Questions tagged [scan]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
3answers
134 views

Authenticated vs Unauthenticated network scans

Some questions: What are the differences between authenticated and unauthenticated network scans? Do they show the same results? In which scenario should both be used?
0
votes
1answer
213 views

My router is getting port scan attacks [duplicate]

My internet suddenly cut out yesterday, i checked the router and it looked like nothing is wrong. I looked at the logs and i see this 2019-08-18 12:50:39 Security Warning Detect UDP port scan ...
1
vote
1answer
136 views

Mindlessly clicked days old phishing email link appeared dead

Was multitasking and mindlessly clicked Squarespace phishing email. Page didn't load, and right away I realized my mistake. Completed several malware scans which came back clean. The button link ...
1
vote
1answer
42 views

RHEL7 SSGv0.1 2.2.3 Unauthorized SUID/GUID executables

We are upgrading to RHEL 7.6. My Nessus scanner is giving me the following message: 2.2.3.c-d Mandatory Review Required: Find unauthorized SUID/GUID System Executables RHEL7 SSGv0.1 2.2.3 Unauthorized ...
0
votes
1answer
163 views

How do I investigate a suspicious link?

I made a RuneScape account about a week ago. I stupidly responded to a scam by clicking on a link provided to me in the game. I think I may have a keylogger, which would explain why my new account was ...
1
vote
2answers
117 views

Is VirusTotal useful for finding malware in a WordPress database SQL export?

Does VirusTotal detect malware in an SQL export? I have an infected WordPress site. I removed the malware with various tools, however I know from experience, that sometimes it hides itself somewhere ...
3
votes
4answers
409 views

Do mail servers follow links in emails as part of a security scan before inbox delivery?

I've implemented a passwordless login using a magic link and email. The link can be used only once. One customer is complaining that once they click the link, the page reports that the link is already ...
0
votes
1answer
96 views

Modified NMAP script: variable 'host' is not declared [closed]

I am modifying an nse script, ssl-cert.nse, which was already made for enumerating ssl certificates. I want to output the host ip and the port number in a line of the ssl certificate output. However, ...
0
votes
0answers
37 views

Any way to SCAP scan a RHEL 5 server for open STIGs?

We have RHEL 5 servers in our environment. Looking to move off of them, but I need to check how many STIGs are open findings. I tried installing OpenSCAP on a CentOS 5 VM at home and using the oscap ...
2
votes
1answer
78 views

Verifying Host Sterility After Running Malware Tests on Virtual Machine

I know that "VM escape" is becoming a common issue now with malware testing. I'm just wondering if there's any way of verifying if the host system is clean from any infection after running a malware ...
0
votes
1answer
549 views

What is this service? [closed]

Fairly new to infosec and am going through a course on nmap. While scanning I found this and it looked interesting and was wondering if you all had any information on this? This is the port,state and ...
1
vote
0answers
117 views

nmap - No Ports Open [closed]

I bought a Tonbux Smart WiFi Plug WL-SC01 and I'm doing some hack tests on it for educational purposes. I used nmap to check for both UDP and TCP ports but both return that there are no open ports at ...
1
vote
1answer
132 views

Determine victim of port scan's OS

I am taking part in a practice sandbox, and have a pcap file in Wireshark: with the traffic depicting a Vertical Port Scan. Is there anyway to find out the "victim"'s Operating System? The packets are ...
0
votes
1answer
160 views

Is there anywhere we can scan projects (PHP, JAVA…) for vulnerabilities, like VirusTotal.com does (All-in-one)? [closed]

Virustotal is excellent in its field. Does there exist any tool (or site) where we could upload (or that could be also an offline PC version) to test projects or websites (PHP, Java, whatever) for ...
0
votes
0answers
271 views

Telnet output with nmap

I made a scan on a server with nmap with these options : nmap -sT -A -P0 and this is the output for the telnet port (23) : PORT STATE SERVICE VERSION 23/tcp open telnet | fingerprint-strings: ...
1
vote
2answers
1k views

How secure is the fingerprint sensor in the Pixel 3?

As far as I understand different fingerprint scanners have different security levels. Old fingerprint print scanners could be fooled quite easily as the CCC (Chaos Computer Club) demonstrated. How ...
2
votes
1answer
57 views

Given a list of components and versions, how can I check if any of them have known vulnerabilities?

In this case, I have a list of names and versions, but not access to any source code or binaries. E.g. ComponentA 2.6.6 ComponentB 1.1 ComponentC 0.12 The list is more than 300 components long, so ...
2
votes
1answer
270 views

Scanning a binary against YARA rules dictionary

I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
0
votes
3answers
88 views

Scan for infection of malicious files manually?

I know there are options of free security softwares out there that do good job like malwarebytes, but I really want to learn how to scan for possible threats of malicious files on your pc manually. I ...
1
vote
2answers
86 views

What is the recommanded periodicity for antivirus RAM and disk scans?

Antivirus scans consumes resources, and far more when the full disk or RAM is scanned. Anyway, files are scanned before opening and often when they enter the system, so periodic scans on this point of ...
0
votes
1answer
239 views

Virustotal detecting threats in Suricata rule set

Virustotal scans are detecting threats from the Suricata default rule pack located https://rules.emergingthreats.net/open/suricata-4.0/ Is this a false positive? https://www.virustotal.com/#/file/...
0
votes
3answers
3k views

Port sweep vs port scan

I was asked this question in an interview: "What is a port sweep?" When I replied with port scan he said that my answer was not a scan, it was a port sweep. I googled and found "tcp sweep: but not "...
2
votes
1answer
152 views

Port Knock logs suggest machine has been compromised?

On my CentOS machine, all my ports are filtered with the Iptables rule: DROP all -- * * 0.0.0.0/0 0.0.0.0/0 So from the Internet, every port timeouts. The only way to ...
4
votes
1answer
517 views

How to distinguish between “normal internet” Port scan and more “serious” port scan preparing attack?

In a complete network infrastructure, with firewalls, routers, servers supervised by a SIEM, LogPoint here. Of course, there is a private network and public servers. in the LogPoint there is an ...
0
votes
1answer
707 views

Modify Win OS banner to avoid OS detection

I would like to modify Win OS banner to defeat OS detection from scanning tools like Nmap for example. Although, I know that Nmap does not take into account just the banner to do OS detection.
0
votes
2answers
7k views

Quick scan of a /8 subnet with nmap

I am trying to scan a full subnet (10.0.0.0/8) using nmap. I am using the command nmap –v –sn 10.0.0.0/8. I specifically just want to detect active hosts without scanning ports because I thought that ...
1
vote
0answers
187 views

How to use a web vulnerability scanner to autenthicate through in order to do the scan

I thinking about use a various mix of different scanner such as: Burp-suite Acunetix Vulnerability Scanner Arachni Owasp Zed Attack Proxy Project Vega W3af though we have Active directory that is ...
1
vote
1answer
104 views

Why are network scans coming from my router?

I'm seeing notifications from my antivirus software that scans are being blocked. Some are from external IP addresses, but others are coming from my router. For example, here's the text from one ...
1
vote
1answer
2k views

Port scans: 'traffic denied' VS 'close - age out'

I have been investigating logs from the firewall (Juniper) and I've found out that when someone is portscanning my website, the majority of the traffic through different tcp/udp ports is denied (...
0
votes
1answer
653 views

“Windows Unquoted Search” Fix?

Now I may have missed it but I was reading up on common windows issues and "Windows Unquoted Search Path or Element can allow local privilege escalation" keeps appearing. I am amazed that this is ...
2
votes
1answer
916 views

nmap results after evading firewall

I've done an nmap scan on my server with an F5 firewall protecting it. I used the nmap command nmap -vvv -f -Pn -mtu 8 -sN -oN nmap-results.txt 192.168.22.102 I had this result but it seems ...
2
votes
1answer
51 views

Downloaded MailMergePro file seems to have virus attached

I downloaded MailMerge Pro from http://www.standss.com/emailmerge/download_process.asp website and i scanned it on VirusTotal.com and two of the antivirus flagged it. I am sharing the link for same, i ...
1
vote
1answer
2k views

Clamscan: infected files found

From time to time, I perform a scan with clamscan. I'm on Archlinux. Clamscan database is updated before each scan. Today clasmscan reported 19 infected files: ./.cache/mozilla/firefox/qyq0onej....
0
votes
1answer
2k views

how to detect udp port scan in suricata?

I'd like to detect udp port scan in Suricata. I searched google, but I didn't manage to find Suricata rule for detecting UDP port scan attempts. I saw before a snort rule for this scan. How can we ...
2
votes
2answers
3k views

Service running on a closed port?

I just finished scanning a host and I found something unusual. My question is regarding port 50000 and 50002. Nmap shows that these ports are closed and also identifies the services running on them!...
0
votes
2answers
73 views

Scan for a specific virus type?

Is it possible to tell an antivirus which specific virus type (worm, macro etc) to scan for? Assuming I know the type of virus and just want to save time and scan for it specifically instead of ...
1
vote
2answers
887 views

Scan my network externally [closed]

So I'm about to undertake Cyber Essentials as our first step towards nailing as best as we can our security. I have done quite a lot of work on locking down our network, however, I would like audit ...
0
votes
1answer
97 views

Symantc Endpoint protection keeps detecting clean file as risk

I downloaded some files from website using FTP and these websites have been developed using .net and any .dll file is flagged as Risk by our Antivirus. our IT Made some changes to antivirus on my ...
2
votes
1answer
473 views

Is it possible to scan the top X UDP ports and the top Y (X!=Y) TCP ports in Nmap using a single command?

Given X!=Y, is there any way to scan the top (--top-ports) X TCP ports and the top Y UDP ports using a simple Nmap command? The --top-ports parameter affects both the TCP and UDP scans (e.g., when -...
0
votes
1answer
114 views

server that responds on any port [closed]

I want to make a server that responds open to every port that is scanned by nmap (TCP and UDP). Are there a simple solution to do that?
4
votes
1answer
181 views

What allows for reinfection of the same PUP after quarantine and removal?

I use an antimalware program- the scan finds a PUP (Potentially Unwanted Program), which is quarantined and removed. It comes back! I am guessing it is stored somehow to resurface after normal shut ...
0
votes
1answer
193 views

How can I run nmap scan via multiple proxies (not chained; each proxy will be used for disjoint part of the scan)?

How can I run nmap scan via multiple proxies, such that each proxy will actually send only part of the packets? For example, assuming that a scan sends X requests, and I have Y proxies, I would like ...
1
vote
1answer
31 views

Reason behind sending multiple probes when scanning?

I've read, that the ZMap creators recommend to send three probes for each (ip,port) tuple when scanning. Let's say, we scan port 443 port with a TCP SYN scan. One reason, I can imagine is packet loss. ...
0
votes
3answers
260 views

Using Nmap kicks me out my own network

I am working on a school task, where I have to use Nmap in order to scan for open port on another device on the same network. However, when I use Nmap my network suddenly gets limited. I have tried ...
0
votes
1answer
76 views

How to know if locally installed programs (like Re Image) are malware

Not sure where to ask this question but figured I'd ask it here, at least in a generic way. I installed a program called Re Image as I red it helps with system instability problems. However, I then ...
7
votes
1answer
4k views

How does one scan a MySQL database for malware?

I have a lot of means of searching for malicious code within the file system, monitoring traffic, scanning log files, checking for suspicious/masked processes etc. However, scanning a relational ...
5
votes
1answer
202 views

Is there a need to scan images with real-time scanners anymore?

Historically, there were some exploits for certain types of image files, notably JPEG images. Consequently, many real-time malware scanners (antivirus included) started scanning every JPEG image (as ...
3
votes
1answer
704 views

Best practices manual for Alienvault USM?

Is there any best practices manual for Alienvault USM? I found some information about the profiles for the vulnerability scanner but nothing about how often I should launch the scan or which ...
-2
votes
2answers
195 views

Professional Scanner with nmap

Can one scan a range of IP addresses and detect if a specific version of FTP-, which is FTP Service 7.5 is running using nmap?
1
vote
1answer
500 views

Scan detection Tool better than Snort Portscan Preprocessor

I am working on detection of Scanning activities of Bots/Worms. I have found that Snort Portscan Preprocessor detects Scan activities. I have tweaked Snort Portscan Preprocessor to detect different ...