Questions tagged [network-scanners]
Programs that map out a network to figure out which computers and services are available to be exploited.
308
questions
47
votes
5answers
7k views
Open-source penetration-test automation
What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them?
Does one simply use Metasploit RC files? A network vulnerability ...
44
votes
3answers
9k views
Does a fake SSH server have any purpose security-wise?
I stumbled upon this sshesame software which appears to imitate an SSH server accepting any username/password, only instead of executing the subsequent shell commands it logs them in a file.
What I ...
29
votes
5answers
10k views
How do you deal with massive port scans?
This morning I was looking through firewall logs and saw there were about 500 packets marked as port scan. The scanning range was from 1000-1200 5000-5200.
The IP address is 85.25.217.47 which seems ...
27
votes
3answers
24k views
What benefits does Nessus have over OpenVAS?
Nessus and OpenVAS appear to have fairly similar features. Why would you choose one over the other, besides the benefit of commercial support (which isn't available for Nessus Home Feed users anyways)?...
25
votes
3answers
5k views
How wise is it to use a tool for portspoofing at your server to confuse attackers?
I came across this tool recently https://github.com/drk1wi/portspoof
How efficient will it be to use it to confuse hackers doing port scanning? If it's actually going to be pretty efficient, why ...
24
votes
3answers
55k views
How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?
There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP.
How is the syn flag in TCP used to achieve traceroute ...
19
votes
5answers
3k views
419 Nigerian scam problem
I fell in a scamming trap. It took me a while to figure it out. Blinded like an idiot. But it is what it is. I can only do as much as I can now. Tell me if there is anything else I should do.
After ...
19
votes
6answers
13k views
Are some uncommon TCP ports scanned less than others?
Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
17
votes
2answers
86k views
nmap scan shows ports are filtered but nessus scan shows no result
I'm performing an port scanning on a range of IPs on our remote site. I tried running nmap scan on that IP range and some of the IP result are shown as filtered
When I perform a nessus scan on the ...
14
votes
3answers
5k views
Nessus vs third-party scans
As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
13
votes
2answers
4k views
Bypassing a reverse proxy/NAT
Reverse proxies and NAT would seem to obscure a network behind such technologies to the point where it would be hard if not impossible to identify ports open and services running.
Given that many ...
12
votes
5answers
20k views
How to detect hosts running in virtual machines with nmap?
I have to determine if a given subnet has virtual hosts.
Are there any ideas about what switches to use?
12
votes
5answers
2k views
Powerful security tools to use in penetration testing
I want to ask you about some good security tools you've used or heard about, please let us know the ability in every tool and the difficulty to use it and which is the best situation to use this tool ....
12
votes
4answers
1k views
Wireless Activity Monitoring for PCI DSS Compliance
In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks:
Is the presence of wireless access points tested for by using a wireless analyzer at ...
11
votes
4answers
17k views
Filtered ports - What exactly filters them?
By the NMAP definition, unfiltered ports are the ones which cannot be determined to be open or closed since packet filtering prevents its probes from reaching the port. (ISBN 9780979958717 pag. 77)
...
11
votes
2answers
2k views
Malware known to use port knocking to evade detection by network scanners?
Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
10
votes
1answer
2k views
How can I find my home network's vulnerabilities when opening it for VPN connections
I want to open my home network so I can connect to it via VPN to do things™ while not at home. This concerns me because I am potentially opening doors that I don't know about.
What tools can I use ...
9
votes
1answer
4k views
How can a webpage scan my local, internal network from the Internet?
http://webkay.robinlinus.com/
It was on Reddit. In the middle is a Scan My Computer button. Yeah, I clicked it. It already knew my internal IP anyway without my permission. But I was never ...
9
votes
4answers
6k views
nmap showing unknown IPs on private network
I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
9
votes
3answers
603 views
What are some instant red flags when scanning an network with nmap
When doing an Nmap scan from an external network, what open ports should be an instant red flag?
For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
8
votes
5answers
22k views
Increase speed in nmap UDP scan?
How can I get nmap quicker in scanning UDP ports?
This kind of scan is incredibly more slow than TCP ports (at least 2-3 times)
8
votes
4answers
91k views
Unknown MAC address connected to router
I found an unknown MAC address connected to my home router. How would I figure out what OS the IP or MAC address is running?
8
votes
2answers
7k views
Scanning my network with NMAP
Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
8
votes
2answers
31k views
Nmap through proxy
Using the following command:
nmap --proxy socks4://*.*.*.*:25074 -sV -O --reason scanme.nmap.org
I'm not sure if nmap is really using the proxy specified
Had an idea of scanning "localhost" or "127....
8
votes
2answers
10k views
Stop Nmap scan and preserve XML output
Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
8
votes
6answers
15k views
How to bypass Nmap blockage?
I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside?
Also, does blocking nmap on a network provide any security?
...
8
votes
4answers
2k views
Persisting and comparing NMAP scans
Does anyone have any good recommendations on a good tool for persisting NMAP scans to database?
It may be a tool for persisting or simply a java library for easy parsing of the nmap xml scan result ...
8
votes
2answers
20k views
Port scanning legal or not? [closed]
Is port scanning legal ?
In which countries ?
my option :
I think port scanning is like a short-walk( or a long-walk) in the neighbourhood, just curious about neighbours are up to.
I think that ...
8
votes
1answer
827 views
Triangulate a MAC address
Last Sunday my iMac was stolen by a burglar. On Monday it showed up on 'find my mac'. Good police work and a lot of luck ended up in me retrieving my device that was on a location more than 50 meter ...
8
votes
1answer
2k views
Is it possible to emulate real network printer i.e. to run some actual firmware in VM?
I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
7
votes
4answers
18k views
Is there a nmap command to get the top # most common ports?
I understand nmap by default scans the top 1k 'most common' ports (-F reduces to 100)
I understand it gets these 'most common' ports based on the nmap-services file, specifically the frequency (3rd ...
7
votes
5answers
7k views
How to run nmap HTTP scripts on unusual ports
How can I make nmap run the HTTP-scripts on ports that are unusual for HTTP, say TCP port 123? On something like nmap -n --script="http* ..." -p123 target nmap does nothing except to check that port ...
7
votes
4answers
27k views
Could Nmap scan switches/routers
Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.
7
votes
1answer
713 views
different portscan tools give different results
I have different results as of my open TCP ports. When using nmap -sS 127.0.0.1, I get some 5 usual open ports, but when using osx built-in tool as stroke, I get those 5 ports plus 5 extra ports. How ...
7
votes
2answers
3k views
Initial steps of network mapping
In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question.
My Question
You ...
7
votes
1answer
315 views
Port Scanning - States definition
I am currently reading the "NMAP Network Scanning" book by Gordon Fyodor Lyon. On page 77 there is a description on how NMAP categorizes the ports based on host's responses (or not).
What would help ...
7
votes
2answers
4k views
Discovering IP or Mac address of mobile devices passing by.
Is it possible for someone to discover the IP and/or MAC address of my mobile device, even if I do not attempt to connect to their network?
7
votes
3answers
6k views
Nessus Port scan Vs NMAP Port scan
My objective is to find network vulnerabilities. I have used Nessus and NMAP both for vulnerability scan. I have to verify if I can use only "Nessus" rather than using "NMAP".
According to my ...
6
votes
4answers
2k views
Do these ports mean anything?
I'm diving to the world of penetration testing and I decided to port scan my server. My website is completely managed by a friend of mine but he lacks any knowledge of security.
PORT STATE ...
6
votes
5answers
5k views
How can I portscan large subnets?
I need to scan several /16 and a /8 subnet to see what hosts are up and additionally, if any services are running on a select few ports. I've tried various tools such as angry IP scanner, Nmap, ...
6
votes
4answers
13k views
How to remote monitor a computer network traffic?
I would like to know if it is possible to remote monitor the incoming and outcoming network traffic of a specific IP from my network. I need to log the time, ip numbers and port that contact the ...
6
votes
1answer
3k views
How does OS detection work in practice?
I was wondering how OS detection really works on Nmap. I know it is about to send different tcp probes to see how the target machine responds to them.
But what kind of probes would distinguish a ...
6
votes
4answers
651 views
What kind of IT security applications do you guys run on your laptop/desktop? [closed]
I know a lot of people run different security applications on their laptops/desktops. I use Little Snitch on my Macbook Pro. I like to know where my applications are sending data and where I am ...
6
votes
2answers
624 views
What should a Vulnerability Management System scan on a large scale
On a large scale (~1500 workstations, ~100 servers, ~50 network routers and switches, etc), what should a vulnerability management system be scanning? Should it scan everything, or just samples?
I ...
6
votes
4answers
20k views
Can I get a virus from connecting to a WiFi network?
Let's say I connect to a local WiFi hotspot with a particularly bad security.
I am aware that a hacker may be able to perform the following:
Man-in-the-middle attack
Snoop on an unencrypted network ...
6
votes
2answers
4k views
Why do multiple IP Addresses in my local network point to the same computer?
I'm new to linux and nmap, and I am attempting to do a scan of my local network. Using nmap I find that there are 4 hosts on my network (10.0.2.2, 10.0.2.3, 10.0.2.4, 10.0.2.15). I am using VirtualBox ...
6
votes
2answers
6k views
Using Nmap to Scan Port Forwarding?
I have enabled port forwarding on my router to do some testing with Nmap. The internal IP address 10.0.0.10 on port 4245 is being sent to my public IP address on port 4245. I can access this with x.x....
6
votes
5answers
4k views
Sharing Nmap scan results in a web page [closed]
Is there a tool that allow the sharing of nmap scan results ? I know nmap can produce XML and I can easily convert them in HTML.
I would like to know if there is a tool with more features. For ...
5
votes
2answers
3k views
What is the purpose of subdomain enumeration?
There're a number of security tools out there that enumerate the subdomains of a given domain. I wonder:
What's the purpose of that in terms of security / hacking?
Is there any way to do that other ...
5
votes
2answers
6k views
Tools/methods helping to determine application/protocol serving specific port
I do blackbox testing of the server and figured out that there is a bunch of listening ports. I need to determine what services/protocols those ports are used for.
What I've tried so far is to use ...
