Re: Port Scanning Issues

Does port scanning and discovery with Windows XPSP2 work more
naturally from within Cygwin or or a *nix OS running within VMWare, or
is it better to just perform these tasks with NMAP from within native
*nix?

On 6/26/07, Lee Lawson <leejlawson@xxxxxxxxx> wrote:
Port scanning is not an exact science, although it should be.

With regard to UDP scanning, a port is determined as open if it does
not respond to probe attempts. This means that if it responds with an
ICMP port unreachable message, it's closed, it no response is
received, it is thought to be open.

There are a number of reasons that causes a lack of response to a UDP
scan, such as network issues, firewalls, luck! I find that UDP
scanning, especially over the Internet, is likely to cause conflicting
results.

What do you get for TCP results?
Are you scanning on the LAN or over the Internet?
Have you tried nmap?

Something worth trying as an exercise is to identify all of the open
ports on the local, target system (if you have access to it!). You
can use a number of tools to do this, but I like fport. It's a small
command line tools that lists the PID, port, protocol and parent
process. Run this tool and then compare the locally gathered results
to the port scanners.


On 25 Jun 2007 21:59:58 -0000, crumdub12@xxxxxxxxx <crumdub12@xxxxxxxxx> wrote:
> A Chairde,
>
>
> Havin, some issues with scanning stacks on my system.
>
>
> 1. Using Superscan4 , I scan stack UDP-TCP 1-65534 , Sometimes I
>
> get no ports open , another time I get 49159 UDP Ports open, only get port report, no attempt made to open any ports ... , when get open ports , I always get 49159 UDP Ports ...... , use the scanner at 250msecs , takes around 16 hours to finish.
>
>
> 2. Using Languard, Nessus and Retina , get different scans from each tool, any ideas why, how do I find out real ports open.. differences can be 10,000 ports
>
>
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Are you using SPI, Watchfire or WhiteHat?
> Consider getting clear vision with Cenzic
> See HOW Now with our 20/20 program!
>
> http://www.cenzic.com/c/2020
> ------------------------------------------------------------------------
>
>


--
Lee J Lawson
leejlawson@xxxxxxxxx

"Give a man a fire, and he'll be warm for a day; set a man on fire,
and he'll be warm for the rest of his life."

"Quidquid latine dictum sit, altum sonatur."

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------



------------------------------------------------------------------------
This List Sponsored by: Cenzic

Swap Out your SPI or Watchfire app sec solution for
Cenzic's robust, accurate risk assessment and management
solution FREE - limited Time Offer

http://www.cenzic.com/c/wf-spi
------------------------------------------------------------------------

Relevant Pages

  • [TOOL] WeBrute - Directory Brute Forcer
    ... Get your security news from a reliable source. ... # Scan 127.0.0.1 port 80, Use wordlist and admin as start path ... # Scan 127.0.0.1 port 80, Use wordlist, and traverse scanning and verbose ... sub catchInterrupt { ...
    (Securiteam)
  • Re: Legal? Road Runner proactive scanning.
    ... Also makes me think that their port scanning is no different than anyone ... > Attend a course taught by an expert instructor with years of ... Attend a course taught by an expert instructor with years of ...
    (Security-Basics)
  • [REVS] Host Fingerprinting and Firewalking With hping
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... by sending several packets to the remote machine and reviewing ... good job in scanning and guessing the remote operating system. ... Service port fingerprinting and OS fingerprinting in certain fire walled ...
    (Securiteam)
  • Re: Reporting Hackers
    ... If I saw someone checking every door on every house on the ... A person scanning my ports is not at all like a person ... > standing on my property and rattling my doorknob. ... prohibiting unauthorized port scans. ...
    (microsoft.public.security)
  • Re: Whats going on here?
    ... >upstream path portscanning, using source port 80 to fool misconfigured ... Three scenarios, both based on the facts that ZoneAlarm is host-based, ... Scenarion #1: Someone port scanning your system: ... Someone external to your network would receive no ...
    (Incidents)