146

You can have some serious fun playing with printers, photocopiers and other such devices - even UPSes. Security is usually an afterthought at best, if not totally absent. Stuff I've seen: Default credentials used everywhere, and web-based config panels storing passwords in plain-text, often within a generated config file. I've never seen anything better ...


59

You're hurting yourself. The "attacker"/crawler... probably doesn't pay for their traffic or processing power (ie. they use a botnet, hijacked servers or at least are on a connection that doesn't make them pay for traffic), but you will be billed for traffic and CPU/storage/memory, or your server's hoster has a "fair usage" clause, under which your server's ...


40

What are the strengths of each team member that I will work with regularly? (i.e. programming, linux, networking, regulations, etc.) Where is our documentation? You hopefully have a wiki, a knowledge base, or set of documents somewhere that explain your processes and policies. If you don't, be a hero and get started on one. What are the current projects the ...


34

The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as Loki (or the older Yersinia tool), intrace, Chiron, mana-toolkit, mitmf, bettercap, and Responder.py that must be run outside of the Metasploit framework, but so many ...


33

Unless you've got nmap configured not to perform host discovery (-PN or -PN --send-ip on the LAN), if it is indicating that all ports are filtered, then the host is up, but the firewall on that host is dropping traffic to all the scanned ports. Note that a default nmap scan does not probe all ports. It only scans 1000 TCP ports. If you want to check for any ...


32

It depends on how your organization uses these kind of reports. If the people responsible for planning and/or implementing security controls read these documents once and then never look at them again OR see them more as a guideline than actual rules on how to set up an environment, I can see that you might want to refrain from adding too much information ...


28

Consider that serving anything other than HTTP 404 page for /administrator/index.php may get your server in the lists of potential targets, which means even more scans in the future. Since crackers who pay for such lists don't need to scan millions of IPs themselves, they can concentrate on you with much more sophisticated attacks than checking for the ...


27

Referring to my answer to this question (before it was migrated): No, scanning the drive without "opening the folder" isn't a secure way to protect against viruses on the drive. It's very risky to insert what you believe to be a compromised USB device into your PC, no matter what AV you have installed. If you desperately need files from the drive (to quote ...


20

I ignore them. There will always be compromised systems continually scanning the entire Internet for arbitrary vulnerabilities. Trying to block them is no more effective than spitting into the wind. You'll get far more value out of focusing on the security of your servers and applications, and keeping an eye out for attackers who seem to specifically ...


18

To avoid client-side security issues, you need to learn about the security requirements for client-side code and the common mistakes. OWASP has good resources. Make sure you read about DOM-based XSS, as that is one of the most common security mistakes. As far as security best practices, I have several suggestions: To avoid XSS, abide by the rules found ...


17

The vast majority of web applications do not allow query stacking. With PHP/MySQL application can allow for query stacking if you use the mysqli::multi_query()or mysqli_multi_query() functions. You can exploit these systems using sub-select, union-selects, blind sql injection, into outfile, or loadfile(). SQLMap and Havij are both tools that automate ...


16

There's a couple of ways you could do this, that spring to mind First up would be using search which will show exploits matching the search term, (eg, search fileformat would return modules matching that term. The other was would be to use the tab completion, so if you type: use exploit/windows/fileformat/ and then hit Tab. It'll scroll through all the ...


16

The major issue here is that your printer is accessible from outside your network. I've never seen a situation where printers need to be accessible from outside a network, and I mean ever! I suggest you get that fixed, and urgently! There's more to printers than most people realize, but the risks can be managed by keeping them updated, turning off options ...


16

Testing for ECB / CBC / OFB / CTR mode is fairly straightforward. It's also straightforward to see if the mode has authenticated encryption like EAX / GCM (though it isn't straightforward to see which mode of AE). ECB: have a file with many similar blocks in the plaintext. Do you see identical blocks in the ciphertext? (Yes this is similar to Dan's ...


16

This is a very complex question, and I'm not sure where you stand technically. I'll lay out some background to help you get to the point. Basic refresher A computer has a couple of important parts: a Central Processing Unit (CPU) and Random Access Memory (RAM). Essentially, a CPU reads a few bytes of memory from RAM, performs the instruction they contain,...


16

As already said, its probably not worth it, but it is a very interesting topic to think about. There was a very good talk on that topic at DEF CON 21 called "Making Problems for Script Kiddies and Scanner Monkeys" which you can find here: https://www.youtube.com/watch?v=I3pNLB3Cq24 Several ideas are presented, and some are very simple and effective like ...


16

How could a IANA reserved port(tcp/0) handle traffic? It can. Generally, TCP (or UDP) port 0 being in a reserved state doesn't mean it can't be used in practice. Though the way Berkeley sockets are designed it's not that easy to bind on port zero, it's nevertheless possible to use it. However, it's highly unlikely that this is actually happening in your ...


14

What you are asking to find out is called enumeration. Reading the SQLMap manual under the enumeration topic provides me with the following information: --dbs for databases --tables for tables --columns for columns There is also a lot of other good information in the manual, so I suggest reading over it if you have more questions about flags and ...


13

Yes, there is, it's called metasploit unleashed. It is an official metasploit wiki with lots of information. It is structured kind of as a tutorial/course, and it gets upgraded and updated regularly. It is probably the best place to start.


12

The question is regarding "Security through obscurity"1. Does hiding your design/implementation (e.g. what server you are running) lead to less instances of exploitation? This is a long debated subject with reasonable arguments on both sides of the fence. All security practices are a tradeoff between cost (e.g. effort, maintainability, money) and benefit (...


12

That seems to be a NetGear log entry, there are two possibilities for this: SYN Port Scan: Someone (very likely automated, by an infected machine) attempting to scan your machine. They send a SYN packet to you, then your machine responds with an ACK packet. In order to prevent a connection from being established, they send you an RST (Reset) packet. (More ...


12

Try https://HTBridge.com/ssl Update 2016-02-08: New kid on the block: High-Tech Bridge does custom ports: Example: Report for imap.spamarrest.com:993 There are a few. But none even close to what SSL Labs does. Here's two sample sites. https://ssltools.websecurity.symantec.com/checker/views/certCheck.jsp http://www.networking4all.com/en/support/tools/...


12

Forget the gigabytes. Use minutes or hours of delay. Many web servers have modules that introduce artificial delays (aka tarpits). It occupies a thread/process on your server, but it comforts a few other servers on the Internet who would have been probed during the time. Of course other bots and other threads of this bot continue their work, so the annoyance ...


11

Well, obviously, whatever heuristics the ISP employs are wrong in your case, since you do not have Java at all. We can imagine a few scenarios: The ISP detection is based on tracking downloads from Oracle's site: their system failed to detect any download of an update from your machine, and therefore concluded that your Java "must be old". (It would be a ...


10

The nmap result "filtered" implies that (if you know there is a host with that IP address) access to the port has been blocked by a firewall or similar, which is dropping the traffic. This is as opposed to the "closed" result which indicates that there is a host on that IP but that there is no active service which responds to nmaps probes. If all ports on ...


10

In msf console, you can use the autocomplete feature (as Rory suggests) you can use the search command: search windows/fileformat -t exploit If not restrained to the console, another idea is to browse them online here http://www.metasploit.com/modules/exploit/windows/fileformat/ You can also use things like Armitage to browse exploits in a nicer way or ...


10

If you properly follow the recommendations and standards that you've mentioned here, you should be reasonably safe, as long as you also keep your software up to date. It's arguably more important to install updates for PDF readers, Adobe Flash, Microsoft Office, etc. than the OS updates, because those are where most day-to-day attacks are focused. A few ...


10

Step one - close all the ports you do not have an explicit business need for! All open ports add potential insecurity - a closed port is a safe port. If you don't know why a port is open, I would be worried - find out what service is running on it. If there is no business need, shut it down! If you can't find out what service it is, shut it down! There ...


10

As a customer of vulnerability reports, I would say yes, but it is certainly a waste of time to give it equal weight as other vulnerabilities. E.g., live, exploitable massive remote access holes or active malicious backdoors wouldn't get the same coverage as something like a DoS vulnerability or in this case a vulnerability in a disabled bit of software. ...


Only top voted, non community-wiki answers of a minimum length are eligible