96
votes
Accepted
Does a fake SSH server have any purpose security-wise?
The reasons to have such fake SSH servers are multiple. They include such as:
determining whether you’re under attack
knowing the users and passwords guessed (which can display the intel the attacker ...
- 992
55
votes
How do you deal with massive port scans?
I ignore them. And if you have a reasonable security posture, you should too.
Your servers should have no ports open to the general public other than those that you use to serve the general public.
...
- 83.3k
44
votes
How wise is it to use a tool for portspoofing at your server to confuse attackers?
Multiple problems here.
Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence.
You're burning CPU ...
- 759
27
votes
Does a fake SSH server have any purpose security-wise?
It can be used as honeypot/research to collect most used password attempts and the like.
Otherwise, I agree with your assessment, it's an attractive nuisance.
If you are looking for actual ...
- 8,118
21
votes
Accepted
Nmap through proxy
TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy.
nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. ...
- 198k
21
votes
Accepted
Nmap - Closed vs Filtered
This largely depends on the used scan. The Nmap scan types page explains the status of the port and the reasons per scan.
Some examples:
TCP SYN Scan (-sS)
- Sends a TCP packet with SYN flag set
- ...
- 2,379
19
votes
How do you deal with massive port scans?
I don't believe in enumerating badness. If you have infrastructure sitting on the internet it's going to get scanned all the time by numerous IPs.
For example, I created an AWS app that turns up ...
- 1,125
19
votes
Accepted
How can a webpage scan my local, internal network from the Internet?
On the application layer, your browser has no notion of internal and external IP addresses. So any website can simply tell your browser to request a resource from your internal network. This wouldn't ...
- 44.7k
18
votes
Accepted
Stop Nmap scan and preserve XML output
Nmap dev here: Sorry, but there is not an option to cleanly stop a scan and finalize the XML output. The --resume option, as you noted, only works with Normal and Grepable output. It also cannot cope ...
- 11.6k
18
votes
Accepted
Why doesn't `nmap -sn 192.168.2.1/150` show the hosts that are up?
Your first example uses the CIDR notation to specify the host range as a netmask.
But since /150 is an illegal value for an IPv4 subnet mask, nmap falls back to the largest plausible value which is /...
- 44.7k
14
votes
VM Kali Linux - nmap why is so slow?
Possibilities:
You are using a VM with a virtual NAT (Network Address Translation) network adapter. I have experienced profound slowdown under VirtualBox, for instance, when using NAT instead of a ...
- 11.6k
12
votes
What are the best pratices to avoid my server being port scanned
Portknocking
Portknocking is a method to open ports that the firewall normally keeps closed by executing a series of connection attempts (knocks) to other ports. Upon the valid sequence of port knocks,...
- 2,764
11
votes
How much traffic can a firewall node handle? Any real examples?
Having done tests for multiple clients where they claim "scans won't knock this over, you'll be alright", then an hour later we're having a meeting discussing how they're going to handle a serious ...
- 135k
11
votes
Does a fake SSH server have any purpose security-wise?
A good use for an open and fake ssh server like this is to set it up on a corporate LAN as a honeypot. Give it an attractive (but not obviously fake) hostname set up syslog forwarding to your SIEM ...
- 2,691
10
votes
Why is UDP port scanning slower than TCP port scanning?
The difference is in the very nature of the two protocols.
TCP is a connection-oriented protocol. This means that systems must establish and confirm a stable connection - for TCP, the process is ...
- 27.1k
10
votes
Nmap through proxy
For now, use an external tool like proxychains.
The nmap documentation for --proxies states, that the feature is not fully implemented yet:
Warning: this feature is still under development and has ...
- 44.7k
9
votes
Accepted
VM Kali Linux - nmap why is so slow?
bonsaiviking's answer is valid, but here are a few more points:
-sT scan realise a full TCP handshake, it takes significantly longer than a -sS (SYN Stealth Scan): Basically,
You send a Syn, ...
- 695
9
votes
nmap to scan all resolved ip addresses for a given domain name?
Nmap has a script to do this, resolveall. The interface isn't as nice as it could be: you have to provide the hostname via the resolveall.hosts script argument. Here's how to do that and also add any ...
- 11.6k
9
votes
How wise is it to use a tool for portspoofing at your server to confuse attackers?
I assume the effectiveness will be very limited.
First of all, exploiting port scanning tools will rarely be useful because most pentesters will use VMs and other confined environments when ...
- 1,955
9
votes
Accepted
Multiple Open ports on a server, is that safe?
There are a lot of misunderstandings and assumptions in your question, but I will try to address them.
First, you are scanning a domain (I assume from the Internet). Just because nmap shows them as ...
- 128k
8
votes
Accepted
Why can I ping a server, but nmap normal scan cannot see the host?
From nmap.org:
If no host discovery options are given, Nmap sends an ICMP echo
request, a TCP SYN packet to port 443, a TCP ACK packet to port 80,
and an ICMP timestamp request. ... For unprivileged
...
- 12.7k
7
votes
Accepted
Netdiscover running on NAT interface not finding IP addresses on host-only network?
Netdiscover finds IP addresses using the Address Resolution Protocol (ARP), which matches IP addresses to MAC addresses. However, ARP by design will not cross network boundaries (see for example at ...
- 2,042
7
votes
Accepted
Scanning private IPs from outside network
Not using a VPN or some other way to be connected as if you were local, the answer is "no", but not because of a limitation in Nmap or any similar tool.
The primary reason this won't work is ...
- 14.2k
7
votes
Accepted
/hnap1/ scans router compromised or worm?
What you found was that a device connected to your web server and requested /HNAP1/
HNAP is a protocol for managing devices, so with just this information about potential attacks, my guess is that ...
- 18.8k
7
votes
Accepted
What are some instant red flags when scanning an network with nmap
To echo gameOver's comment and elaborate further, simply detecting that a port is open is interesting but I wouldn't see it as an immediate 'red flag'. Perhaps a better approach might be to run Nmap ...
- 1,034
7
votes
Accepted
Why do I need root privileges to send a raw packet from a UNIX machine?
The security model in UNIX is traditionally centered around having hardware and network controlled by the network administrators and then having unprivileged users separate from these administrators ...
- 198k
6
votes
Router Receiving Unknown Packets from the Same IP and Port Even After Address Rotations - How?
How much of the public IP is changing upon the DHCP renew? How quickly before you see the packets upon getting a new IP?
This is unlikely a targeted attack and more likely a shotgun-approach scanner ...
- 61
5
votes
nmap OS scan showing DD-WRT when I'm not running it?
The answer is in your question :
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Nmap literally guesses which OS is on the machine. Didn't work ...
- 409
5
votes
Discovering IP or Mac address of mobile devices passing by.
Yes, the MAC address can easily be discovered, but your device won't have an IP address unless it's connected to some network!
Let's assume that you are not connected to any network.
The attacker ...
- 2,495
Only top scored, non community-wiki answers of a minimum length are eligible