Questions tagged [scan]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
102 views

How reliable is a mathematical model of a human fingerprint for identification?

How reliable is a mathematical model of a human fingerprint for identification? I am looking for a way to uniquely identify individuals that is very reliable and easy to use that does not require ...
0
votes
0answers
93 views

Router scanning ports on all connected devices

From time to time, my router starts to scan ports on all the connected devices. I have an internal RPi server which I restricted its access to the internet from the router. I checked the "/var/...
16
votes
5answers
5k views

How can an attacker identify if a website is using PHP? How about the PHP version?

I have a vulnerable test site up that runs PHP. How can an attacker identify that PHP is used? if I type .../add.php the site gives back an error message, although the file is add.php. If I type .../...
0
votes
2answers
103 views

Does it make sense to perform vulnerability assessment tests with admin user rights?

We have an admin web portal that we use to configure and monitor our system We recently had a security consultant scan our servers for vulnerabilities. Our admin portal is secured with username and ...
1
vote
0answers
48 views

Scanning developer dependency for OSS scan

I have a angular project which has several packages that have direct dependencies and developer dependencies like below "dependencies": { "@angular/animations": "8.2.14", ...
1
vote
1answer
354 views

If a file has previously been scanned by VirusTotal, will the VirusTotal website always indicate this fact?

I recently downloaded a very popular open-source application. Usually, I compile open-source applications myself after reading the source code. But my compiler box was busy with many tasks, so I ...
0
votes
1answer
77 views

Estimate the number of host computers on the private network by port scanning

If we have a private network connected to the Internet with NAT, how can an attacker estimate the number of host computers in network using port scanning? For both possible modes, the attacker inside ...
1
vote
0answers
132 views

Is port scanning used by software for legitimate reasons?

Does normal network traffic sent out by software or anything else use port scanning for legitimate reasons? I'm using psad on my linux server and am unsure if setting the auto-ban IP feature on danger ...
0
votes
1answer
63 views

Are there reasons to match the target port/service protocol when doing a scan?

I am pushing my way through some beginner level security readings and exercises (ECSA 1 & 2) without much of a networking background. I happened upon an interesting suggestion or command: to use ...
0
votes
1answer
864 views

AutoRecon is taking too long to complete

AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services. It is intended as a time-saving tool for use in CTFs and other penetration testing ...
3
votes
3answers
5k views

Gmail warns about encrypted PDF file

I recently received a PDF file that, when attached to a gmail message, causes a warning to be displayed as follows: Encrypted attachment warning – Be careful with this attachment. This message ...
1
vote
1answer
161 views

Security pattern for third party uploads to Azure blob container

Scenario: Vendor 1 needs to upload data (.json, compressed .csv files, images and video) to an Azure blob storage container owned by Vendor 2 Vendor 1 is issued a limited duration SAS token each day ...
3
votes
1answer
90 views

Why are full port scans more susceptible to being logged than half-open port scans?

Many resources I come across state that one major advantage of full-port scans (e.g. SYN scans) is the fact that there is a lower risk of being logged. But why? In my opinion, the sequence of ...
57
votes
3answers
9k views

eBay web site tries to connect to wss://localhost:xxxxx - is this legit or they have some Malware JS running?

In helping a corporate user log on to eBay, I noticed that when on the login page, a stream of errors were coming up in the Firefox JS Console about not being able to connect to wss://localhost. This ...
2
votes
2answers
876 views

Why is my computer connected to amazon instances

When I run the command netstat -a to see the actual connections on my computer, I see all the time that my computer is connected to something like this ec2-xx-xx-xx-xx, not just one address it changes ...
1
vote
0answers
77 views

Spike in activity with port 3379 (SOCORFS)

My personal IPs on AWS are being scanned for 3379. Apparently, this is SOCORFS, registered to one Hugo Charbonneau. This port is getting scanned a lot more often in recent months: https://isc.sans.edu/...
1
vote
1answer
1k views

Investigate an unknown device connected to router

On my router(Virgin Media) I found a device labelled as "unknown" I often see the router not assigning the device name but I do have a clue about which device is. However this specific device got me ...
0
votes
1answer
151 views

Using an active or passive scan, can I detect all devices connected to or transmitting via a Wifi network?

I know that it's possible to do a passive scan on all channels to see if an access point sends a beacon. However, is it also possible to listen to general Wifi traffic on that channel and assemble a ...
2
votes
1answer
412 views

Why would I use an ACK scan over a FIN scan and vice versa?

I understand that both scans return RST packets and you can use this to scan hosts behind poorly configured firewalls. Is the idea to use both in case the firewall doesn't check for one? For example ...
0
votes
1answer
78 views

How does Burp update XSS/vulnerability scanning rules/payloads?

The first point, that it updates with new release. So if somebody discovered new payload for popular frameworks, it will be in burp only with new release. Does Burp app load payloads from Internet ...
0
votes
2answers
385 views

Public IP Address to be tested legally? [closed]

According to this question on Quora: Scanning a public IP address can be a cyber crime. But there are a few public IPs that can be used for testing purposes such as 45.33.32.156 which is belong ...
0
votes
1answer
105 views

How to check big video file if can't check it entirely?

There size limit on VirusTotal, some videos are very big. What if cut off part from the video and send part of it. Is it possible? What part of it, where malware can be?
2
votes
0answers
158 views

Where to run long automated scans? [closed]

I'm trying to run some automated scans without stopping for long periods of time (each scan can take anywhere from 8 hours to 3 days). I currently don't have a PC I can leave running for many days ...
0
votes
3answers
3k views

Authenticated vs Unauthenticated network scans

What are the differences between authenticated and unauthenticated network scans? Do they show the same results? In which scenario should both be used?
0
votes
1answer
10k views

My router is getting port scan attacks [duplicate]

My internet suddenly cut out yesterday, i checked the router and it looked like nothing is wrong. I looked at the logs and i see this 2019-08-18 12:50:39 Security Warning Detect UDP port scan ...
1
vote
1answer
250 views

Mindlessly clicked days old phishing email link appeared dead

Was multitasking and mindlessly clicked Squarespace phishing email. Page didn't load, and right away I realized my mistake. Completed several malware scans which came back clean. The button link ...
1
vote
1answer
138 views

RHEL7 SSGv0.1 2.2.3 Unauthorized SUID/GUID executables

We are upgrading to RHEL 7.6. My Nessus scanner is giving me the following message: 2.2.3.c-d Mandatory Review Required: Find unauthorized SUID/GUID System Executables RHEL7 SSGv0.1 2.2.3 Unauthorized ...
0
votes
1answer
1k views

How do I investigate a suspicious link?

I made a RuneScape account about a week ago. I stupidly responded to a scam by clicking on a link provided to me in the game. I think I may have a keylogger, which would explain why my new account was ...
1
vote
2answers
359 views

Is VirusTotal useful for finding malware in a WordPress database SQL export?

Does VirusTotal detect malware in an SQL export? I have an infected WordPress site. I removed the malware with various tools, however I know from experience, that sometimes it hides itself somewhere ...
9
votes
4answers
3k views

Do mail servers follow links in emails as part of a security scan before inbox delivery?

I've implemented a passwordless login using a magic link and email. The link can be used only once. One customer is complaining that once they click the link, the page reports that the link is already ...
0
votes
1answer
215 views

Modified NMAP script: variable 'host' is not declared [closed]

I am modifying an nse script, ssl-cert.nse, which was already made for enumerating ssl certificates. I want to output the host ip and the port number in a line of the ssl certificate output. However, ...
3
votes
1answer
144 views

Verifying Host Sterility After Running Malware Tests on Virtual Machine

I know that "VM escape" is becoming a common issue now with malware testing. I'm just wondering if there's any way of verifying if the host system is clean from any infection after running a malware ...
3
votes
1answer
11k views

What is this service? [closed]

Fairly new to infosec and am going through a course on nmap. While scanning I found this and it looked interesting and was wondering if you all had any information on this? This is the port,state and ...
1
vote
0answers
433 views

nmap - No Ports Open [closed]

I bought a Tonbux Smart WiFi Plug WL-SC01 and I'm doing some hack tests on it for educational purposes. I used nmap to check for both UDP and TCP ports but both return that there are no open ports at ...
1
vote
1answer
214 views

Determine victim of port scan's OS

I am taking part in a practice sandbox, and have a pcap file in Wireshark: with the traffic depicting a Vertical Port Scan. Is there anyway to find out the "victim"'s Operating System? The packets are ...
0
votes
1answer
178 views

Is there anywhere we can scan projects (PHP, JAVA...) for vulnerabilities, like VirusTotal.com does (All-in-one)? [closed]

Virustotal is excellent in its field. Does there exist any tool (or site) where we could upload (or that could be also an offline PC version) to test projects or websites (PHP, Java, whatever) for ...
1
vote
2answers
2k views

How secure is the fingerprint sensor in the Pixel 3?

As far as I understand different fingerprint scanners have different security levels. Old fingerprint print scanners could be fooled quite easily as the CCC (Chaos Computer Club) demonstrated. How ...
2
votes
1answer
67 views

Given a list of components and versions, how can I check if any of them have known vulnerabilities?

In this case, I have a list of names and versions, but not access to any source code or binaries. E.g. ComponentA 2.6.6 ComponentB 1.1 ComponentC 0.12 The list is more than 300 components long, so ...
2
votes
1answer
689 views

Scanning a binary against YARA rules dictionary

I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
0
votes
3answers
156 views

Scan for infection of malicious files manually?

I know there are options of free security softwares out there that do good job like malwarebytes, but I really want to learn how to scan for possible threats of malicious files on your pc manually. I ...
1
vote
2answers
114 views

What is the recommanded periodicity for antivirus RAM and disk scans?

Antivirus scans consumes resources, and far more when the full disk or RAM is scanned. Anyway, files are scanned before opening and often when they enter the system, so periodic scans on this point of ...
0
votes
1answer
2k views

Virustotal detecting threats in Suricata rule set

Virustotal scans are detecting threats from the Suricata default rule pack located https://rules.emergingthreats.net/open/suricata-4.0/ Is this a false positive? https://www.virustotal.com/#/file/...
1
vote
3answers
8k views

Port sweep vs port scan

I was asked this question in an interview: "What is a port sweep?" When I replied with port scan he said that my answer was not a scan, it was a port sweep. I googled and found "tcp sweep: but not "...
2
votes
1answer
236 views

Port Knock logs suggest machine has been compromised?

On my CentOS machine, all my ports are filtered with the Iptables rule: DROP all -- * * 0.0.0.0/0 0.0.0.0/0 So from the Internet, every port timeouts. The only way to ...
4
votes
1answer
1k views

How to distinguish between "normal internet" Port scan and more "serious" port scan preparing attack?

In a complete network infrastructure, with firewalls, routers, servers supervised by a SIEM, LogPoint here. Of course, there is a private network and public servers. in the LogPoint there is an ...
0
votes
1answer
1k views

Modify Win OS banner to avoid OS detection

I would like to modify Win OS banner to defeat OS detection from scanning tools like Nmap for example. Although, I know that Nmap does not take into account just the banner to do OS detection.
0
votes
2answers
10k views

Quick scan of a /8 subnet with nmap

I am trying to scan a full subnet (10.0.0.0/8) using nmap. I am using the command nmap –v –sn 10.0.0.0/8. I specifically just want to detect active hosts without scanning ports because I thought that ...
1
vote
0answers
214 views

How to use a web vulnerability scanner to autenthicate through in order to do the scan

I thinking about use a various mix of different scanner such as: Burp-suite Acunetix Vulnerability Scanner Arachni Owasp Zed Attack Proxy Project Vega W3af though we have Active directory that is ...
1
vote
1answer
118 views

Why are network scans coming from my router?

I'm seeing notifications from my antivirus software that scans are being blocked. Some are from external IP addresses, but others are coming from my router. For example, here's the text from one ...
1
vote
1answer
3k views

Port scans: 'traffic denied' VS 'close - age out'

I have been investigating logs from the firewall (Juniper) and I've found out that when someone is portscanning my website, the majority of the traffic through different tcp/udp ports is denied (...