Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [scan]

The tag has no usage guidance.

0
votes
0answers
27 views

Any way to SCAP scan a RHEL 5 server for open STIGs?

We have RHEL 5 servers in our environment. Looking to move off of them, but I need to check how many STIGs are open findings. I tried installing OpenSCAP on a CentOS 5 VM at home and using the oscap ...
2
votes
1answer
43 views

Verifying Host Sterility After Running Malware Tests on Virtual Machine

I know that "VM escape" is becoming a common issue now with malware testing. I'm just wondering if there's any way of verifying if the host system is clean from any infection after running a malware ...
0
votes
1answer
50 views

What is this service? [closed]

Fairly new to infosec and am going through a course on nmap. While scanning I found this and it looked interesting and was wondering if you all had any information on this? This is the port,state and ...
1
vote
0answers
42 views

nmap - No Ports Open [closed]

I bought a Tonbux Smart WiFi Plug WL-SC01 and I'm doing some hack tests on it for educational purposes. I used nmap to check for both UDP and TCP ports but both return that there are no open ports at ...
1
vote
1answer
51 views

Determine victim of port scan's OS

I am taking part in a practice sandbox, and have a pcap file in Wireshark: with the traffic depicting a Vertical Port Scan. Is there anyway to find out the "victim"'s Operating System? The packets are ...
0
votes
1answer
152 views

Is there anywhere we can scan projects (PHP, JAVA…) for vulnerabilities, like VirusTotal.com does (All-in-one)? [closed]

Virustotal is excellent in its field. Does there exist any tool (or site) where we could upload (or that could be also an offline PC version) to test projects or websites (PHP, Java, whatever) for ...
0
votes
0answers
107 views

Telnet output with nmap

I made a scan on a server with nmap with these options : nmap -sT -A -P0 and this is the output for the telnet port (23) : PORT STATE SERVICE VERSION 23/tcp open telnet | fingerprint-strings: ...
1
vote
2answers
544 views

How secure is the fingerprint sensor in the Pixel 3?

As far as I understand different fingerprint scanners have different security levels. Old fingerprint print scanners could be fooled quite easily as the CCC (Chaos Computer Club) demonstrated. How ...
2
votes
1answer
54 views

Given a list of components and versions, how can I check if any of them have known vulnerabilities?

In this case, I have a list of names and versions, but not access to any source code or binaries. E.g. ComponentA 2.6.6 ComponentB 1.1 ComponentC 0.12 The list is more than 300 components long, so ...
2
votes
1answer
141 views

Scanning a binary against YARA rules dictionary

I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
0
votes
3answers
76 views

Scan for infection of malicious files manually?

I know there are options of free security softwares out there that do good job like malwarebytes, but I really want to learn how to scan for possible threats of malicious files on your pc manually. I ...
1
vote
2answers
78 views

What is the recommanded periodicity for antivirus RAM and disk scans?

Antivirus scans consumes resources, and far more when the full disk or RAM is scanned. Anyway, files are scanned before opening and often when they enter the system, so periodic scans on this point of ...
0
votes
1answer
159 views

Virustotal detecting threats in Suricata rule set

Virustotal scans are detecting threats from the Suricata default rule pack located https://rules.emergingthreats.net/open/suricata-4.0/ Is this a false positive? https://www.virustotal.com/#/file/...
0
votes
3answers
2k views

Port sweep vs port scan

I was asked this question in an interview: "What is a port sweep?" When I replied with port scan he said that my answer was not a scan, it was a port sweep. I googled and found "tcp sweep: but not "...
2
votes
1answer
119 views

Port Knock logs suggest machine has been compromised?

On my CentOS machine, all my ports are filtered with the Iptables rule: DROP all -- * * 0.0.0.0/0 0.0.0.0/0 So from the Internet, every port timeouts. The only way to ...
4
votes
1answer
308 views

How to distinguish between “normal internet” Port scan and more “serious” port scan preparing attack?

In a complete network infrastructure, with firewalls, routers, servers supervised by a SIEM, LogPoint here. Of course, there is a private network and public servers. in the LogPoint there is an ...
0
votes
1answer
526 views

Modify Win OS banner to avoid OS detection

I would like to modify Win OS banner to defeat OS detection from scanning tools like Nmap for example. Although, I know that Nmap does not take into account just the banner to do OS detection.
0
votes
2answers
5k views

Quick scan of a /8 subnet with nmap

I am trying to scan a full subnet (10.0.0.0/8) using nmap. I am using the command nmap –v –sn 10.0.0.0/8. I specifically just want to detect active hosts without scanning ports because I thought that ...
1
vote
0answers
153 views

How to use a web vulnerability scanner to autenthicate through in order to do the scan

I thinking about use a various mix of different scanner such as: Burp-suite Acunetix Vulnerability Scanner Arachni Owasp Zed Attack Proxy Project Vega W3af though we have Active directory that is ...
1
vote
1answer
102 views

Why are network scans coming from my router?

I'm seeing notifications from my antivirus software that scans are being blocked. Some are from external IP addresses, but others are coming from my router. For example, here's the text from one ...
1
vote
1answer
1k views

Port scans: 'traffic denied' VS 'close - age out'

I have been investigating logs from the firewall (Juniper) and I've found out that when someone is portscanning my website, the majority of the traffic through different tcp/udp ports is denied (...
0
votes
1answer
464 views

“Windows Unquoted Search” Fix?

Now I may have missed it but I was reading up on common windows issues and "Windows Unquoted Search Path or Element can allow local privilege escalation" keeps appearing. I am amazed that this is ...
2
votes
1answer
709 views

nmap results after evading firewall

I've done an nmap scan on my server with an F5 firewall protecting it. I used the nmap command nmap -vvv -f -Pn -mtu 8 -sN -oN nmap-results.txt 192.168.22.102 I had this result but it seems ...
2
votes
1answer
49 views

Downloaded MailMergePro file seems to have virus attached

I downloaded MailMerge Pro from http://www.standss.com/emailmerge/download_process.asp website and i scanned it on VirusTotal.com and two of the antivirus flagged it. I am sharing the link for same, i ...
1
vote
1answer
1k views

Clamscan: infected files found

From time to time, I perform a scan with clamscan. I'm on Archlinux. Clamscan database is updated before each scan. Today clasmscan reported 19 infected files: ./.cache/mozilla/firefox/qyq0onej....
0
votes
1answer
2k views

how to detect udp port scan in suricata?

I'd like to detect udp port scan in Suricata. I searched google, but I didn't manage to find Suricata rule for detecting UDP port scan attempts. I saw before a snort rule for this scan. How can we ...
1
vote
2answers
2k views

Service running on a closed port?

I just finished scanning a host and I found something unusual. My question is regarding port 50000 and 50002. Nmap shows that these ports are closed and also identifies the services running on them!...
0
votes
2answers
69 views

Scan for a specific virus type?

Is it possible to tell an antivirus which specific virus type (worm, macro etc) to scan for? Assuming I know the type of virus and just want to save time and scan for it specifically instead of ...
1
vote
2answers
695 views

Scan my network externally [closed]

So I'm about to undertake Cyber Essentials as our first step towards nailing as best as we can our security. I have done quite a lot of work on locking down our network, however, I would like audit ...
0
votes
1answer
83 views

Symantc Endpoint protection keeps detecting clean file as risk

I downloaded some files from website using FTP and these websites have been developed using .net and any .dll file is flagged as Risk by our Antivirus. our IT Made some changes to antivirus on my ...
3
votes
1answer
421 views

Is it possible to scan the top X UDP ports and the top Y (X!=Y) TCP ports in Nmap using a single command?

Given X!=Y, is there any way to scan the top (--top-ports) X TCP ports and the top Y UDP ports using a simple Nmap command? The --top-ports parameter affects both the TCP and UDP scans (e.g., when -...
0
votes
1answer
112 views

server that responds on any port [closed]

I want to make a server that responds open to every port that is scanned by nmap (TCP and UDP). Are there a simple solution to do that?
4
votes
1answer
152 views

What allows for reinfection of the same PUP after quarantine and removal?

I use an antimalware program- the scan finds a PUP (Potentially Unwanted Program), which is quarantined and removed. It comes back! I am guessing it is stored somehow to resurface after normal shut ...
0
votes
1answer
162 views

How can I run nmap scan via multiple proxies (not chained; each proxy will be used for disjoint part of the scan)?

How can I run nmap scan via multiple proxies, such that each proxy will actually send only part of the packets? For example, assuming that a scan sends X requests, and I have Y proxies, I would like ...
1
vote
1answer
29 views

Reason behind sending multiple probes when scanning?

I've read, that the ZMap creators recommend to send three probes for each (ip,port) tuple when scanning. Let's say, we scan port 443 port with a TCP SYN scan. One reason, I can imagine is packet loss. ...
0
votes
3answers
187 views

Using Nmap kicks me out my own network

I am working on a school task, where I have to use Nmap in order to scan for open port on another device on the same network. However, when I use Nmap my network suddenly gets limited. I have tried ...
0
votes
1answer
76 views

How to know if locally installed programs (like Re Image) are malware

Not sure where to ask this question but figured I'd ask it here, at least in a generic way. I installed a program called Re Image as I red it helps with system instability problems. However, I then ...
7
votes
1answer
4k views

How does one scan a MySQL database for malware?

I have a lot of means of searching for malicious code within the file system, monitoring traffic, scanning log files, checking for suspicious/masked processes etc. However, scanning a relational ...
5
votes
1answer
189 views

Is there a need to scan images with real-time scanners anymore?

Historically, there were some exploits for certain types of image files, notably JPEG images. Consequently, many real-time malware scanners (antivirus included) started scanning every JPEG image (as ...
3
votes
1answer
654 views

Best practices manual for Alienvault USM?

Is there any best practices manual for Alienvault USM? I found some information about the profiles for the vulnerability scanner but nothing about how often I should launch the scan or which ...
-2
votes
2answers
191 views

Professional Scanner with nmap

Can one scan a range of IP addresses and detect if a specific version of FTP-, which is FTP Service 7.5 is running using nmap?
-1
votes
0answers
100 views

Frequency of Stealth scan?

Background I am working on snort Portscan Module to detect Stealth scans.Snort uses good amount of datastructures to capture scanning events and to explicitly set the threshold values. typedef ...
1
vote
1answer
444 views

Scan detection Tool better than Snort Portscan Preprocessor

I am working on detection of Scanning activities of Bots/Worms. I have found that Snort Portscan Preprocessor detects Scan activities. I have tweaked Snort Portscan Preprocessor to detect different ...
8
votes
2answers
1k views

What's the advantage of sending an RST packet after getting a response in a SYN scan?

I'm reading about nmap's SYN scan, and it says Nmap sends an RST immediately after the server tries to establish the handshake. My question is - why bother with the RST? Is it to prevent the server ...
-3
votes
2answers
726 views

How do Hackers and Security Researchers Scan The Internet For Vulnerable Servers and Devices? [closed]

I would like to know how Security Researchers and hackers scan the internet to find vulnerable devices. For example in this article here, what sort of request/packets are those researchers sending to ...
4
votes
3answers
19k views

How to use nmap through proxychains?

I am running nmap through proxychains using this command: proxychains nmap -v scanme.namp.org This produced an error: root@kali:~# proxychains nmap -v scanme.nmap.org ProxyChains-3.1 (http://...
1
vote
2answers
3k views

Wireshark as a network scanner [closed]

I have been playing with nmap lately, trying out arp-ping scanning and using idle hosts, etc... Looking at Wireshark, there is always some suspicious activity when performing scans. The thing is, I ...
1
vote
3answers
4k views

Why is UDP port scanning slower than TCP port scanning?

I can't seem to find an answer for this. Any suggestions?
15
votes
4answers
7k views

Can I block viruses from a USB stick by scanning it before opening its folder?

I inserted my USB stick into a friend's PC which was full of viruses, malwares and adwares. Therefore I suppose they attacked my USB device as well. Now I want to use my USB device on my PC without ...
1
vote
3answers
457 views

Snort Unable to detect portscans in LAN

Setup Information I am doing experiment on portscan detection using snort 2.9.8.I have 10 systems in my lab with id:1,2,3,...,10. i have installed snort in my lab-pc with id:1.Now i am using Pc with ...