Tell me if there is anything else I should do.
After ...
19
votes
6answers
15k views
Are some uncommon TCP ports scanned less than others?
Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
17
votes
2answers
97k views
nmap scan shows ports are filtered but nessus scan shows no result
I'm performing an port scanning on a range of IPs on our remote site. I tried running nmap scan on that IP range and some of the IP result are shown as filtered
When I perform a nessus scan on the ...
14
votes
3answers
5k views
Nessus vs third-party scans
As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
14
votes
5answers
23k views
How to detect hosts running in virtual machines with nmap?
I have to determine if a given subnet has virtual hosts.
Are there any ideas about what switches to use?
13
votes
2answers
4k views
Bypassing a reverse proxy/NAT
Reverse proxies and NAT would seem to obscure a network behind such technologies to the point where it would be hard if not impossible to identify ports open and services running.
Given that many ...
12
votes
5answers
2k views
Powerful security tools to use in penetration testing
I want to ask you about some good security tools you've used or heard about, please let us know the ability in every tool and the difficulty to use it and which is the best situation to use this tool ....
12
votes
4answers
1k views
Wireless Activity Monitoring for PCI DSS Compliance
In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks:
Is the presence of wireless access points tested for by using a wireless analyzer at ...
11
votes
4answers
21k views
Filtered ports - What exactly filters them?
By the NMAP definition, unfiltered ports are the ones which cannot be determined to be open or closed since packet filtering prevents its probes from reaching the port. (ISBN 9780979958717 pag. 77)
...
11
votes
2answers
2k views
Malware known to use port knocking to evade detection by network scanners?
Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
10
votes
4answers
22k views
Is there a nmap command to get the top # most common ports?
I understand nmap by default scans the top 1k 'most common' ports (-F reduces to 100)
I understand it gets these 'most common' ports based on the nmap-services file, specifically the frequency (3rd ...
10
votes
4answers
138k views
Unknown MAC address connected to router
I found an unknown MAC address connected to my home router. How would I figure out what OS the IP or MAC address is running?
10
votes
1answer
2k views
How can I find my home network's vulnerabilities when opening it for VPN connections
I want to open my home network so I can connect to it via VPN to do things™ while not at home. This concerns me because I am potentially opening doors that I don't know about.
What tools can I use ...
9
votes
6answers
18k views
How to bypass Nmap blockage?
I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside?
Also, does blocking nmap on a network provide any security?
...
9
votes
1answer
5k views
How can a webpage scan my local, internal network from the Internet?
http://webkay.robinlinus.com/
It was on Reddit. In the middle is a Scan My Computer button. Yeah, I clicked it. It already knew my internal IP anyway without my permission. But I was never ...
9
votes
1answer
14k views
NMAP - Closed vs Filtered
A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found).
I want to understand why NMAP decides to ...
9
votes
4answers
6k views
nmap showing unknown IPs on private network
I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
8
votes
5answers
25k views
Increase speed in nmap UDP scan?
How can I get nmap quicker in scanning UDP ports?
This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
8
votes
2answers
7k views
Scanning my network with NMAP
Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
8
votes
2answers
42k views
Nmap through proxy
Using the following command:
nmap --proxy socks4://*.*.*.*:25074 -sV -O --reason scanme.nmap.org
I'm not sure if nmap is really using the proxy specified
Had an idea of scanning "localhost" or "127....
8
votes
2answers
13k views
Stop Nmap scan and preserve XML output
Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
8
votes
4answers
2k views
Persisting and comparing NMAP scans
Does anyone have any good recommendations on a good tool for persisting NMAP scans to database?
It may be a tool for persisting or simply a java library for easy parsing of the nmap xml scan result ...
8
votes
2answers
21k views
Port scanning legal or not? [closed]
Is port scanning legal ?
In which countries ?
my option :
I think port scanning is like a short-walk( or a long-walk) in the neighbourhood, just curious about neighbours are up to.
I think that ...
8
votes
3answers
667 views
What are some instant red flags when scanning an network with nmap
When doing an Nmap scan from an external network, what open ports should be an instant red flag?
For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
8
votes
1answer
1k views
Triangulate a MAC address
Last Sunday my iMac was stolen by a burglar. On Monday it showed up on 'find my mac'. Good police work and a lot of luck ended up in me retrieving my device that was on a location more than 50 meter ...
8
votes
1answer
2k views
Is it possible to emulate real network printer i.e. to run some actual firmware in VM?
I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
7
votes
5answers
8k views
How to run nmap HTTP scripts on unusual ports
How can I make nmap run the HTTP-scripts on ports that are unusual for HTTP, say TCP port 123? On something like nmap -n --script="http* ..." -p123 target nmap does nothing except to check that port ...
7
votes
4answers
33k views
Could Nmap scan switches/routers
Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.
7
votes
1answer
720 views
different portscan tools give different results
I have different results as of my open TCP ports. When using nmap -sS 127.0.0.1, I get some 5 usual open ports, but when using osx built-in tool as stroke, I get those 5 ports plus 5 extra ports. How ...
7
votes
2answers
3k views
Initial steps of network mapping
In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question.
My Question
You ...
7
votes
1answer
319 views
Port Scanning - States definition
I am currently reading the "NMAP Network Scanning" book by Gordon Fyodor Lyon. On page 77 there is a description on how NMAP categorizes the ports based on host's responses (or not).
What would help ...
7
votes
1answer
11k views
/hnap1/ scans router compromised or worm?
Recently, I saw some strange entries on my local-only webserver. The thing is I don't know if the attack came from outside the network or from an infected machine. I have read up a little on the hnap ...
7
votes
4answers
24k views
Can I get a virus from connecting to a WiFi network?
Let's say I connect to a local WiFi hotspot with a particularly bad security.
I am aware that a hacker may be able to perform the following:
Man-in-the-middle attack
Snoop on an unencrypted network ...
7
votes
2answers
4k views
Discovering IP or Mac address of mobile devices passing by.
Is it possible for someone to discover the IP and/or MAC address of my mobile device, even if I do not attempt to connect to their network?
7
votes
3answers
9k views
Nessus Port scan Vs NMAP Port scan
My objective is to find network vulnerabilities. I have used Nessus and NMAP both for vulnerability scan. I have to verify if I can use only "Nessus" rather than using "NMAP".
According to my ...
7
votes
2answers
7k views
Using Nmap to Scan Port Forwarding?
I have enabled port forwarding on my router to do some testing with Nmap. The internal IP address 10.0.0.10 on port 4245 is being sent to my public IP address on port 4245. I can access this with x.x....
6
votes
4answers
2k views
Do these ports mean anything?
I'm diving to the world of penetration testing and I decided to port scan my server. My website is completely managed by a friend of mine but he lacks any knowledge of security.
PORT STATE ...
6
votes
5answers
5k views
How can I portscan large subnets?
I need to scan several /16 and a /8 subnet to see what hosts are up and additionally, if any services are running on a select few ports. I've tried various tools such as angry IP scanner, Nmap, ...
6
votes
4answers
13k views
How to remote monitor a computer network traffic?
I would like to know if it is possible to remote monitor the incoming and outcoming network traffic of a specific IP from my network. I need to log the time, ip numbers and port that contact the ...
6
votes
1answer
3k views
How does OS detection work in practice?
I was wondering how OS detection really works on Nmap. I know it is about to send different tcp probes to see how the target machine responds to them.
But what kind of probes would distinguish a ...
6
votes
4answers
659 views
What kind of IT security applications do you guys run on your laptop/desktop? [closed]
I know a lot of people run different security applications on their laptops/desktops. I use Little Snitch on my Macbook Pro. I like to know where my applications are sending data and where I am ...
6
votes
2answers
633 views
What should a Vulnerability Management System scan on a large scale
On a large scale (~1500 workstations, ~100 servers, ~50 network routers and switches, etc), what should a vulnerability management system be scanning? Should it scan everything, or just samples?
I ...
6
votes
4answers
38k views
With Nmap it is possible to scan according mac address?
I would like to know if it's possible to use Nmap in order to scan hosts according to their mac address.
Or if it's not possible to do it directly, is there an option (i didn't find) to select only ...
