94

The reasons to have such fake SSH servers are multiple. They include such as: determining whether you’re under attack knowing the users and passwords guessed (which can display the intel the attacker has) to see attacker’s actions of interest to see attempts of exploitation of the server (might disclose 0days or backdoors) to study how the attacker tries to ...


53

I ignore them. And if you have a reasonable security posture, you should too. Your servers should have no ports open to the general public other than those that you use to serve the general public. For example, your web server should have open port 80, 443, and maybe 22; everything else should be SSH-tunneled or otherwise VPN'ed if you need to connect to ...


44

All the tracerouting tools rely on the following principle: they send packets with a short life, and wait for ICMP packets reporting the death of these packets. An IP packet has a field called "TTL" (as "Time To Live") which is decremented at each hop; when it reaches 0, the packet dies, and the router on which this happens is supposed to send back a "Time ...


44

Multiple problems here. Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence. You're burning CPU to respond to the reconnaissance phase of an attack. This can be used against you. Depending on how this is set up, I can kill your server by forcing your ...


35

The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as Loki (or the older Yersinia tool), intrace, Chiron, mana-toolkit, mitmf, bettercap, and Responder.py that must be run outside of the Metasploit framework, but so many ...


27

It can be used as honeypot/research to collect most used password attempts and the like. Otherwise, I agree with your assessment, it's an attractive nuisance. If you are looking for actual protection mechanisms, I recommend "Fail2Ban".


23

First of all go to the police. Tell them your story, tell them you sent them a copy of your passport. Alert your bank and credit card suppliers as well. The biggest problem with sending a copy of your passport is that they can easily do identity theft. I wouldn't use an AV for your computer, I would just re-install your computer from scratch. As we ...


18

I don't believe in enumerating badness. If you have infrastructure sitting on the internet it's going to get scanned all the time by numerous IPs. For example, I created an AWS app that turns up spot instances, scans blocks of IPs from a list, and turns them off once the results are shipped to the master server. If I was scanning your range daily you ...


17

What's the purpose of that in terms of security / hacking? The hostname(s) of resources can provide valuable information to narrow the scope of an attacker's task by providing information about available machines and resources. The underlying space of network (IP) addresses is sparsely populated (and IP:port combinations even more so), so narrowing down the ...


16

Your first example uses the CIDR notation to specify the host range as a netmask. But since /150 is an illegal value for an IPv4 subnet mask, nmap falls back to the largest plausible value which is /32 (because an IPv4 address only has 32 bits), making you scan exactly one host: $ nmap -sn 192.168.2.1/150 Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-...


15

Nmap dev here: Sorry, but there is not an option to cleanly stop a scan and finalize the XML output. The --resume option, as you noted, only works with Normal and Grepable output. It also cannot cope with --randomize-hosts. Here are the stages of development we would need to undertake to make this possible: Extend --resume to parse Nmap's XML output for ...


15

On the application layer, your browser has no notion of internal and external IP addresses. So any website can simply tell your browser to request a resource from your internal network. This wouldn't get blocked since for the browser it's just an ordinary cross-origin request. Note that the requesting site won't be able to read anything, it could just ...


13

My guess is that you aren't seeing those open ports is because of the default behavior of nmap to only scan the 1.000 most commonly used ports. If you want to cover all ports you need to explicitly state that you want to scan all ports with the -p parameter. So say I want to scan from port 1 until 5037: nmap -sS 127.0.0.1 -p1-5037 To view which process ...


13

UDP scanning is likely to be slower than TCP due to the differences in how the protocol works (i.e. with TCP it's easier to establish that a port is open due to the three-way handshake). That said it's possible to increase the speed of UDP scans in a couple of ways. one thing to watch for here is that if you apply too many timing options you risk reducing ...


13

Well, open port does not necessary mean that anyone can enter. If you have an open port on a router/modem with nothing listening behind, then there is nothing to compromise. Of course, this won't let you work from outside your home either. For this to happen, you have to put the VPN server and make it listen to this open port. What are the ...


12

you can check the following links NMap OS Detection and Paper About Nmap Detection you will find on them different methods used for OS detection By Fyodor the Creator of Nmap and if you want to dig dive you can purchase his book from amazon. From NMap OS Detection: ...dozens of tests such as TCP ISN sampling, TCP options support and ordering, IP ID ...


12

If you can send packets to the target machine, use nmap -O, which provides OS fingerprinting. If you can eavesdrop/intercept network traffic with the target machine, use pof, a tool for passive OS fingerprinting. You didn't provide much information about what are your constraints or why the standard tools (like nmap or pof) didn't work for you. Therefore, ...


12

To easy your concerns, I recommend looking into the following interesting article: http://research.microsoft.com/pubs/167719/whyfromnigeria.pdf Basically, the scammers send out an immense number of e-mails, and they get money only from a very small percentage of targets. The number of people who reply to them, but figure out half way through that it's a ...


11

As @logicalscope says, you can also look at the MAC lookup chart to find out the manufacturer. This could be spoofed. You could try to find out the IP address of the device, then you could run nmap against it to see if you can identify the OS. This could be hidden from you, so an alternative would be to try and connect to it - does it give banners back? ...


11

A recent test of Nessus and OpenVAS shows the benefits in using multiple scanners due to the difference in the signatures: Nessus, OpenVAS and Nexpose VS Metasploitable (blog post by Peter at HackerTarget) Out of 15 known security holes in the system used for the test, 4 were spotted by all four tested tools (Nessus, OpenVAS, Nexpose and some Nmap scripts); ...


11

Unicornscan is a tool known for high-speed scanning of large net blocks (e.g. last I observed was sustained 60+mbps internet-based scans). Nmap in the past definitely had memory consumption issues w/large scans, but I haven't seen those issues in the 5.x/6.x versions when performing 65k ports scans over several /16s. The memory problems I run into are ...


11

I'm assuming that what you're doing is related to ethical pen. testing. If you have no legitimate control over your target, you have 3 options Haxoring your target: Attempt to gain access to the target machine by exploiting some vulnerabilities in the machine itself, or the operator of the machine. Big Man in the Middle (Between your target and the servers ...


11

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. Apart from that using any kind of proxy means that nmap communicates with the IP stack of the proxy and not of the target. This means: ICMP ping can not be done to ...


11

Having done tests for multiple clients where they claim "scans won't knock this over, you'll be alright", then an hour later we're having a meeting discussing how they're going to handle a serious downtime incident, I can safely say a few things: The marketing figures describing performance are at best a peak performance case, produced in a lab situation ...


11

A good use for an open and fake ssh server like this is to set it up on a corporate LAN as a honeypot. Give it an attractive (but not obviously fake) hostname set up syslog forwarding to your SIEM and see if anybody connects to it and what they try to do. Nobody legitimate should be poking around in it (unless you have a hunt team or a red team operation ...


10

Yes, provided the devices are reachable on the network they can be scanned. The accuracy of the results (e.g. fingerprinting) is dependant on the platform, software version, running services and configuration. Example: $ nmap -A -T4 10.1.1.1 Nmap scan report for 10.1.1.1 Host is up (0.020s latency). Not shown: 999 closed ports PORT STATE SERVICE ...


10

The short answer is that you need to talk to the port to see who answers. Two things can come from this: banners protocol traffic The problem is that banners can be faked, so you need a tool to analyze the traffic in order to get an accurate picture. Tools: netcat/nc/ncat - useful for basic banner grabbing sbd - like nc, but encrypted - useful for basic ...


10

sort -r -k3 /usr/share/nmap/nmap-services should give you what you need. This will sort the nmap-services file by open-frequency. http 80/tcp 0.484143 # World Wide Web HTTP ipp 631/udp 0.450281 # Internet Printing Protocol snmp 161/udp 0.433467 # Simple Net Mgmt Proto netbios-ns 137/udp 0.365163 # NETBIOS Name Service ntp 123/udp 0....


10

In addition to sorting the nmap-services file as SilverlightFox suggests, you can get this information from Nmap: $ ./nmap --top-ports 1000 localhost -v -oG - # Nmap 6.47SVN scan initiated Wed Jan 7 18:04:53 2015 as: ./nmap --top-ports 1000 -v -oG - localhost # Ports scanned: TCP(1000;1,3-4,6-7,9,13,17,19-26,30,32-33,37,42-43,49,53,70,79-85,88-90,99-100,...


Only top voted, non community-wiki answers of a minimum length are eligible