Questions tagged [network-scanners]

Programs that map out a network to figure out which computers and services are available to be exploited.

Filter by
Sorted by
Tagged with
5
votes
3answers
2k views

Why would a stealth scan attract more attention than a connect scan?

I'm reading an Information Security book and am faced with the question: Why may nmap stealth scans(SYN) attract more attention than simple connect scans(TCP connect())? Why might it be?
5
votes
2answers
347 views

How do pentesters approach a large complex network?

Lots of books talk about using tools such as whois and other information gathering tools to collect information on the network and of course, not forgetting nmap. However, in a real network with such ...
5
votes
1answer
3k views

How does this shellshock scan work?

My server is obviously up to date and not vulnerable to shellshock exploits. However I am still curious to know how the following shellshock scan work: /var/log/apache2 # cat access.log | grep bash ...
5
votes
2answers
2k views

Is it possible to ping a LAN card through its MAC address? [duplicate]

As you can start a PC through its 'WAKE ON LAN' feature on private networks, can you trace someone's online status through their MAC address over the internet ?
5
votes
3answers
537 views

Watching for applications like WireShark and other eaves dropping on corporate network

Are there ways to monitor and check for network monitoring like WireShark? Or would it just be more ideal to ensure every application uses SSL to ensure no employee or anyone could packet sniff chats/...
5
votes
4answers
14k views

what scanning tools are unlikely to set off network IDS?

What network scanning tools have a stealth option to avoid detection?
5
votes
2answers
926 views

Scan for Vulnerabilities Without Network Connection

I have been search on the internet for some time but can't really find an answer to my question; Is it possible (common) to scan or hack a network device (such as a router or computer) without being ...
5
votes
3answers
37k views

How does Network Discovery OFF protect my computer?

Yes, it seems that the computer will not respond to pinging. But any computer with a packet sniffer will be able to see my ip once I send any packet to the router. So basically, if I'm surfing the ...
4
votes
4answers
500 views

Malware that uses http as a covert channel

I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour. Is there any database of malware, ...
4
votes
2answers
958 views

The effect of hidden or spoofed service banners on vulnerability scanners

The linked question relates to error pages, although the same information is often available in HTTP headers, if I follow best practise of hiding service banners: Is displaying what server I am ...
4
votes
4answers
5k views

How can I scan open ports without being traced back

I would like to scan open ports of a server. But as far as I know, when I try to scan the open ports with something like nmap in shell they would be able to trace me. Is there a way to secure this ...
4
votes
1answer
8k views

NMAP - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why NMAP decides to ...
4
votes
3answers
332 views

packet sniffers and segments

Just curious why most packet sniffers are limited to their segment? is it the nature of a gateway to block the attempt outside a subnet? cheers
4
votes
2answers
2k views

Is it possible to defeat the OS detection capabilities of network scanning tools?

Network scanning tools such as nmap have the capability to infer operating system version based upon lower-level system details. EG: TCP/IP stack behavior, etc. Are there any known methods to trick ...
4
votes
1answer
7k views

/hnap1/ scans router compromised or worm?

Recently, I saw some strange entries on my local-only webserver. The thing is I don't know if the attack came from outside the network or from an infected machine. I have read up a little on the hnap ...
4
votes
1answer
1k views

nmap OS scan showing DD-WRT when I'm not running it?

This weekend, I set up pfSense on a spare box that I had sitting in the garage. It seems cool and powerful, but I haven't messed with it much yet. Was doing some basic nmap scanning from work against ...
4
votes
1answer
531 views

tcp seq number prediction

While testing a system, nmap told me that the tcp seq number prediction is really low, (trivial joke). There is only one system in the whole range that gives me that answer. Some papers, e.g. a ...
4
votes
6answers
2k views

Determining network topology from the outside

To what extent can an attacker generate a map of a network from outside of it? Are network scanning tools such as nmap the only means to do this? Otherwise what other types of tools or techniques ...
4
votes
1answer
2k views

How to control the ciphersuites in nmap “ssl-enum-ciphers”

There is a script for enumerating the TLS versions and ciphersuites ofered by a server provided by nmap. See this link. Is there a way that allow me to specify the verisions and ciphersuites I want ...
4
votes
1answer
165 views

Unrecognised and undiscoverable(?) device on home network

I noticed yesterday that my home router (ASUS) was picking up an unrecognised device in it's traffic monitor function. This is a GUI that shows total upload/downloads by device/MAC address. So this ...
4
votes
1answer
5k views

Scanning private IPs from outside network

Is it possible with Nmap (or other tool) to scan a range of private IPs (let's say 10.0.0.0/8) but being outside any private network (using those IPs) ?
4
votes
2answers
6k views

nmap to scan all resolved ip addresses for a given domain name?

I'm using nmap to scan a given domain name example.com, which resolves to 2 ip addresses, then nmap chooses only one ip address to scan for example: #nmap -vv -sV scanme.nmap.org Starting Nmap 7.01 (...
4
votes
1answer
1k views

Where can I use the TCP FIN scan?

For a coursework i've got to run the various port scans, i'm having trouble with the FIN scan though, I can't seem to find a system where I can try it, everywhere I try it all ports either come back ...
4
votes
1answer
5k views

Scan All private subnets with NMAP [closed]

I have a managed switch on my network but I don't remember the subnet. How can I scan all the private network without changing my ip address : 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 Thanks for ...
4
votes
1answer
67 views

Do generic custom scripts avoid detection more than common security applications?

Are scripts coded only using the default API of a high level, interpreted language for generic and meticulous gathering of network device and host software information that are already available ...
4
votes
2answers
788 views

How can I identify a machine with two network interfaces as one?

When I run nmap on different subnets it finds different hosts. They are identified by their ip and if they are one the same subnet as the scanning device also by their mac address. But how can I ...
3
votes
3answers
2k views

Online security check via command line

My scenario is that I have a VPS with Apache (mostly for development of my own projects) accessed via SSH; and I time to time I would like to do a quick check just to be sure that there's no potential ...
3
votes
3answers
4k views

How to decode this exploit scanner?

My server is obviously up to date and not vulnerable to shellshock exploits. However, I am still curious and would like to understand how to decode the following malicious vulnerability scan. I have ...
3
votes
4answers
516 views

What does a switched network protect us from? What does it not protect us from?

There seems to be some misconceptions regarding what a switched network will protect us from, and what technologies/precautions a secure environment requires when segmenting trusted users from hostile ...
3
votes
5answers
384 views

How to introduce delay in scanning tools that do not implement delay without touching source code?

Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option. Is there a way to delay packets from ...
3
votes
2answers
7k views

Using Cain and Abel to capture traffic of machine in the same network

I have installed Cain and Able in machine A, which is connected to another machine B via a LAN. Now I want to analyze all the traffic of machine B. Is this possible by installing Cain and Abel on ...
3
votes
2answers
1k views

Is it possible to trace fellow nodes on a DSL internet connection?

I'm not in my college campus right now. In campus we had private LAN. There my computer was directly connected to a gateway. Using subnet masks I used to find out fellow nodes on my subnet. There were ...
3
votes
1answer
758 views

Is this a security threat?

So at my business our receipt printer randomly printed some questionable looking data. I looked into scanproxy.net and it's clearly not something legitimate. Can anyone give me a better idea of ...
3
votes
6answers
2k views

What are the best pratices to avoid my server being port scanned

The title probably says it all. I just wanna know what are the best technics to avoid having a port scanner detecting open ports on my server. I'm using a Linux distro as my OS (Ubuntu Server).
3
votes
1answer
167 views

How do I know that the request and response is using encryption protocols in burp suite?

I know these things can easily be done on wireshark, tshark, etc but is it possible to know that the request I forwarded and the response I received is using protocols such as TLS, TLSv1.2, TCP, HTTP, ...
3
votes
1answer
55 views

Single-packet connect request at an extremely slow rate

I had been reading a blog post on trapx.com about how they go about threat analysis and following statement was made; "advanced attackers no longer perform noisy network scans. If they do network ...
3
votes
2answers
274 views

Should ports be visible to nmap?

I'm currently working on the firewall when I discovered that the firewall exposes a lot of ports outside of the internal network. I discovered this when setting up a new FTP server using a basic nmap ...
3
votes
2answers
1k views

nmap --top-ports range selection

I'm trying to find out if it is possible to select a range from within the --top-ports when scanning with nmap. I'm performing scans which are progressive in nature, for example, scanning the top 100, ...
3
votes
3answers
2k views

Nmap showing ISPs router's DNS port in addition to target's ports

Whenever I do nmap scans, it seems that the information related to port 53 is altered by my ISP router as follows: $ nmap -T4 -A -v stackoverflow.com PORT STATE SERVICE VERSION 53/tcp open ...
3
votes
1answer
7k views

How to detect infected devices on your local network [closed]

Today I read about a researcher who bought a digital TV recorder and connected it to the internet - probably using port forwarding to enable attackers to connect to the recorder. After a while someone ...
3
votes
1answer
862 views

Persistent back door using Netcat

I have found the following command several times in one of the linux servers during an assessment: nc -l -p 3030 -e /bin/bash This enables a hacker to gain control over this sever via bash. By ...
3
votes
2answers
50 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...
3
votes
3answers
7k views

nmap detects opened port but can't connect with telnet

I've made an scan to one single IP with nmap and it reports that the port 65301 is opened, and even it detects that it's maybe the service pcanywhere. sudo nmap -p 65000-65535 -sV x.x.x.x Starting ...
3
votes
1answer
1k views

NMAP results inconsistent

I'm doing a NMAP scan that runs continuously. For some reason the results are not consistent. Sometimes it detects all the connected devices of the local network and sometimes only some of them. ...
3
votes
2answers
325 views

Nmap and it default scripts when I already know some of the information

I am a network guy and not a “hacker” or whatever the official term is these days. I’ve been learning how to use nmap as I think it’s a great tool for just keeping the network secure. The thing is ...
3
votes
1answer
933 views

How to protect open ports for Services/Programs needed for network connectivity?

I've noticed a number of Windows services required for network connectivity maintain open ports. What can be done to ensure Service functionality without allowing the always-open ports to act as a ...
3
votes
3answers
8k views

nmap not scanning for host

nmap keeps showing different and wrong results whenever I perform a scan to see how many hosts are up on my subnet. See the following scan reports. The first scan I made was not with super user ...
3
votes
2answers
5k views

Scanning multiple subnets with nmap to determine open services & ports

First off, I know nmap's documentation is very powerful and I have been reading through it rather extensively. I will be scanning externally, with permission, to determine ports & services that ...
3
votes
2answers
139 views

Public facing computers in a Media Lab

I've just taken over administering a lab of Apple computers on a university campus. We have about 15 computers and I've discovered that they all have public IPs and domain names. Even our printer is ...
3
votes
1answer
351 views

Can I perform WEP cracking from several laptops against 1 AP

I have successfully being able to perform WEP key cracking attack using aircrack tool. I want to allow my students to test this in a lab environment. They will be working fro their own laptops against ...