The tag has no wiki summary.

learn more… | top users | synonyms

6
votes
1answer
141 views

What is the purpose of using different DNS server in nmap?

nmap allows the use of different DNS servers (not local). What is the benefit of doing so?
3
votes
2answers
83 views

Is it possible to “fingerprint” the “patches” applied to a Windows system?

Two situations with a similar goal: 1) You have access to a target network, and you a Windows host. Is it possible to remotely finger print which (operating system security) patches are applied to ...
1
vote
2answers
89 views

Reconnaissance countermeasures

I have a lot of XMAS/NULL/SYN packets (+-1000 packets/day/server) from same IPs (+-120 differents IPs from anywhere) on multiple servers. Logs and firewalls are checked daily and servers are updated. ...
0
votes
2answers
71 views

Deniable discussions online [closed]

Consider this scenario: Alice is a typical corporate shark. She wants to get ahead in her organisation. Alice has a sensitive information security scenario, she needs expert consultation but she ...
0
votes
0answers
81 views

Find the location of a hidden host

I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
0
votes
1answer
53 views

Is it possible to detect IDS name and version

the title said it. Is it possible to detect IDS name and version. If server use Snort as IDS, would I be able to detect it from external PC? And if it's possible how?
2
votes
1answer
137 views

Does OpenSSL leave any traces that a server uses it?

I was thinking that maybe the banners can give some insight as to whether a server is using OpenSSL. Is there any tell tale signs that a server is using OpenSSL? -- Clarification: Speaking in terms ...
0
votes
1answer
179 views

Does shodan JSON API use my IP address?

I want to find out if shodan uses my ip adresse to query the target after sending this HTTP request: https://api.shodan.io/shodan/host/{target_ip}?key={MY_API_KEY} so is shodan API a passive or ...
1
vote
1answer
657 views

Spoofing OS during browsing

I am using http://www.mybrowserinfo.com/ to gather some info about me while browsing. I want to change my OS to appear that its a Windows Xp machine.(No VM solutions please:D) If you have any ...
3
votes
1answer
629 views

Strange packets coming over wireless, looking for clues

While running airodump-ng in town, I have noticed an unusual type of AP or pseudo-AP. There is a steady stream of wireless beacon frames coming in on channel 6. The frames are valid, but have several ...
1
vote
1answer
431 views

OS fingerprinting protection - why not by default?

This article describes how to fool nmap in it's OS fingerprinting detection. In short, nmap sends malformed packets to open and closed ports and listens to the responses. Because every OS implements ...
6
votes
3answers
5k views

How to know if two IP addresses point to the same web server?

Doing some testing against two IP address in the scope I find one web server in each one. Both host what it seems the same web application. They are different public (accessible through Internet) IP ...
15
votes
5answers
18k views

How can I find subdomains of a site?

One of the things I need to do from time to time is to find subdomains of a site for example. Starting with example.com sub1.example.com other.example.com another.example.com I'm ...