Skip to main content
Share Your Experience: Take the 2024 Developer Survey
96 votes
Accepted

Does a fake SSH server have any purpose security-wise?

The reasons to have such fake SSH servers are multiple. They include such as: determining whether you’re under attack knowing the users and passwords guessed (which can display the intel the attacker ...
Vilius Povilaika's user avatar
43 votes

How wise is it to use a tool for portspoofing at your server to confuse attackers?

Multiple problems here. Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence. You're burning CPU ...
Ryan Gooler's user avatar
27 votes

Does a fake SSH server have any purpose security-wise?

It can be used as honeypot/research to collect most used password attempts and the like. Otherwise, I agree with your assessment, it's an attractive nuisance. If you are looking for actual ...
user10216038's user avatar
  • 8,123
22 votes
Accepted

Nmap - Closed vs Filtered

This largely depends on the used scan. The Nmap scan types page explains the status of the port and the reasons per scan. Some examples: TCP SYN Scan (-sS) - Sends a TCP packet with SYN flag set - ...
Nomad's user avatar
  • 2,379
21 votes
Accepted

Nmap through proxy

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. ...
Steffen Ullrich's user avatar
20 votes
Accepted

How can a webpage scan my local, internal network from the Internet?

On the application layer, your browser has no notion of internal and external IP addresses. So any website can simply tell your browser to request a resource from your internal network. This wouldn't ...
Arminius's user avatar
  • 44.8k
18 votes
Accepted

Why doesn't `nmap -sn 192.168.2.1/150` show the hosts that are up?

Your first example uses the CIDR notation to specify the host range as a netmask. But since /150 is an illegal value for an IPv4 subnet mask, nmap falls back to the largest plausible value which is /...
Arminius's user avatar
  • 44.8k
12 votes

What are the best pratices to avoid my server being port scanned

Portknocking Portknocking is a method to open ports that the firewall normally keeps closed by executing a series of connection attempts (knocks) to other ports. Upon the valid sequence of port knocks,...
Joe's user avatar
  • 2,764
11 votes

Nmap through proxy

For now, use an external tool like proxychains. The nmap documentation for --proxies states, that the feature is not fully implemented yet: Warning: this feature is still under development and has ...
Arminius's user avatar
  • 44.8k
11 votes

How much traffic can a firewall node handle? Any real examples?

Having done tests for multiple clients where they claim "scans won't knock this over, you'll be alright", then an hour later we're having a meeting discussing how they're going to handle a serious ...
Polynomial's user avatar
  • 135k
11 votes

Does a fake SSH server have any purpose security-wise?

A good use for an open and fake ssh server like this is to set it up on a corporate LAN as a honeypot. Give it an attractive (but not obviously fake) hostname set up syslog forwarding to your SIEM ...
DarkMatter's user avatar
  • 2,691
10 votes

Why is UDP port scanning slower than TCP port scanning?

The difference is in the very nature of the two protocols. TCP is a connection-oriented protocol. This means that systems must establish and confirm a stable connection - for TCP, the process is ...
Iszi's user avatar
  • 27.1k
9 votes

nmap to scan all resolved ip addresses for a given domain name?

Nmap has a script to do this, resolveall. The interface isn't as nice as it could be: you have to provide the hostname via the resolveall.hosts script argument. Here's how to do that and also add any ...
bonsaiviking's user avatar
  • 11.6k
9 votes

How wise is it to use a tool for portspoofing at your server to confuse attackers?

I assume the effectiveness will be very limited. First of all, exploiting port scanning tools will rarely be useful because most pentesters will use VMs and other confined environments when ...
Elias's user avatar
  • 1,980
9 votes
Accepted

Multiple Open ports on a server, is that safe?

There are a lot of misunderstandings and assumptions in your question, but I will try to address them. First, you are scanning a domain (I assume from the Internet). Just because nmap shows them as ...
schroeder's user avatar
  • 130k
8 votes
Accepted

/hnap1/ scans router compromised or worm?

What you found was that a device connected to your web server and requested /HNAP1/ HNAP is a protocol for managing devices, so with just this information about potential attacks, my guess is that ...
Ángel's user avatar
  • 18.9k
8 votes
Accepted

Why can I ping a server, but nmap normal scan cannot see the host?

From nmap.org: If no host discovery options are given, Nmap sends an ICMP echo request, a TCP SYN packet to port 443, a TCP ACK packet to port 80, and an ICMP timestamp request. ... For unprivileged ...
multithr3at3d's user avatar
7 votes
Accepted

Scanning private IPs from outside network

Not using a VPN or some other way to be connected as if you were local, the answer is "no", but not because of a limitation in Nmap or any similar tool. The primary reason this won't work is ...
Trey Blalock's user avatar
  • 14.2k
7 votes
Accepted

What are some instant red flags when scanning an network with nmap

To echo gameOver's comment and elaborate further, simply detecting that a port is open is interesting but I wouldn't see it as an immediate 'red flag'. Perhaps a better approach might be to run Nmap ...
jonroethke's user avatar
  • 1,044
7 votes
Accepted

Why do I need root privileges to send a raw packet from a UNIX machine?

The security model in UNIX is traditionally centered around having hardware and network controlled by the network administrators and then having unprivileged users separate from these administrators ...
Steffen Ullrich's user avatar
6 votes

Router Receiving Unknown Packets from the Same IP and Port Even After Address Rotations - How?

How much of the public IP is changing upon the DHCP renew? How quickly before you see the packets upon getting a new IP? This is unlikely a targeted attack and more likely a shotgun-approach scanner ...
samy kamkar's user avatar
5 votes

Why is UDP port scanning slower than TCP port scanning?

From the nmap page A big challenge with UDP scanning is doing it quickly. Open and filtered ports rarely send any response, leaving Nmap to time out and then conduct retransmissions just in case ...
coffeethulhu's user avatar
5 votes

Single-packet connect request at an extremely slow rate

It simply means to do something like try a single connection attempt to a single port with a lot of time between. But what "slow" means and how much time is not defined. 1/hr? 1/day? It depends on ...
schroeder's user avatar
  • 130k
5 votes
Accepted

How do pentesters approach a large complex network?

All security tests will have a scope and its this scope that would typically drive the process of the review. So I'm assuming from the question that you're thinking about a network based review as ...
Rory McCune's user avatar
  • 62.3k
5 votes
Accepted

Should we use Microsoft security or defender for securing our WAN network

I suggest you contact some local security provider and consult with them about securing your network and desktops. You can use Windows Defender to protect computers from malware and Microsoft System ...
Valery Marchuk's user avatar
4 votes

Nmap reporting almost every port as open

I had the same thing happen to me. It was Snort causing it. Adding the -f and --badsum switches to nmap allowed me to by pass the IDS/IPS. The full command was as follows: nmap -sS -p 1-65535 -f --...
dprofancik's user avatar
4 votes

With Nmap it is possible to scan according mac address?

This is a one-liner to find the IP of a Synology NAS by MAC address in the local network: nmap -sP 192.168.1.0/24 | grep -B 2 "00:11:32:XX:XX:XX" | head -n 1 | cut -d " " -f 5 ...
Oscar's user avatar
  • 41
4 votes
Accepted

With Nmap it is possible to scan according mac address?

Keep in mind that nmap is an IP based scanner. Based on the information that you have provided, I would suggest using nmap to perform a host discovery i.e. identifying active hosts in a network. This ...
Shurmajee's user avatar
  • 7,457
4 votes

Could Nmap scan switches/routers

This command helped me get info about a Cisco router: $ nmap -O -v 172.22.253.1 Output: c:\nmap>nmap -O -v 172.22.253.1 Starting Nmap 7.70 ( https://nmap.org ) at 2019-10-18 11:51 W. Europe ...
Roland's user avatar
  • 41
4 votes

How do Hackers and Security Researchers Scan The Internet For Vulnerable Servers and Devices?

Simply put, this is done using the banner grabbing technique over specific popular service TCP/IP ports such as 80, 8080, 9100, 21 etc. Basically a host will use a piece of software such as netcat or ...
TheIriekid's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible