Hot answers tagged

27

Referring to my answer to this question (before it was migrated): No, scanning the drive without "opening the folder" isn't a secure way to protect against viruses on the drive. It's very risky to insert what you believe to be a compromised USB device into your PC, no matter what AV you have installed. If you desperately need files from the drive (to quote ...


16

Leaving a connection in syn_rcvd state will raise flags as well as this is a common denial of service attack. If you don't send a RST, the server will remain in a syn_rcv state for up to 60 seconds and retransmit the SYN ACK up to 5x. This will waste resources on the network you're scanning and cause a bunch of (depending on the speed and success of your ...


11

The support for proxy with nmap is very limited. Especially you cannot do any kind of ICMP (ping) or UDP scans, no SYN stealth scan, no OS detection etc. This means that the default nmap commands you are using will not work with a proxy and depending on the implementation will either fail or will bypass the proxy. You have to limit yourself to only the kind ...


11

This is technically false: Nmap does not send a RST at any point in the half-open SYN scan. Instead, it relies on the scanning machine's OS to send RST packets in response to what the kernel views as unsolicited SYN-ACK packets. This is the same mechanism that is probed by Nmap's ACK scan (-sA) to map out firewall rules. Of course, this means that if your ...


8

The difference is in the very nature of the two protocols. TCP is a connection-oriented protocol. This means that systems must establish and confirm a stable connection - for TCP, the process is commonly known as the "three-way handshake" - before data is actually transferred. As the process must happen quickly for a good connection, it can be reasonably ...


7

Any one with sufficient access to the network traffic can detect this, All you need is the capability to see all traffic and how its routed (to what TCP Port and IP). The trick is to detect the 'unusual' signature of a port scan over the rest of the traffic (like sequential trying of random ports / specific well-known ports). This can be quite tricky for ...


7

You have to use the -sT option -- the Connect() scan technique. Otherwise nmap will use the SYN method, canceling out proxychains. For you example, this would be proxychains nmap -sT -v scanme.namp.org And, by the way, proxychains-ng seems to cause more problems with nmap than the original version.


6

It's an uphill battle against windmills. When you block obviously malicious traffic, black hats will start using less obviously malicious traffic which achieves the same goals. New security threats and exploits are discovered every day, and keeping up with all of them is practically impossible. There would be false-positives. Due to the complexity of ...


6

It depends. In older times there was an autostart facility when inserting a data DVD/CD-ROM or USB stick but on modern systems this is usually no longer active by default. It might still be possible to corrupt the file system on a stick in a way which causes code execution when the system tries to access the device, and there are USB sticks with a writable ...


5

From the nmap page A big challenge with UDP scanning is doing it quickly. Open and filtered ports rarely send any response, leaving Nmap to time out and then conduct retransmissions just in case the probe or response were lost. Closed ports are often an even bigger problem. They usually send back an ICMP port unreachable error. But unlike the RST packets ...


5

From nmap documentation here: https://nmap.org/book/man-port-scanning-basics.html A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it. This means that the host has responded (most likely with an RST) to the SYN packet sent by Nmap. I didn't see any explicit reference to this in the ...


5

This answer is 64.7% opinion. TL;DR: A port sweep looks for specific port(s) across multiple hosts. A port scan enumerates any ports to be found on one or more hosts. Some people use "port sweep" to describe a port scan that is focused on a specific port across a wide number of hosts, rather than on determining the open ports for some number of hosts. An ...


4

Simply put, this is done using the banner grabbing technique over specific popular service TCP/IP ports such as 80, 8080, 9100, 21 etc. Basically a host will use a piece of software such as netcat or telnet to scan a specific range of IP addresses. A popular website which facilitates this is https://www.shodan.io. They basically have a back end system ...


4

You can't because there isn't one. Unless a port scan is: Initiated by you. Initiated on your request or behalf by a security partner. It is malicious. You can block them as you wish. The sole purpose of port scans, malicious or not, is to find weaknesses and vulnerable services in your internet facing gateway. If you or a partner does it, it's to help you ...


3

Depends on what it has on it. There are some attacks and malware which affects the signals that the device sends to the computer - most famously the BadUSB attacks, which let flash drives claim to be input devices - in which case merely plugging a device in could allow it to do things ranging from the annoying (hitting enter at random) to the malicious (...


3

I was assuming that snort monitors packets in HOME_NETWORK in promiscous mode,Kindly correct me if i am wrong. Snort can only monitor packets which can be seen at the network card, even in promiscuous mode. Usually the switch in a network will only send out packets on the port where the specific device is connected. This means that Snort has to be installed ...


3

It seems that ClamAV supports both YARA and OpenIOC. These two methods of writing signatures will let you take a much more specific look rather than just byte sequences. Check out this SANS paper for a bit of methodology. If you want just a quick idea of what these two frameworks can hone in on check out the documentation for YARA and IOC. Both of these ...


3

While the SYN scan method itself is theoretically quicker, it doesn't mean that it will always be the best or fastest scan to use. It is possible that a firewall or IPS has detected the scan and is slowing you down (nearly every NIDS in the world knows about SYN scans and will alert on sight). You can also try adjusting the timing settings (-T[0-5], higher ...


3

I'm not sure how stable your network is, but maybe you are creating too much traffic for it to handle. I would start by doing a simple scan on the one up address with a slower speed to verify. Example: nmap -sS -T2 -p 0-1000 192.168.1.25 Please note to change the IP address to the one you know is alive.


3

I would recommend having a look at cloud based vulnerability scanners. You can also find a number of web based nmap scanners that will scan your public facing IPs for some common ports. (usually for free) If you are UK based (and since you are going for cyber essentials I assume you are) I would also recommend joining the NCSC Cyber Security Information ...


3

Why has MS not enforced a rule/fix for this? Because it would break existing software. Microsoft published an API where both paths would be searched. Developers implemented software knowing that. To change it would break any software searching in an unquoted directory with a space in the name. "C:\Program Files" means at the very least this is going to be a ...


3

I would like to throw in that the link provided by user ximaera omits some information. Using a scan like this nmap -T5 -n --max-parallelism=255 --min-parallelism=100 -sn 10.0.0.0/8 could trip up some security mechanisms, because it can look a bit like a ping flood and it does not necessarily offer an increase in speed. I would suggest omitting the ...


3

For the sake of ergonomy, smartphones are equipped with small fingerprint sensors which means they are able to obtain only partial images of a given fingerprint. The chances of a partial fingerprint being incorrectly matched with another "user" fingerprint is relatively high. (cf: MasterPrint: Exploring the Vulnerability of Partial Fingerprint-Based ...


3

This is not a new problem. I haven't had to work around it in a few years, so I don't know if the state of the art has changed, but there are a few things you can try: 1) don't process your link unless it has a special query param in it. The query param is added by a client-side redirect (I used http://insider.zone/tools/client-side-url-redirect-generator/...


3

I assume you are talking about web applications. If not, edit your question as my answer will not make much sense. What are the differences between authenticated and unauthenticated scans? Authenticated scan is when you have a valid account on the application. Unauthenticated is when you do not have any. Do they show the same results? No, they show ...


2

Here a cheat sheet that summarizes all nmap switches. https://pentestlab.wordpress.com/2012/08/17/nmap-cheat-sheet/ Notice all ping-related switches begin with 'P', so I assume Pn means Ping Not. I thing it easy to remember now :)


2

The netstat command told you MySQL was listening on 127.0.0.1, the loopback address, to which you can only connect from the local machine, but not from any other host in the Internet. If you really want to reach your database server from the net you'd have to configure it to listen on your internet IP and add the appropriate firewall rules to allow the ...


2

If you are just looking for a way to access it from the outside look at an external VPN or use Tor https://tor.eff.org Using nmap from an external network is probably the easiest and most thorough way to make sure you scan everything. Note: Many services and security tools completely skip ports 9100 and port 0, some skip everything that's not particularly ...


2

With the default Configuration OpenVAS will scan actively. It happend to me sometimes in the past that software crashed while scanning it with a vulnerablity scanner. In my expience this applies mostly to badly written PHP apps, IoT devices and cheap routers but of cause it can happen with other targets too.


2

Probably someone figured out you are using a out of box solution(say a CMS) like Joomla,Wordpress,Drupal. That CHANGELOG.txt is a file in Drupal CMS. I am not sure if that is the one on your server. So, the attacker may be trying to know which version of CMS(Drupal) is it. So that he can use any exploits known to effect that particular version.


Only top voted, non community-wiki answers of a minimum length are eligible