Blocking Port scans

From: BSK (bishan4u_at_yahoo.co.uk)
Date: 10/24/05

  • Next message: tarunthenut_at_gmail.com: "Scanning Class A network" 
    Date: Mon, 24 Oct 2005 12:34:30 +0100 (BST)
To: pen-test@securityfocus.com

    Hello Everyone,

    Just wanted some feedback from you people. I'm doing a
    Firewall Assessment for a CISCO PIX firewall. The
    firewall allows SYN, FIN, NULL and XMAS scans but
    blocks ACK scans (largely means its a stateful
    firewall).

    Now what do we do to block the scans that are allowed.
    I think it should be easy to block FIN, NULL and XMAS
    scans but how do we block or limit or workaround a SYN
    scan. 1 way that I think is probably blocking or
    limiting the packets from the source (using IDS/IPS)

    Looking ahead to some ideas, thoughts, hints.

    thns bshan

                    
    ___________________________________________________________
    To help you stay safe and secure online, we've developed the all new Yahoo! Security Centre. http://uk.security.yahoo.com

    ------------------------------------------------------------------------------
    Audit your website security with Acunetix Web Vulnerability Scanner:

    Hackers are concentrating their efforts on attacking applications on your
    website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
    futile against web application hacking. Check your website for vulnerabilities
    to SQL injection, Cross site scripting and other web attacks before hackers do!
    Download Trial at:

    http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------

  • Next message: tarunthenut_at_gmail.com: "Scanning Class A network"

    Relevant Pages

    • Re: using Sonicwall to deny fin scan, etc
      ... when a user behind your sonicwall closes the window, apache is ... "FIN Scan"... ... >> firewall, this person is always going to be able to send you a FIN ...
      (comp.security.firewalls)
    • Re: using Sonicwall to deny fin scan, etc
      ... when a user behind your sonicwall closes the window, apache is ... "FIN Scan"... ... >> firewall, this person is always going to be able to send you a FIN ...
      (comp.security.firewalls)
    • [fw-wiz] Erroneous FIN scans
      ... My Sonicwall Pro200 firewall is logging these entries as FIN scans, ... "It is possible that someone is scanning your IP addresswith FIN ... My question is during a quicktime session why would multiple FIN packets be ...
      (Firewall-Wizards)
    • Re: Blocking Port scans
      ... >Firewall Assessment for a CISCO PIX firewall. ... >I think it should be easy to block FIN, NULL and XMAS ... than wondering how to block port scans. ...
      (Pen-Test)
    • Re: TCP FIN Scan SonicWall
      ... because some firewalls and IDS systems will not alert or block them. ... about the rule they use to determine what is a FIN scan. ... >> detect false positives from normal activity behind your firewall. ... >>> Helping Business Use Technology ...
      (comp.security.firewalls)
    • Quantcast