Re: how deep do i need to dive ?

From: Ari Rankum (Ari_Rankum_at_invalid.invalid)
Date: 03/28/04

  • Next message: Ari Rankum: "Re: how deep do i need to dive ?" 
    Date: Sun, 28 Mar 2004 15:25:44 GMT

    Beowulf wrote:
    > On Sun, 28 Mar 2004 06:07:03 +0000, Ari Rankum wrote:
    > ..
    >
    >>done that, you might avail yourself of the "ShieldsUp" test at
    >>www.grc.com, or some similar over-the-net scanner. ..
    >
    >
    > I had done that and the grc.com scan of my system showed it was locked up
    > tight, no open ports, very secure. That is a good sign I am thinking?

    That's a good sign. It's an incomplete sign, but a good sign. It's
    incomplete because Gibson either scans a pre-defined list of ports, or a
    custom list that you specify, but never *all* tcp and *udp* ports. Lots
    of trojans install servers on obscure high-numbered ports.

    In addition to nessus, take a look at nmap for remote scanning of a
    machine. Locally, you can do:

    nmap [your IP address] -p 1-65535
    nmap [your IP address] -sU -p 1-65535

    -and-

    lsof | grep TCP
    lsof | grep UDP

  • Next message: Ari Rankum: "Re: how deep do i need to dive ?"

    Relevant Pages

    • RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second
      ... Not only did he say that he ran lsof on the system (no ... Random unprivileged TCP ports below 5000 ... > I found out that by default nmap doesn't scan every ...
      (Incidents)
    • RE: ¡¡I NEED HELP!!
      ... I telnet to the host in those ports and got nothing but it ... Do you know the official site of lsof? ... Håkan Stensby: how does fuser work? ... Do You Yahoo!? ...
      (Security-Basics)
    • RE: ¡¡I NEED HELP!!
      ... If you have debian and dont have lsof do this: ... I scanned my homeserver for open ports and I found that I have the ... 20034 NetBus Pro ...
      (Security-Basics)
    • Re: Has my server been hacked?
      ... If your server has been hacked then most likely those ports are being ... hidden from netstat and lsof via a rootkit of some kind. ... tyler at hudakville dot com ...
      (comp.os.linux.security)
    • Re: Disable Remote X11 and ipp Logins
      ... > I did a nmap scan on Red Hat 9 computer and I got this: ... netstat -tulpn would have been faster. ... or lsof -i ... > How do I disable the remote logins on these 2 ports so I can be in ...
      (comp.os.linux.security)