Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [scan]

The tag has no usage guidance.

0
votes
1answer
149 views

Is there anywhere we can scan projects (PHP, JAVA…) for vulnerabilities, like VirusTotal.com does (All-in-one)? [closed]

Virustotal is excellent in its field. Does there exist any tool (or site) where we could upload (or that could be also an offline PC version) to test projects or websites (PHP, Java, whatever) for ...
0
votes
0answers
52 views

Telnet output with nmap

I made a scan on a server with nmap with these options : nmap -sT -A -P0 and this is the output for the telnet port (23) : PORT STATE SERVICE VERSION 23/tcp open telnet | fingerprint-strings: ...
1
vote
2answers
268 views

How secure is the fingerprint sensor in the Pixel 3?

As far as I understand different fingerprint scanners have different security levels. Old fingerprint print scanners could be fooled quite easily as the CCC (Chaos Computer Club) demonstrated. How ...
2
votes
1answer
54 views

Given a list of components and versions, how can I check if any of them have known vulnerabilities?

In this case, I have a list of names and versions, but not access to any source code or binaries. E.g. ComponentA 2.6.6 ComponentB 1.1 ComponentC 0.12 The list is more than 300 components long, so ...
2
votes
1answer
77 views

Scanning a binary against YARA rules dictionary

I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
0
votes
3answers
69 views

Scan for infection of malicious files manually?

I know there are options of free security softwares out there that do good job like malwarebytes, but I really want to learn how to scan for possible threats of malicious files on your pc manually. I ...
1
vote
2answers
75 views

What is the recommanded periodicity for antivirus RAM and disk scans?

Antivirus scans consumes resources, and far more when the full disk or RAM is scanned. Anyway, files are scanned before opening and often when they enter the system, so periodic scans on this point of ...
0
votes
1answer
137 views

Virustotal detecting threats in Suricata rule set

Virustotal scans are detecting threats from the Suricata default rule pack located https://rules.emergingthreats.net/open/suricata-4.0/ Is this a false positive? https://www.virustotal.com/#/file/...
0
votes
0answers
18 views

NMAP multiple IP scanning (specifying ports for every ip) [duplicate]

I am using nmap for daily monitoring the network service and open ports status, i wrote a bash script that scans a range of ip and ndiff the output with previous scans, and make it as a daily cronjob. ...
0
votes
3answers
1k views

Port sweep vs port scan

I was asked this question in an interview: "What is a port sweep?" When I replied with port scan he said that my answer was not a scan, it was a port sweep. I googled and found "tcp sweep: but not "...
-1
votes
0answers
64 views

VirusTotal: Download URL is clean, but downloaded/reuploaded file is infected

If I scan a file download URL in VirusTotal and it's clean, but then download that same file and then reupload it to VirusTotal for scanning and it finds infections, why would that be the case? The ...
2
votes
1answer
99 views

Port Knock logs suggest machine has been compromised?

On my CentOS machine, all my ports are filtered with the Iptables rule: DROP all -- * * 0.0.0.0/0 0.0.0.0/0 So from the Internet, every port timeouts. The only way to ...
4
votes
1answer
234 views

How to distinguish between “normal internet” Port scan and more “serious” port scan preparing attack?

In a complete network infrastructure, with firewalls, routers, servers supervised by a SIEM, LogPoint here. Of course, there is a private network and public servers. in the LogPoint there is an ...
0
votes
1answer
415 views

Modify Win OS banner to avoid OS detection

I would like to modify Win OS banner to defeat OS detection from scanning tools like Nmap for example. Although, I know that Nmap does not take into account just the banner to do OS detection.
0
votes
2answers
4k views

Quick scan of a /8 subnet with nmap

I am trying to scan a full subnet (10.0.0.0/8) using nmap. I am using the command nmap –v –sn 10.0.0.0/8. I specifically just want to detect active hosts without scanning ports because I thought that ...
1
vote
0answers
130 views

How to use a web vulnerability scanner to autenthicate through in order to do the scan

I thinking about use a various mix of different scanner such as: Burp-suite Acunetix Vulnerability Scanner Arachni Owasp Zed Attack Proxy Project Vega W3af though we have Active directory that is ...
1
vote
1answer
102 views

Why are network scans coming from my router?

I'm seeing notifications from my antivirus software that scans are being blocked. Some are from external IP addresses, but others are coming from my router. For example, here's the text from one ...
1
vote
1answer
910 views

Port scans: 'traffic denied' VS 'close - age out'

I have been investigating logs from the firewall (Juniper) and I've found out that when someone is portscanning my website, the majority of the traffic through different tcp/udp ports is denied (...
0
votes
1answer
397 views

“Windows Unquoted Search” Fix?

Now I may have missed it but I was reading up on common windows issues and "Windows Unquoted Search Path or Element can allow local privilege escalation" keeps appearing. I am amazed that this is ...
1
vote
1answer
657 views

nmap results after evading firewall

I've done an nmap scan on my server with an F5 firewall protecting it. I used the nmap command nmap -vvv -f -Pn -mtu 8 -sN -oN nmap-results.txt 192.168.22.102 I had this result but it seems ...
2
votes
1answer
48 views

Downloaded MailMergePro file seems to have virus attached

I downloaded MailMerge Pro from http://www.standss.com/emailmerge/download_process.asp website and i scanned it on VirusTotal.com and two of the antivirus flagged it. I am sharing the link for same, i ...
1
vote
1answer
1k views

Clamscan: infected files found

From time to time, I perform a scan with clamscan. I'm on Archlinux. Clamscan database is updated before each scan. Today clasmscan reported 19 infected files: ./.cache/mozilla/firefox/qyq0onej....
0
votes
1answer
2k views

how to detect udp port scan in suricata?

I'd like to detect udp port scan in Suricata. I searched google, but I didn't manage to find Suricata rule for detecting UDP port scan attempts. I saw before a snort rule for this scan. How can we ...
1
vote
2answers
2k views

Service running on a closed port?

I just finished scanning a host and I found something unusual. My question is regarding port 50000 and 50002. Nmap shows that these ports are closed and also identifies the services running on them!...
0
votes
2answers
67 views

Scan for a specific virus type?

Is it possible to tell an antivirus which specific virus type (worm, macro etc) to scan for? Assuming I know the type of virus and just want to save time and scan for it specifically instead of ...
1
vote
2answers
609 views

Scan my network externally [closed]

So I'm about to undertake Cyber Essentials as our first step towards nailing as best as we can our security. I have done quite a lot of work on locking down our network, however, I would like audit ...
0
votes
1answer
78 views

Symantc Endpoint protection keeps detecting clean file as risk

I downloaded some files from website using FTP and these websites have been developed using .net and any .dll file is flagged as Risk by our Antivirus. our IT Made some changes to antivirus on my ...
3
votes
1answer
385 views

Is it possible to scan the top X UDP ports and the top Y (X!=Y) TCP ports in Nmap using a single command?

Given X!=Y, is there any way to scan the top (--top-ports) X TCP ports and the top Y UDP ports using a simple Nmap command? The --top-ports parameter affects both the TCP and UDP scans (e.g., when -...
0
votes
1answer
111 views

server that responds on any port [closed]

I want to make a server that responds open to every port that is scanned by nmap (TCP and UDP). Are there a simple solution to do that?
4
votes
1answer
150 views

What allows for reinfection of the same PUP after quarantine and removal?

I use an antimalware program- the scan finds a PUP (Potentially Unwanted Program), which is quarantined and removed. It comes back! I am guessing it is stored somehow to resurface after normal shut ...
0
votes
1answer
146 views

How can I run nmap scan via multiple proxies (not chained; each proxy will be used for disjoint part of the scan)?

How can I run nmap scan via multiple proxies, such that each proxy will actually send only part of the packets? For example, assuming that a scan sends X requests, and I have Y proxies, I would like ...
1
vote
1answer
29 views

Reason behind sending multiple probes when scanning?

I've read, that the ZMap creators recommend to send three probes for each (ip,port) tuple when scanning. Let's say, we scan port 443 port with a TCP SYN scan. One reason, I can imagine is packet loss. ...
0
votes
3answers
180 views

Using Nmap kicks me out my own network

I am working on a school task, where I have to use Nmap in order to scan for open port on another device on the same network. However, when I use Nmap my network suddenly gets limited. I have tried ...
0
votes
1answer
76 views

How to know if locally installed programs (like Re Image) are malware

Not sure where to ask this question but figured I'd ask it here, at least in a generic way. I installed a program called Re Image as I red it helps with system instability problems. However, I then ...
7
votes
1answer
3k views

How does one scan a MySQL database for malware?

I have a lot of means of searching for malicious code within the file system, monitoring traffic, scanning log files, checking for suspicious/masked processes etc. However, scanning a relational ...
5
votes
1answer
189 views

Is there a need to scan images with real-time scanners anymore?

Historically, there were some exploits for certain types of image files, notably JPEG images. Consequently, many real-time malware scanners (antivirus included) started scanning every JPEG image (as ...
3
votes
1answer
611 views

Best practices manual for Alienvault USM?

Is there any best practices manual for Alienvault USM? I found some information about the profiles for the vulnerability scanner but nothing about how often I should launch the scan or which ...
-2
votes
2answers
186 views

Professional Scanner with nmap

Can one scan a range of IP addresses and detect if a specific version of FTP-, which is FTP Service 7.5 is running using nmap?
0
votes
0answers
95 views

Frequency of Stealth scan?

Background I am working on snort Portscan Module to detect Stealth scans.Snort uses good amount of datastructures to capture scanning events and to explicitly set the threshold values. typedef ...
1
vote
1answer
409 views

Scan detection Tool better than Snort Portscan Preprocessor

I am working on detection of Scanning activities of Bots/Worms. I have found that Snort Portscan Preprocessor detects Scan activities. I have tweaked Snort Portscan Preprocessor to detect different ...
8
votes
2answers
1k views

What's the advantage of sending an RST packet after getting a response in a SYN scan?

I'm reading about nmap's SYN scan, and it says Nmap sends an RST immediately after the server tries to establish the handshake. My question is - why bother with the RST? Is it to prevent the server ...
-3
votes
2answers
683 views

How do Hackers and Security Researchers Scan The Internet For Vulnerable Servers and Devices? [closed]

I would like to know how Security Researchers and hackers scan the internet to find vulnerable devices. For example in this article here, what sort of request/packets are those researchers sending to ...
4
votes
3answers
17k views

How to use nmap through proxychains?

I am running nmap through proxychains using this command: proxychains nmap -v scanme.namp.org This produced an error: root@kali:~# proxychains nmap -v scanme.nmap.org ProxyChains-3.1 (http://...
1
vote
2answers
3k views

Wireshark as a network scanner [closed]

I have been playing with nmap lately, trying out arp-ping scanning and using idle hosts, etc... Looking at Wireshark, there is always some suspicious activity when performing scans. The thing is, I ...
1
vote
3answers
4k views

Why is UDP port scanning slower than TCP port scanning?

I can't seem to find an answer for this. Any suggestions?
15
votes
4answers
7k views

Can I block viruses from a USB stick by scanning it before opening its folder?

I inserted my USB stick into a friend's PC which was full of viruses, malwares and adwares. Therefore I suppose they attacked my USB device as well. Now I want to use my USB device on my PC without ...
1
vote
3answers
424 views

Snort Unable to detect portscans in LAN

Setup Information I am doing experiment on portscan detection using snort 2.9.8.I have 10 systems in my lab with id:1,2,3,...,10. i have installed snort in my lab-pc with id:1.Now i am using Pc with ...
3
votes
1answer
544 views

Is OpenVas an active or passive scanner? [closed]

I am using Ossim and I did a scan vulnerabilities with OpenVas. I received feedback that some of our softwares broke after the scan. We will check the logs to see if the scan cause this, but I was ...
2
votes
0answers
584 views

Snort Portscan Preprocessor Analysis

Remarks I really apologize if this content isn't matching the community, but I am not getting approved on snort-mailing lists and I don't know what can I do for the same, therefore I feel this can be ...
1
vote
2answers
346 views

“CHANGELOG.txt” in Apache logs

Recently I've been seeing a major uptick in the following type of requests to my Apache logs: "GET /CHANGELOG.txt HTTP/1.1" 404 211 About a month ago, I received none. Now I receive a dozen or so ...