Re: All tcp ports open?

From: Jose Maria Lopez (jkerouac_at_bgsec.com)
Date: 08/29/04

  • Next message: grutz_at_jingojango.net: "Re: listing directory structure within webserver root" 
    To: "pen-test@securityfocus.com" <pen-test@securityfocus.com>
Date: 29 Aug 2004 18:58:29 +0200

    El dom, 29 de 08 de 2004 a las 09:04, Ben Timby escribió:
    > I am not sure what is doing this, but I assume it is a software (or some
    > kind of) firewall/hids, can anybody point me in the right direction?
    >
    > I am pen-testing a Windows webserver, and a port scan reveals ALL tcp
    > ports open. hping also confirms that a SA is returned for any S packets
    > sent to any port I try. I can connect via netcat any of the ports, and
    > send data, but nothing is returned. In order to verify services, I am
    > required to connect and check for a banner or send appropriate protocol
    > commands to elicit a response.

    It seems like a kind of software firewall, like Zonealarm or Personal
    Sygate Firewall that it's responding to every port to check if it
    has to let the packets in or not. 

    -- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA
The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"
------------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. All of our class sizes are
guaranteed to be 12 students or less to facilitate one-on-one interaction
with one of our expert instructors. Check out our Advanced Hacking course,
learn to write exploits and attack security infrastructure. Attend a course
taught by an expert instructor with years of in-the-field pen testing
experience in our state of the art hacking lab. Master the skills of an
Ethical Hacker to better assess the security of your organization.
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
-------------------------------------------------------------------------------
  • Next message: grutz_at_jingojango.net: "Re: listing directory structure within webserver root"

    Relevant Pages

    • Re: Tool to find hidden web proxy server
      ... That one port is often DNS/udp. ... And finding a firewall piercing through ICMP packets ... Jose Maria Lopez Hernandez ... The only people for me are the mad ones -- the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow Roman candles. ...
      (Pen-Test)
    • Re: Strange response from network
      ... My guess is that hop 7 is home of a firewall of some sort. ... Regarding the port number, my guess is that port 2443 is the 2nd SSL ... Ethical Hacking at the InfoSec Institute. ... learn to write exploits and attack security infrastructure. ...
      (Pen-Test)
    • RE: Tool to find hidden web proxy server
      ... I don't think there's an easy way to find a transparent proxy installed ... in the same machine that the firewall and properly firewalled. ... The only people for me are the mad ones -- the ones who are mad to live, ... Ethical Hacking at the InfoSec Institute. ...
      (Pen-Test)
    • Re: Port numbers???
      ... Lars M. Hansen wrote: ... If you have a firewall that uses application proxies, ... > firewall may block anything on port 80 that isn't legitimate http ... The only people for me are the mad ones -- the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow Roman candles. ...
      (comp.security.firewalls)
    • Re: Tool to find hidden web proxy server
      ... If you are portscanning to find proxies don't forget port 3128 as ... The only people for me are the mad ones -- the ones who are mad to live, ... the ones who never yawn or say a commonplace thing, but burn, burn, burn ... Ethical Hacking at the InfoSec Institute. ...
      (Pen-Test)