Questions tagged [scan]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
57
votes
3answers
9k views

eBay web site tries to connect to wss://localhost:xxxxx - is this legit or they have some Malware JS running?

In helping a corporate user log on to eBay, I noticed that when on the login page, a stream of errors were coming up in the Firefox JS Console about not being able to connect to wss://localhost. This ...
16
votes
5answers
5k views

How can an attacker identify if a website is using PHP? How about the PHP version?

I have a vulnerable test site up that runs PHP. How can an attacker identify that PHP is used? if I type .../add.php the site gives back an error message, although the file is add.php. If I type .../...
15
votes
4answers
10k views

Can I block viruses from a USB stick by scanning it before opening its folder?

I inserted my USB stick into a friend's PC which was full of viruses, malwares and adwares. Therefore I suppose they attacked my USB device as well. Now I want to use my USB device on my PC without ...
10
votes
2answers
2k views

What's the advantage of sending an RST packet after getting a response in a SYN scan?

I'm reading about nmap's SYN scan, and it says Nmap sends an RST immediately after the server tries to establish the handshake. My question is - why bother with the RST? Is it to prevent the server ...
8
votes
3answers
44k views

How to use nmap through proxychains?

I am running nmap through proxychains using this command: proxychains nmap -v scanme.namp.org This produced an error: root@kali:~# proxychains nmap -v scanme.nmap.org ProxyChains-3.1 (http://...
7
votes
4answers
2k views

Do mail servers follow links in emails as part of a security scan before inbox delivery?

I've implemented a passwordless login using a magic link and email. The link can be used only once. One customer is complaining that once they click the link, the page reports that the link is already ...
7
votes
1answer
6k views

How does one scan a MySQL database for malware?

I have a lot of means of searching for malicious code within the file system, monitoring traffic, scanning log files, checking for suspicious/masked processes etc. However, scanning a relational ...
6
votes
1answer
870 views

Can network admin detect port scan on a certain host?

Say, my laptop is connected to a large WiFi network with many other users. If a port scan is run on my IP by somebody else on the same WiFi network, is it possible for the network admin (or anybody) ...
5
votes
1answer
236 views

Is there a need to scan images with real-time scanners anymore?

Historically, there were some exploits for certain types of image files, notably JPEG images. Consequently, many real-time malware scanners (antivirus included) started scanning every JPEG image (as ...
5
votes
2answers
276 views

What allows for reinfection of the same PUP after quarantine and removal?

I use an antimalware program- the scan finds a PUP (Potentially Unwanted Program), which is quarantined and removed. It comes back! I am guessing it is stored somehow to resurface after normal shut ...
4
votes
1answer
1k views

How to distinguish between “normal internet” Port scan and more “serious” port scan preparing attack?

In a complete network infrastructure, with firewalls, routers, servers supervised by a SIEM, LogPoint here. Of course, there is a private network and public servers. in the LogPoint there is an ...
4
votes
1answer
769 views

Best practices manual for Alienvault USM?

Is there any best practices manual for Alienvault USM? I found some information about the profiles for the vulnerability scanner but nothing about how often I should launch the scan or which ...
4
votes
1answer
119 views

Thorough computer scan

I'd like to give my computer an overall deep scan against all kinds of malware. I was infected about a year ago and I feel like there may still be some hidden rootkit on my HDD or something like that....
3
votes
2answers
3k views

Service running on a closed port?

I just finished scanning a host and I found something unusual. My question is regarding port 50000 and 50002. Nmap shows that these ports are closed and also identifies the services running on them!...
3
votes
1answer
75 views

Why are full port scans more susceptible to being logged than half-open port scans?

Many resources I come across state that one major advantage of full-port scans (e.g. SYN scans) is the fact that there is a lower risk of being logged. But why? In my opinion, the sequence of ...
3
votes
2answers
3k views

Gmail warns about encrypted PDF file

I recently received a PDF file that, when attached to a gmail message, causes a warning to be displayed as follows: Encrypted attachment warning – Be careful with this attachment. This message ...
3
votes
1answer
556 views

Is it possible to scan the top X UDP ports and the top Y (X!=Y) TCP ports in Nmap using a single command?

Given X!=Y, is there any way to scan the top (--top-ports) X TCP ports and the top Y UDP ports using a simple Nmap command? The --top-ports parameter affects both the TCP and UDP scans (e.g., when -...
3
votes
1answer
889 views

Is OpenVas an active or passive scanner? [closed]

I am using Ossim and I did a scan vulnerabilities with OpenVas. I received feedback that some of our softwares broke after the scan. We will check the logs to see if the scan cause this, but I was ...
3
votes
1answer
127 views

Verifying Host Sterility After Running Malware Tests on Virtual Machine

I know that "VM escape" is becoming a common issue now with malware testing. I'm just wondering if there's any way of verifying if the host system is clean from any infection after running a malware ...
3
votes
1answer
57 views

Systematic exploitation of software components [closed]

My question is rather generic. People are likely to downvote the question and admins will be tempted to close it at off-topic etc. But, I couldn't help myself asking the question to seek some fruitful ...
2
votes
3answers
7k views

Why is UDP port scanning slower than TCP port scanning?

I can't seem to find an answer for this. Any suggestions?
2
votes
3answers
294 views

Is there a more precise approach to generate signatures for ClamAV, than regex signatures?

Actually I generate signatures from libraries, to scan executables for beeing statically linked to that library. My actual approach is to read out the .text section and generate a byte sequence for ...
2
votes
1answer
3k views

Clamscan: infected files found

From time to time, I perform a scan with clamscan. I'm on Archlinux. Clamscan database is updated before each scan. Today clasmscan reported 19 infected files: ./.cache/mozilla/firefox/qyq0onej....
2
votes
2answers
6k views

How do I scan my Routers Ports? [duplicate]

I recently scanned ports from within my LAN, but I recently read in order to determine whether Ports are open to the WAN I need to scan from outside the LAN, how do I do this?
2
votes
2answers
1k views

nmap output to file different than interactive output?

I am running a simple SYN scan of all ports on all hosts that I found on a previous ping scan saved to a file: targets like this: nmap -sS -p- -v -T5 -oN puzzling.txt -iL targets As the scan runs ...
2
votes
1answer
342 views

Why would I use an ACK scan over a FIN scan and vice versa?

I understand that both scans return RST packets and you can use this to scan hosts behind poorly configured firewalls. Is the idea to use both in case the firewall doesn't check for one? For example ...
2
votes
1answer
10k views

What is this service? [closed]

Fairly new to infosec and am going through a course on nmap. While scanning I found this and it looked interesting and was wondering if you all had any information on this? This is the port,state and ...
2
votes
1answer
2k views

nmap results after evading firewall

I've done an nmap scan on my server with an F5 firewall protecting it. I used the nmap command nmap -vvv -f -Pn -mtu 8 -sN -oN nmap-results.txt 192.168.22.102 I had this result but it seems ...
2
votes
1answer
56 views

Downloaded MailMergePro file seems to have virus attached

I downloaded MailMerge Pro from http://www.standss.com/emailmerge/download_process.asp website and i scanned it on VirusTotal.com and two of the antivirus flagged it. I am sharing the link for same, i ...
2
votes
2answers
544 views

Why is my computer connected to amazon instances

When I run the command netstat -a to see the actual connections on my computer, I see all the time that my computer is connected to something like this ec2-xx-xx-xx-xx, not just one address it changes ...
2
votes
1answer
595 views

Scanning a binary against YARA rules dictionary

I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
2
votes
1answer
219 views

Port Knock logs suggest machine has been compromised?

On my CentOS machine, all my ports are filtered with the Iptables rule: DROP all -- * * 0.0.0.0/0 0.0.0.0/0 So from the Internet, every port timeouts. The only way to ...
2
votes
1answer
4k views

How to scan large .bin files for malware?

I know about websites like VirusTotal, and programs like herdprotect. I'm using Avira and Superantispyware, but once the large bin files are scanned, usually nothing is found. But after running an ...
2
votes
0answers
149 views

Where to run long automated scans? [closed]

I'm trying to run some automated scans without stopping for long periods of time (each scan can take anywhere from 8 hours to 3 days). I currently don't have a PC I can leave running for many days ...
2
votes
1answer
58 views

Given a list of components and versions, how can I check if any of them have known vulnerabilities?

In this case, I have a list of names and versions, but not access to any source code or binaries. E.g. ComponentA 2.6.6 ComponentB 1.1 ComponentC 0.12 The list is more than 300 components long, so ...
2
votes
0answers
793 views

Snort Portscan Preprocessor Analysis

Remarks I really apologize if this content isn't matching the community, but I am not getting approved on snort-mailing lists and I don't know what can I do for the same, therefore I feel this can be ...
2
votes
1answer
2k views

Detect port scans on Linux (centos) [closed]

I have OSSEC installed on my hosts. I want to detect port scans and generate an alert in OSSEC. So, how can I detect these port scans? Is it possible reading iptables logs? Do you recommend some ...
2
votes
0answers
82 views

Does hping support FTP Bounce scanning?

Does hping support FTP Bounce scanning? I googled it, but I couldn't find its command, so I think it didn't support it. I just find command for nmap not hping.
2
votes
0answers
924 views

Amazon Web Services - Relational Database Service - Security Scan

My company is utilizing AWS for it's infrastructure including Mysql RDS instances for our databases. Everything we have is in a VPC and requires access through our VPN. Our databases are all not ...
1
vote
2answers
1k views

Scan my network externally [closed]

So I'm about to undertake Cyber Essentials as our first step towards nailing as best as we can our security. I have done quite a lot of work on locking down our network, however, I would like audit ...
1
vote
3answers
651 views

Snort Unable to detect portscans in LAN

Setup Information I am doing experiment on portscan detection using snort 2.9.8.I have 10 systems in my lab with id:1,2,3,...,10. i have installed snort in my lab-pc with id:1.Now i am using Pc with ...
1
vote
2answers
590 views

“CHANGELOG.txt” in Apache logs

Recently I've been seeing a major uptick in the following type of requests to my Apache logs: "GET /CHANGELOG.txt HTTP/1.1" 404 211 About a month ago, I received none. Now I receive a dozen or so ...
1
vote
2answers
300 views

Is VirusTotal useful for finding malware in a WordPress database SQL export?

Does VirusTotal detect malware in an SQL export? I have an infected WordPress site. I removed the malware with various tools, however I know from experience, that sometimes it hides itself somewhere ...
1
vote
2answers
2k views

How secure is the fingerprint sensor in the Pixel 3?

As far as I understand different fingerprint scanners have different security levels. Old fingerprint print scanners could be fooled quite easily as the CCC (Chaos Computer Club) demonstrated. How ...
1
vote
2answers
98 views

What is the recommanded periodicity for antivirus RAM and disk scans?

Antivirus scans consumes resources, and far more when the full disk or RAM is scanned. Anyway, files are scanned before opening and often when they enter the system, so periodic scans on this point of ...
1
vote
1answer
34 views

Reason behind sending multiple probes when scanning?

I've read, that the ZMap creators recommend to send three probes for each (ip,port) tuple when scanning. Let's say, we scan port 443 port with a TCP SYN scan. One reason, I can imagine is packet loss. ...
1
vote
2answers
18k views

Network scan across multiple subnets and output list of names and IP's

We have multiple sites with multiple subnets. We have mandated that the admins at those sites enter DNS names for all devices that exist on the network. (anything with an IP gets a name) I want to be ...
1
vote
1answer
116 views

Security pattern for third party uploads to Azure blob container

Scenario: Vendor 1 needs to upload data (.json, compressed .csv files, images and video) to an Azure blob storage container owned by Vendor 2 Vendor 1 is issued a limited duration SAS token each day ...
1
vote
1answer
114 views

RHEL7 SSGv0.1 2.2.3 Unauthorized SUID/GUID executables

We are upgrading to RHEL 7.6. My Nessus scanner is giving me the following message: 2.2.3.c-d Mandatory Review Required: Find unauthorized SUID/GUID System Executables RHEL7 SSGv0.1 2.2.3 Unauthorized ...
1
vote
1answer
187 views

Determine victim of port scan's OS

I am taking part in a practice sandbox, and have a pcap file in Wireshark: with the traffic depicting a Vertical Port Scan. Is there anyway to find out the "victim"'s Operating System? The packets are ...