Questions tagged [network-scanners]

Programs that map out a network to figure out which computers and services are available to be exploited.

Filter by
Sorted by
Tagged with
2
votes
0answers
43 views

Protecting smart devices on my local network [closed]

I have a network of smart devices I have created, I wish to make more secure from attackers. I have implemented a Gateway on a Data Stream Network (DSN) to allow users to access these devices and ...
2
votes
0answers
2k views

VirtualBox Metasploitable VM not visible to Kali VM [closed]

I am running VirtualBox on Windows 10, and have 2 VMs set up; Metasploitable (target obviously) and Kali (lab host). I am attempting to fping, followed by nmap from Kali, and for some reason my ...
2
votes
0answers
81 views

Does hping support FTP Bounce scanning?

Does hping support FTP Bounce scanning? I googled it, but I couldn't find its command, so I think it didn't support it. I just find command for nmap not hping.
2
votes
2answers
103 views

Identification of TLS POODLE Vulnerability

How can I identify whether the remote server is vulnerable to TLS POODLE vulnerability? Although, there are online scanners such as Qualys SSL Labs. As per my understanding, these online scanners do ...
1
vote
3answers
4k views

How to find the OS of the target machine

I am new to this field. Currently I am using Linux OS and my question is how can I find the OS of another machine to which I do not have a direct access. I am interested in any possibilities which ...
1
vote
3answers
5k views

Why is UDP port scanning slower than TCP port scanning?

I can't seem to find an answer for this. Any suggestions?
1
vote
4answers
2k views

SYN scan victim sending back RST

I'm confused on the case of SYN scan and closed ports (the case of open ports makes sense). So, the attacker sends a ~40 byte SYN packet, a "closed port" would send a RST packet back to the attacker ...
1
vote
1answer
767 views

NMAP not reporting open ports with -sS scan

Is there any reason why an -sS scan (or most others) would not report an open port that doesn't have a service attached to it? For example, in a regular -sS scan, the following port will be missing, ...
1
vote
3answers
195 views

Is it safe to share my hostname

I am using GNU/Linux. Sometimes, I copy/paste code from the terminal (like user@hostname ..) to put it in a forum thread or a blog ..etc And I was always wondering that it is better to hide it . Is ...
1
vote
2answers
973 views

Scan my network externally [closed]

So I'm about to undertake Cyber Essentials as our first step towards nailing as best as we can our security. I have done quite a lot of work on locking down our network, however, I would like audit ...
1
vote
2answers
393 views

Is a Windows (fresh installation) 7 really this safe against NMAP or am I missing something?

I am playing with NMAP in my small private network performing port scanning. So far I went through scanning the following OSs (Unaltered new installations - Meaning no extra software installed!): ...
1
vote
2answers
1k views

Nmap scan list of domains and provide boolean if up/down

I have a newline separated list of domains that I would like to perform an arbitrary nmap scan on (e.g. aggressive, syn) and I would like to output a boolean that indicates whether or not any ports ...
1
vote
3answers
2k views

What exactly does one get from a Nmap Scan?

I know nmap is a port scanner and its output shows all the open ports, the services running on those ports, the underlying OS and technology, etc. What should one take from this result in easiest ...
1
vote
2answers
1k views

TCP / UDP port monitoring programs for mac?

Does anyone know of a free and effective port monitor for mac? Also, can a laymen, in relatively short order, learn to use such software to detect and thus prevent unauthorized remote access/control ...
1
vote
1answer
88 views

Is there any method or tool other than nmap for the detection of an OS?

I wanted to know if there was any other way to detect the OS of a network (other than nmap) since nmap doesn't detect most versions of Windows 10 at all and identifies them as a different OS ...
1
vote
1answer
233 views

Can you scan unmanaged switches with vulnerability scanners?

The target switches do not have IP addresses and most scanners require IPs as targets. Can you scan unmanaged switches with vulnerability scanners? What scanners can target layer 2?
1
vote
1answer
367 views

How to detect a scan on a local machine?

Is there any way to detect a scan on the local machine ( the pc that I'm using with a linux os -ubuntu-) from the network that I'm connected to? I know that for the webservers we could check the ...
1
vote
2answers
180 views

How to scan allowed outbound (destination) ports on the local host?

Without access to firewall rules, I want to scan allowed outbound (destination) ports on the local machine. I would take too long to start a netcat listener for each of the destination ports on a ...
1
vote
3answers
1k views

Number of bytes in a TLS handshake

How can I identify precisely the exact number of bytes the ClientHello and ServerHello in a TLS traffic needs? this is for traffic analysis purpose to capture the TLS bytes of interest (client hello ...
1
vote
2answers
839 views

Different scanning results with Nmap

Me and my friend have access to a private enviroment, and we use Nmap to scan one domain and a www. I get the following result: ====================================================================== ...
1
vote
2answers
397 views

What phases does a network penetration test consist of?

What are common phases of a network infrastructure penetration test? Staring with discovering IP's and ports? A simple vulnerability assessment, checking version information of banners from different ...
1
vote
3answers
2k views

Port Scanning Host that has Rate Limiting Enabled

I am trying to enumerate on of my lab machines. It seems that it has rate limiting enabled since I am getting blocked after the first few probes. I need to scan the whole 65535 tcp ports. I tried ...
1
vote
2answers
1k views

Spike in TCP port 5904 activity - what for?

There is an 'Internet Weather Report' on the Threat!Traq video blog by AT&T security researchers. In the March 14th broadcast, at around 31 minutes in, they mention an increase of scanning ...
1
vote
1answer
438 views

NMAP reporting all ports open

I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between. I tried the SYN scan, and when I check the traffic in WireShark I see ...
1
vote
2answers
149 views

Am I being Hacked? So many defferent ip's in router firewall logs [duplicate]

My router dsl light was not stable; It keept disconnecting and connecting..So I logged into Router Homepage to check whats wrong and found there were so many different ip's in Router firewall logs I ...
1
vote
1answer
448 views

Black Box penetration testing in private network

I came across a scenario where an organization is using micro-service architecture. They are using Amazon AWS as a web service and Kubernetes to maintain micro-services. All the EC2 instances are in ...
1
vote
3answers
3k views

How to get shodan to report IP addresses with a specific open port?

I've done the leg work and I've struggled to identify how to search with the Shodan CLI, or the web search, just for a specific port and output all the IP addresses that expose this port. For ...
1
vote
1answer
2k views

Can Inverse TCP Flag Scan be run as a stealth scan?

How exactly does the Inverse TCP flag scan run and can we run it as a stealth scan?
1
vote
3answers
538 views

Nmap TCP scan decreases the progress percentage

I'm performing a TCP scan on a network and noticed that nmap decreased the percentage of the progress. The command is: nmap -A -sT 10.0.0.1-254 -oG scan.txt Amongst the output I found: Stats: 0:13:...
1
vote
3answers
907 views

Spytechphone - iPhone

When port scanning my iPhone I get an RST, ACK from 'Spytechphone' over port 8192, does anyone know what this port does? I can't find any useful information. [1] http://www.iana.org/assignments/...
1
vote
1answer
1k views

How do I scan for and discover active IPv6 addresses of devices behind a router?

Usually with IPv4 and NAT you can only access a device behind a router if the router is port-forwarded correctly or is the router's DMZ. When behind the router you can easily scan for the IPs behind ...
1
vote
2answers
135 views

How to evaluate a wireless network risk level?

When travelling everyone has to use structural wireless networks (managed by airports, hotels, museums, restaurants…). Some of these only open (80|443)/tcp/ip once you have provided an E-mail or ...
1
vote
1answer
112 views

What this type of attack called? (gaining peripheral information)

When the intruder looks at the transmitted data and finds information about the sender and the receiver of the data or other peripheral information that won't help him hack the system but know more ...
1
vote
1answer
660 views

Network enumeration protection [closed]

I was reading about DNS security, and readed about Zone Transfer and how can be used to retrieve host information of a network, so not allowing Zone Tranfer from external sources will be the solution ...
1
vote
2answers
612 views

Is there a way to see if an nMap scan in the background is progressing?

I have launched an nMap scan from an Ubuntu machine with the following parameters: nmap -Pn -T3 -sS -sV -iL /home/tsouser/Desktop/Scope.txt --reason --top-ports 100 --max_rtt_timeout 200ms --...
1
vote
1answer
98 views

Morris worm and fixes

I am new to information security and was reading about Morris worm and encoutnered some nice reports and articles on it like this, this and this. There are many other article and tech reports on this. ...
1
vote
1answer
271 views

Scanning a network via a hardline connection to a wired-switch NIC in promiscuous mode

Question from a CEHv9 exam preparation book: "When scanning a network via a hardline connection to a wired-switch NIC in promiscuous mode, what would be the extent of network traffic you would ...
1
vote
1answer
162 views

Searching a tool to perform SSL/TLS handshakes and store data [closed]

As the title says, I am searching for a tool, which can do the following: Do SSL Handshake beeing given a list of IP-Addresses Support SNI (in that case hostnames would be in the list, too) ...
1
vote
1answer
565 views

Is there anyway to probe open out ports?

I can use nmap to find open ports on a specific client with following command: nmap -sC -sV [IP] This command only shows incoming open ports, I'm looking for a similar command to find outgoing ...
1
vote
2answers
2k views

Packet Filter vs Application proxy

http://postimg.org/image/b1w3bujnv/ I don't understand the highlighted part in red. Firstly,Why is a packet filter is enough in a situation where traffic is busy? Secondly,Isn't application proxy ...
1
vote
1answer
69 views

What is a device that scans the network it is connected to called?

Are there any devices (computer, switch, router, etc.) witch integrate licensed software like Nessus or Nexpose in a way that you can just drop them in a network and scan that network remote? If so, ...
1
vote
1answer
86 views

What local ethernet-accessible resources can be accessed on a PC through a USB cable?

Clarification: this is about scanning the network resources on computer B from computer A in a situation where: Computer A is connected to Computer B through a USB cable Computer A has some scanning ...
1
vote
1answer
199 views

Denial of Service during scanning [closed]

As I know you can do Denial of Service when footprinting with scanners, like nmap or Maltego. But is it legal? As I know, scanning isn't illegal but doing DoS attacks is. EDIT I meant if you scan ...
1
vote
1answer
3k views

Tracing stolen android tablet via MAC address [closed]

I lost my tablet , but I can see that the tablet is connected to the network on my router: :So I know the MAC address but I am unable to trace my tablet using this information and I am running out of ...
1
vote
1answer
13k views

Router detecting constant ack flood attacks and port scans

I first noticed this yesterday in my logs - while I was configuring the router settings, so I don't know how long it's been going on. What should I do? I reconfigured my router with more secure ...
1
vote
1answer
989 views

Is ettercap detectable?

Is Ettercap detectable? It technically shouldn't be because it just reads the data it sees legally through network. Every other computer receives the exact same data, it just doesn't show the data to ...
1
vote
1answer
373 views

Understanding a Zenmap output

I'm running Zenmap on my Windows 7 laptop. I ran an intense scan with UDP targeting my router 192.168.1.1.I realize that I'm probing into the back end of the router from the inside and that any open ...
1
vote
1answer
123 views

Nessus Report Total 0?

This may seem like a slightly esoteric question but, I am wondering if it possible to achieve a result summary in Nessus where the Total is 0 for a windows server? Things that have no risk factors ...
1
vote
1answer
218 views

how to protect from Network scanner on android?

How can I block and detect network scanners on android platforms to stop scanning vlan of my hot spot. My question is: which scanners they use? how can i detect such scanners? Can i protect LAN ...
1
vote
1answer
37 views

Scapy: Sending forged Probe Requests and capturing them in a different device

Objective: Sending a forged Probe Request frame from one machine and capturing it on a second machine. I have two codes running: sender.py interface = sys.argv[1] dot11 = Dot11(addr1='ff:ff:ff:ff:...