96

The reasons to have such fake SSH servers are multiple. They include such as: determining whether you’re under attack knowing the users and passwords guessed (which can display the intel the attacker has) to see attacker’s actions of interest to see attempts of exploitation of the server (might disclose 0days or backdoors) to study how the attacker tries to ...


53

I ignore them. And if you have a reasonable security posture, you should too. Your servers should have no ports open to the general public other than those that you use to serve the general public. For example, your web server should have open port 80, 443, and maybe 22; everything else should be SSH-tunneled or otherwise VPN'ed if you need to connect to ...


46

All the tracerouting tools rely on the following principle: they send packets with a short life, and wait for ICMP packets reporting the death of these packets. An IP packet has a field called "TTL" (as "Time To Live") which is decremented at each hop; when it reaches 0, the packet dies, and the router on which this happens is supposed to ...


44

Multiple problems here. Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence. You're burning CPU to respond to the reconnaissance phase of an attack. This can be used against you. Depending on how this is set up, I can kill your server by forcing your ...


35

The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as Loki (or the older Yersinia tool), intrace, Chiron, mana-toolkit, mitmf, bettercap, and Responder.py that must be run outside of the Metasploit framework, but so many ...


27

It can be used as honeypot/research to collect most used password attempts and the like. Otherwise, I agree with your assessment, it's an attractive nuisance. If you are looking for actual protection mechanisms, I recommend "Fail2Ban".


23

First of all go to the police. Tell them your story, tell them you sent them a copy of your passport. Alert your bank and credit card suppliers as well. The biggest problem with sending a copy of your passport is that they can easily do identity theft. I wouldn't use an AV for your computer, I would just re-install your computer from scratch. As we ...


18

I don't believe in enumerating badness. If you have infrastructure sitting on the internet it's going to get scanned all the time by numerous IPs. For example, I created an AWS app that turns up spot instances, scans blocks of IPs from a list, and turns them off once the results are shipped to the master server. If I was scanning your range daily you ...


17

What's the purpose of that in terms of security / hacking? The hostname(s) of resources can provide valuable information to narrow the scope of an attacker's task by providing information about available machines and resources. The underlying space of network (IP) addresses is sparsely populated (and IP:port combinations even more so), so narrowing down the ...


17

Your first example uses the CIDR notation to specify the host range as a netmask. But since /150 is an illegal value for an IPv4 subnet mask, nmap falls back to the largest plausible value which is /32 (because an IPv4 address only has 32 bits), making you scan exactly one host: $ nmap -sn 192.168.2.1/150 Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-...


15

Nmap dev here: Sorry, but there is not an option to cleanly stop a scan and finalize the XML output. The --resume option, as you noted, only works with Normal and Grepable output. It also cannot cope with --randomize-hosts. Here are the stages of development we would need to undertake to make this possible: Extend --resume to parse Nmap's XML output for ...


15

On the application layer, your browser has no notion of internal and external IP addresses. So any website can simply tell your browser to request a resource from your internal network. This wouldn't get blocked since for the browser it's just an ordinary cross-origin request. Note that the requesting site won't be able to read anything, it could just ...


14

UDP scanning is likely to be slower than TCP due to the differences in how the protocol works (i.e. with TCP it's easier to establish that a port is open due to the three-way handshake). That said it's possible to increase the speed of UDP scans in a couple of ways. one thing to watch for here is that if you apply too many timing options you risk reducing ...


14

Possibilities: You are using a VM with a virtual NAT (Network Address Translation) network adapter. I have experienced profound slowdown under VirtualBox, for instance, when using NAT instead of a bridged network adapter. You are scanning something that isn't there. The -Pn option means "don't bother trying to find out if anything is listening at this ...


13

My guess is that you aren't seeing those open ports is because of the default behavior of nmap to only scan the 1.000 most commonly used ports. If you want to cover all ports you need to explicitly state that you want to scan all ports with the -p parameter. So say I want to scan from port 1 until 5037: nmap -sS 127.0.0.1 -p1-5037 To view which process ...


13

Well, open port does not necessary mean that anyone can enter. If you have an open port on a router/modem with nothing listening behind, then there is nothing to compromise. Of course, this won't let you work from outside your home either. For this to happen, you have to put the VPN server and make it listen to this open port. What are the ...


13

This largely depends on the used scan, and the nmap scan types page explains the status of the port and the reasons per scan. Some examples: TCP SYN Scan (-sS) - Sends a TCP packet with SYN flag set - If a SYN/ACK (or SYN) is received --> Port is Open, TCP initiation accepted - If a RST is received --> Port is closed - If no response is received --> ...


12

I'm assuming that what you're doing is related to ethical pen. testing. If you have no legitimate control over your target, you have 3 options Haxoring your target: Attempt to gain access to the target machine by exploiting some vulnerabilities in the machine itself, or the operator of the machine. Big Man in the Middle (Between your target and the servers ...


12

To easy your concerns, I recommend looking into the following interesting article: http://research.microsoft.com/pubs/167719/whyfromnigeria.pdf Basically, the scammers send out an immense number of e-mails, and they get money only from a very small percentage of targets. The number of people who reply to them, but figure out half way through that it's a ...


12

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. Apart from that using any kind of proxy means that nmap communicates with the IP stack of the proxy and not of the target. This means: ICMP ping can not be done to ...


11

Unicornscan is a tool known for high-speed scanning of large net blocks (e.g. last I observed was sustained 60+mbps internet-based scans). Nmap in the past definitely had memory consumption issues w/large scans, but I haven't seen those issues in the 5.x/6.x versions when performing 65k ports scans over several /16s. The memory problems I run into are ...


11

Having done tests for multiple clients where they claim "scans won't knock this over, you'll be alright", then an hour later we're having a meeting discussing how they're going to handle a serious downtime incident, I can safely say a few things: The marketing figures describing performance are at best a peak performance case, produced in a lab situation ...


11

A good use for an open and fake ssh server like this is to set it up on a corporate LAN as a honeypot. Give it an attractive (but not obviously fake) hostname set up syslog forwarding to your SIEM and see if anybody connects to it and what they try to do. Nobody legitimate should be poking around in it (unless you have a hunt team or a red team operation ...


10

In addition to sorting the nmap-services file as SilverlightFox suggests, you can get this information from Nmap: $ ./nmap --top-ports 1000 localhost -v -oG - # Nmap 6.47SVN scan initiated Wed Jan 7 18:04:53 2015 as: ./nmap --top-ports 1000 -v -oG - localhost # Ports scanned: TCP(1000;1,3-4,6-7,9,13,17,19-26,30,32-33,37,42-43,49,53,70,79-85,88-90,99-100,...


10

Nmap, like any adversary tool, can be fingerprinted by Intrusion Detection Systems (IDS). As such, any of Nmap's techniques are generally classified as an attack by these modern tools -- especially Next-generation Firewall (NGFW) technologies, or the bleeding-edge equivalents of NGFWs. Additionally, information sharing alliance centers (ISACs) are sharing ...


10

Subdomain enumeration techniques are passive methods used during a pre-attack phase or during information gathering phase of a pentest assignment. Enumerating subdomains is crucial as they may point to different parts of a web application or may lead to another website hosted on another server with a different IP address. This allows you to come up with an ...


9

sort -r -k3 /usr/share/nmap/nmap-services should give you what you need. This will sort the nmap-services file by open-frequency. http 80/tcp 0.484143 # World Wide Web HTTP ipp 631/udp 0.450281 # Internet Printing Protocol snmp 161/udp 0.433467 # Simple Net Mgmt Proto netbios-ns 137/udp 0.365163 # NETBIOS Name Service ntp 123/udp 0....


9

The other answers here are very good. However, there are a couple ways to do what you want that will work without editing the scripts: You can teach Nmap to recognize this service. Nmap's service fingerprints are in the nmap-service-probes file. Nmap already recognizes some versions of MiniShare with this match line, added in Nmap 6.00: match http m|^HTTP/...


9

In most operating systems, handling the TCP three-way handshake is the responsibility of the operating system's networking code. Applications can only declare interest in receiving connections on a certain port by means of the listen() system call. The operating system will answer a SYN with a SYN/ACK if there is an application listening on the port, and ...


Only top voted, non community-wiki answers of a minimum length are eligible