Hot answers tagged

62 votes
Accepted

eBay web site tries to connect to wss://localhost:xxxxx - is this legit or they have some Malware JS running?

This is ebay running a local port scan over websockets. It has been reported recently: https://twitter.com/JackRhysider/status/1264415919691841536 (original research) https://www.bleepingcomputer.com/...
user avatar
  • 3,891
28 votes
Accepted

Can I block viruses from a USB stick by scanning it before opening its folder?

Referring to my answer to this question (before it was migrated): No, scanning the drive without "opening the folder" isn't a secure way to protect against viruses on the drive. It's very ...
user avatar
20 votes

How can an attacker identify if a website is using PHP? How about the PHP version?

Because PHP is built from its own code Maybe by looking at how it parses specific querystrings (e.g. ?a[]=1&a[]=2&a[]=3), which regular expression syntax it supports, the distinctive ...
user avatar
18 votes

eBay web site tries to connect to wss://localhost:xxxxx - is this legit or they have some Malware JS running?

There's been some discussion of this recently, e.g. here and here. Suggested reasons for port scanning include: a) fingerprinting to uniquely identify your machine for future reference, or b) ...
user avatar
17 votes
Accepted

What's the advantage of sending an RST packet after getting a response in a SYN scan?

Leaving a connection in syn_rcvd state will raise flags as well as this is a common denial of service attack. If you don't send a RST, the server will remain in a syn_rcv state for up to 60 seconds ...
user avatar
  • 286
15 votes
Accepted

How to use nmap through proxychains?

The support for proxy with nmap is very limited. Especially you cannot do any kind of ICMP (ping) or UDP scans, no SYN stealth scan, no OS detection etc. This means that the default nmap commands you ...
user avatar
12 votes

How to use nmap through proxychains?

You have to use the -sT option -- the Connect() scan technique. Otherwise nmap will use the SYN method, canceling out proxychains. For you example, this would be proxychains nmap -sT -v scanme.namp....
user avatar
  • 221
12 votes

eBay web site tries to connect to wss://localhost:xxxxx - is this legit or they have some Malware JS running?

A German computer magazine was writing about this observation last week and asked eBay for a statement. eBay's answer was: There is some widely spread software that is either Malware or legit ...
user avatar
11 votes

What's the advantage of sending an RST packet after getting a response in a SYN scan?

This is technically false: Nmap does not send a RST at any point in the half-open SYN scan. Instead, it relies on the scanning machine's OS to send RST packets in response to what the kernel views as ...
user avatar
  • 11.3k
10 votes

Why is UDP port scanning slower than TCP port scanning?

The difference is in the very nature of the two protocols. TCP is a connection-oriented protocol. This means that systems must establish and confirm a stable connection - for TCP, the process is ...
user avatar
  • 27k
7 votes
Accepted

Can network admin detect port scan on a certain host?

Any one with sufficient access to the network traffic can detect this, All you need is the capability to see all traffic and how its routed (to what TCP Port and IP). The trick is to detect the '...
user avatar
  • 8,151
6 votes
Accepted

Why can't the Router devices worldwide block automatically malicious packets?

It's an uphill battle against windmills. When you block obviously malicious traffic, black hats will start using less obviously malicious traffic which achieves the same goals. New security threats ...
user avatar
  • 48.8k
6 votes

Can I block viruses from a USB stick by scanning it before opening its folder?

It depends. In older times there was an autostart facility when inserting a data DVD/CD-ROM or USB stick but on modern systems this is usually no longer active by default. It might still be possible ...
user avatar
6 votes
Accepted

Service running on a closed port?

From nmap documentation here: https://nmap.org/book/man-port-scanning-basics.html A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening ...
user avatar
  • 2,638
6 votes
Accepted

Port sweep vs port scan

This answer is 64.7% opinion. TL;DR: A port sweep looks for specific port(s) across multiple hosts. A port scan enumerates any ports to be found on one or more hosts. Some people use "port sweep" ...
user avatar
  • 71.7k
6 votes
Accepted

Do mail servers follow links in emails as part of a security scan before inbox delivery?

This is not a new problem. I haven't had to work around it in a few years, so I don't know if the state of the art has changed, but there are a few things you can try: 1) don't process your link ...
user avatar
  • 426
6 votes

How can an attacker identify if a website is using PHP? How about the PHP version?

From a practical point of view, your question does not matter. If you know that your server runs a vulnerable version of PHP, or anything else, it needs to be patched, not hidden. Meanwhile, the ...
user avatar
  • 771
5 votes

Why is UDP port scanning slower than TCP port scanning?

From the nmap page A big challenge with UDP scanning is doing it quickly. Open and filtered ports rarely send any response, leaving Nmap to time out and then conduct retransmissions just in case ...
user avatar
5 votes

How to distinguish between "normal internet" Port scan and more "serious" port scan preparing attack?

You can't because there isn't one. Unless a port scan is: Initiated by you. Initiated on your request or behalf by a security partner. It is malicious. You can block them as you wish. The sole ...
user avatar
5 votes

How can an attacker identify if a website is using PHP? How about the PHP version?

In some (but not all) cases - if a site is using PHP, you may see this in the response headers. One way to view the response headers is to use curl with the -I option. For example: curl -I www....
user avatar
  • 19.6k
4 votes

nmap output to file different than interactive output?

You used the -T5 option, which according to the documentation does the following (emphasis mine): T5 does the equivalent of --max-rtt-timeout 300ms --min-rtt-timeout 50ms --initial-rtt-timeout ...
user avatar
  • 11.3k
4 votes

How do Hackers and Security Researchers Scan The Internet For Vulnerable Servers and Devices?

Simply put, this is done using the banner grabbing technique over specific popular service TCP/IP ports such as 80, 8080, 9100, 21 etc. Basically a host will use a piece of software such as netcat or ...
user avatar
3 votes

Can I block viruses from a USB stick by scanning it before opening its folder?

Depends on what it has on it. There are some attacks and malware which affects the signals that the device sends to the computer - most famously the BadUSB attacks, which let flash drives claim to be ...
user avatar
  • 27.2k
3 votes

Snort Unable to detect portscans in LAN

I was assuming that snort monitors packets in HOME_NETWORK in promiscous mode,Kindly correct me if i am wrong. Snort can only monitor packets which can be seen at the network card, even in ...
user avatar
3 votes

Is there a more precise approach to generate signatures for ClamAV, than regex signatures?

It seems that ClamAV supports both YARA and OpenIOC. These two methods of writing signatures will let you take a much more specific look rather than just byte sequences. Check out this SANS paper for ...
user avatar
  • 4,971
3 votes
Accepted

nmap SYN scan taking forever

While the SYN scan method itself is theoretically quicker, it doesn't mean that it will always be the best or fastest scan to use. It is possible that a firewall or IPS has detected the scan and is ...
user avatar
3 votes

Using Nmap kicks me out my own network

I'm not sure how stable your network is, but maybe you are creating too much traffic for it to handle. I would start by doing a simple scan on the one up address with a slower speed to verify. Example:...
user avatar
  • 303
3 votes
Accepted

Scan my network externally

I would recommend having a look at cloud based vulnerability scanners. You can also find a number of web based nmap scanners that will scan your public facing IPs for some common ports. (usually for ...
user avatar
  • 7,639

Only top scored, non community-wiki answers of a minimum length are eligible