96 votes
Accepted

Does a fake SSH server have any purpose security-wise?

The reasons to have such fake SSH servers are multiple. They include such as: determining whether you’re under attack knowing the users and passwords guessed (which can display the intel the attacker ...
user avatar
55 votes

How do you deal with massive port scans?

I ignore them. And if you have a reasonable security posture, you should too. Your servers should have no ports open to the general public other than those that you use to serve the general public. ...
user avatar
  • 81.9k
44 votes

How wise is it to use a tool for portspoofing at your server to confuse attackers?

Multiple problems here. Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence. You're burning CPU ...
user avatar
35 votes
Accepted

Open-source penetration-test automation

The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as Loki (...
user avatar
  • 18.9k
27 votes

Does a fake SSH server have any purpose security-wise?

It can be used as honeypot/research to collect most used password attempts and the like. Otherwise, I agree with your assessment, it's an attractive nuisance. If you are looking for actual ...
user avatar
  • 7,298
19 votes

How do you deal with massive port scans?

I don't believe in enumerating badness. If you have infrastructure sitting on the internet it's going to get scanned all the time by numerous IPs. For example, I created an AWS app that turns up ...
user avatar
  • 1,115
19 votes
Accepted

Nmap - Closed vs Filtered

This largely depends on the used scan. The Nmap scan types page explains the status of the port and the reasons per scan. Some examples: TCP SYN Scan (-sS) - Sends a TCP packet with SYN flag set - ...
user avatar
  • 2,339
18 votes
Accepted

Nmap through proxy

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. ...
user avatar
18 votes
Accepted

Why doesn't `nmap -sn 192.168.2.1/150` show the hosts that are up?

Your first example uses the CIDR notation to specify the host range as a netmask. But since /150 is an illegal value for an IPv4 subnet mask, nmap falls back to the largest plausible value which is /...
user avatar
  • 43.6k
17 votes

What is the purpose of subdomain enumeration?

What's the purpose of that in terms of security / hacking? The hostname(s) of resources can provide valuable information to narrow the scope of an attacker's task by providing information about ...
user avatar
17 votes
Accepted

Stop Nmap scan and preserve XML output

Nmap dev here: Sorry, but there is not an option to cleanly stop a scan and finalize the XML output. The --resume option, as you noted, only works with Normal and Grepable output. It also cannot cope ...
user avatar
  • 11.3k
17 votes
Accepted

How can a webpage scan my local, internal network from the Internet?

On the application layer, your browser has no notion of internal and external IP addresses. So any website can simply tell your browser to request a resource from your internal network. This wouldn't ...
user avatar
  • 43.6k
15 votes

Increase speed in nmap UDP scan?

UDP scanning is likely to be slower than TCP due to the differences in how the protocol works (i.e. with TCP it's easier to establish that a port is open due to the three-way handshake). That said it'...
user avatar
  • 60.6k
15 votes

VM Kali Linux - nmap why is so slow?

Possibilities: You are using a VM with a virtual NAT (Network Address Translation) network adapter. I have experienced profound slowdown under VirtualBox, for instance, when using NAT instead of a ...
user avatar
  • 11.3k
13 votes
Accepted

How can I find my home network's vulnerabilities when opening it for VPN connections

Well, open port does not necessary mean that anyone can enter. If you have an open port on a router/modem with nothing listening behind, then there is nothing to compromise. Of course, this won't ...
user avatar
  • 13k
11 votes
Accepted

Is there a nmap command to get the top # most common ports?

In addition to sorting the nmap-services file as SilverlightFox suggests, you can get this information from Nmap: $ ./nmap --top-ports 1000 localhost -v -oG - # Nmap 6.47SVN scan initiated Wed Jan 7 ...
user avatar
  • 11.3k
11 votes
Accepted

How to run nmap HTTP scripts on unusual ports

The other answers here are very good. However, there are a couple ways to do what you want that will work without editing the scripts: You can teach Nmap to recognize this service. Nmap's service ...
user avatar
  • 11.3k
11 votes

How much traffic can a firewall node handle? Any real examples?

Having done tests for multiple clients where they claim "scans won't knock this over, you'll be alright", then an hour later we're having a meeting discussing how they're going to handle a serious ...
user avatar
  • 131k
11 votes

What are the best pratices to avoid my server being port scanned

Portknocking Portknocking is a method to open ports that the firewall normally keeps closed by executing a series of connection attempts (knocks) to other ports. Upon the valid sequence of port knocks,...
user avatar
  • 2,724
11 votes

Does a fake SSH server have any purpose security-wise?

A good use for an open and fake ssh server like this is to set it up on a corporate LAN as a honeypot. Give it an attractive (but not obviously fake) hostname set up syslog forwarding to your SIEM ...
user avatar
  • 2,651
10 votes
Accepted

Why would a stealth scan attract more attention than a connect scan?

Nmap, like any adversary tool, can be fingerprinted by Intrusion Detection Systems (IDS). As such, any of Nmap's techniques are generally classified as an attack by these modern tools -- especially ...
user avatar
  • 18.9k
10 votes

What is the purpose of subdomain enumeration?

Subdomain enumeration techniques are passive methods used during a pre-attack phase or during information gathering phase of a pentest assignment. Enumerating subdomains is crucial as they may point ...
user avatar
  • 7,275
10 votes

Why is UDP port scanning slower than TCP port scanning?

The difference is in the very nature of the two protocols. TCP is a connection-oriented protocol. This means that systems must establish and confirm a stable connection - for TCP, the process is ...
user avatar
  • 27k
9 votes

Is there a nmap command to get the top # most common ports?

sort -r -k3 /usr/share/nmap/nmap-services should give you what you need. This will sort the nmap-services file by open-frequency. http 80/tcp 0.484143 # World Wide Web HTTP ipp 631/udp 0....
user avatar
9 votes

Filtered ports - What exactly filters them?

In most operating systems, handling the TCP three-way handshake is the responsibility of the operating system's networking code. Applications can only declare interest in receiving connections on a ...
user avatar
9 votes

How wise is it to use a tool for portspoofing at your server to confuse attackers?

I assume the effectiveness will be very limited. First of all, exploiting port scanning tools will rarely be useful because most pentesters will use VMs and other confined environments when ...
user avatar
  • 1,875
9 votes
Accepted

Multiple Open ports on a server, is that safe?

There are a lot of misunderstandings and assumptions in your question, but I will try to address them. First, you are scanning a domain (I assume from the Internet). Just because nmap shows them as ...
user avatar
  • 123k
8 votes
Accepted

How does this shellshock scan work?

If / is rendered by a cgi script, that script would be called with the User-Agent in an environment variable called HTTP_USER_AGENT. bash would look at all environment variables starting with () { to ...
user avatar
  • 5,382
8 votes

How to decode this exploit scanner?

It's not scanning for the "shellshock" exploit. It's scanning for an older exploit where a poorly-configured server leaves a copy of the PHP interpreter in the CGI directory, permitting remote ...
user avatar
  • 34.4k
8 votes
Accepted

The effect of hidden or spoofed service banners on vulnerability scanners

The first thing to note here is that banner grabbing is an error prone way to check for vulnerabilities in a lot of cases (as OS vendors backport security fixes without updating version numbers). ...
user avatar
  • 60.6k

Only top scored, non community-wiki answers of a minimum length are eligible