The DMZ - 2013-03-19 (page 1 of 5)

« first day (824 days earlier) ← previous day next day → last day (4061 days later) »

12:23 AM

@Polynomial I don't think I understand what that means.

@ScottPack My point entirely.

Why aren't you in bed yet?

Ok, just edited another one of his copy/paste jobs if somebody would like to peer review it.

just did

he needs to be slapped

@ScottPack Because I'm a rebel.

and responsible chronology is for pussies.

2

12:39 AM

user image

@Polynomial You know what else is for pussies?

@AviD That's primarily where I got the inspiration for that comment :P

@Polynomial Thank you sir. And yes he does.

@ScottPack Cocks?

@Polynomial I was going to say saucers of cream.

12:42 AM

@Polynomial heh, sorry! I didn't know!

@AviD s'all good. glad to see someone else reading TwoGAG

@ScottPack yaknow, at least @Polynomial was subtle. You didnt have to be so damn graphic about it.

@Xander did, and flagged

and good night.

@AviD what, you aren't handling that flag? It isn't even 3am

12:44 AM

Speaking of pussies.

good night (or good morning)

@Gilles ehh. Doing the damn tax paperwork, have to file tomorrow.

every damn time, I say I'm gonna do this regularly, and every time it rolls around, I have to slog through a big pile of months worth of papers.

Just to prepare for the accountant, mind you.

Being self employed is not all its cracked up to be.

2

@Gilles Thank you sir. And actually the whole thing (except for the "Sample command utilizing the -s option:" that I added) was taken straight from the PowerPoint. Including the command line example itself.

@Xander I can't find the exact same command, that's why I left it out of the quote

Ah, nevermind. I take that back.

12:51 AM

it's very similar, but some of the parameter are different

I did miss out a quote before the next-to-last bullet point

Yeah, I did a search for "-s 5" and found it, and made a bad assumption that it was the same without checking.

oh, no, that one is reformulated too, not quoted verbatim

anyway, enough time wasted on that

@Gilles LOL! You're telling me.

@Gilles Ah, yeah, You're more thorough than I am, apparently.

It's close, but not quite the same indeed.

1:13 AM

@asadz We need to speak about your recent answers. The last two seem to have some issues with them, possibly including plagiarism (security.stackexchange.com/posts/32756)

1 hour later…

2:16 AM

I see the asadz lulz continue... :P

@Adnan He is a troll I guess. I have seen people like that on other forums, challenging people to crack their algorithms.

2:35 AM

@D3C4FF yup it is getting hysterical again

@asadz - It's not void of service detection at all, don't know where you're getting that from. The description clearly states Unicornscan has Asynchronous stateless TCP banner grabbing abilities, protocol specific UDP Scanning, and Active and Passive remote OS, application, and component identification by analyzing responses. What more would you want in the service detection sense? — TildalWave 6 mins ago

@TildalWave I think it's sad really.

user image

I sense a disturbance in the force

3:05 AM

@TerryChia what the..?? This is real ultrasound? metro.co.uk/2013/03/11/…

@TerryChia I lulz'd

3:54 AM

ARGH. Turns out, if you scan using Nmap with -verbose and/or -debug flags set and then export the results, you CANT re-import them ;__;

@D3C4FF mind me asking why are you scanning up to /8 ranges? Some research project requires of you to map such large ranges by services? You do realize there are easier ways to obtain her Skype address, right? :P

@TildalWave xD I didn't know you could pull skype names via pings :P

Its for work.

@D3C4FF Really? Can't say I tried it out before but that is surprising. Which format are you exporting it as?

I'm currently consulting for a uni doing an internal pentest. I've got 5 days to scan pretty much 10.x.x.x

@TerryChia both nmap and .xml, i usually do so for posterity.

4:09 AM

@D3C4FF Ahh.

@D3C4FF Wait, what flags are you using again? A -sV on that subnet is gonna take a hella long time you know. :P

@TildalWave It also doesn't help that one of my machines is unstable as fuck.

@D3C4FF LOL well at least you're not required to scan IPv6 /8 :)))

@TerryChia Why/

@TildalWave I lookforward to doomsday coming before widespread IPv6 adoption

@D3C4FF That really isn't a good idea.

Do a ping scan on the whole subnet first.

Then do a -A on the host that are up.

about 30% of hosts here don't respond to ping.

4:12 AM

Gimme a sec, I'll start up my vm to see what flags I would usually use.

Damn windows host...

nmap -sn -T4 10.1.0.0/16 ?

@D3C4FF Yes. Do note that the -sn flag isn't only a ping, despite it's name.

> The default host discovery done with -sn consists of an ICMP echo request, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request by default.

Yep

Then import the list of host that are up for a second scan, using the -Pn flag this time.

You might wanna use the -n flag to skip dns resolution if you can, it's hella slow.

I daresay it's pretty much impossible to scan a whole /8 subnet in 5 days with the -A flag.

Not to mention the -A flag doesn't perform UDP scans IIRC, which might be something you want.

Well while one PC's been scanning i've been pwning and so i've got the network diagrams so i know what subnets to focus on...

No. UDP is blocked pretty much everywhere here :(

4:19 AM

@D3C4FF Well, use the -sn or even the -sS options to map out which host are online. Then focus the -A scans against interesting hosts.

There really isn't a point in running the NSE against every single IP in the whole subnet. :P

See? This is why i come to sec.se! :D

Cheers @TerryChia :)

Lets see how long it takes now...

lol xander you want me to pastebin the entire scan results of class 16 subnet address im so much amazed neither one of you had the courage to technically debate why this command would fail? xander its not about 10 year paper its pure simple ping scanning how much has that change over past 10 years?i habe supplied this command with its parameters what else is left. — asadz 10 mins ago

Simple ping scanning? That goes to show he has absolutely no idea how a port scanner works.

Nmap has improved A LOT in the recent versions.

Despite my gripes, i fokkin' love NMAP

@D3C4FF Yeah. It's my favourite security tool tbh.

Port scanning is fun.

I think asadz is deleting his own posts? or a mod is?

4:35 AM

@D3C4FF Hmm? His answer to your question is still there.

But he tends to delete his post once it gets downvoted a bit.

I'll be back in a few, just gotta grab lunch.

the comments at the bottom sorry

4:55 AM

Hello and welcome to IT Security! Your question seems a bit too open-ended, and might inspire debate. Please refer to the FAQ on what questions aren't expected to be properly answered and why not. But I see some parts of it that certainly need answering, as it suggests some misapprehensions regarding what type-safe and memory-safe actually mean for languages, compilers and their memory managers in terms of system and application level security. If you could re-write it to be more specific for the 2nd part, that'd be fab. Thanks! — TildalWave 4 mins ago

is this acceptable review for the question asked?

@TildalWave It's ok.

> However, is JVM in general (still) a good choice for high secure server applications? Are other JVMs (e.g. from IBM) more secure than Oracle's for this purpose?

I think changing those two lines will make it a good question.

I wanted to write something up, but I realized I know nuts about Java so screw it.

@TerryChia I asked OP to re-word it and gave him a link, what questions are expected here... I say we let him/her a few minutes first, some do get it, despite some unnamed others showing lack of understanding LOL... I'm optimistic

@TildalWave Hey, he is a new user. No reason not to be optimistic.

It's actually a good question. I can't remember if it's a dupe though.

i'm just running through JVM questions

19

Q: Should I be disabling Java?

First it was Apple, now it's the US government... U.S. urges users to disable Java; Apple disables some remotely New malware exploiting Java 7 in Windows and Unix systems How serious is this "unspecified vulnerability"? Should all users be disabling Java until we know things have been patche...

known-vulnerabilities java zero-day

There it is. I knew I read something about it by The Bear.

5:02 AM

yes, but is not quite the same question. neither is this one:

1

A: Is there a need to define "language safety"?

Language safety can be interpreted more broadly than affecting merely security. But as this is a security site, let's just restrictive ourselves to security. Clearly language selection has a significant on whether you will get certain types of vulnerability. Write a non-trivial program in C and ...

@TildalWave I think The Bear's answer covers it pretty well. It's basically a problem with the client-side apps, server side is fine.

Problem is, how the question is written, it's really a two-part question. First part is OP's misapprehension about language safety, and the other is the JVM part

Hmm good point. Goes to show how much I know about Java. :P

Damn Java..

@TerryChia Sure, but I can't flag some question as a duplicate of another, completely different one only due to the answer covering both LOL

@TildalWave Actually, I think the language safety part is irrelevant. He is just explaining why he likes to use Java instead of C/C++.

The main question is the safety of Java for use in servers and the JVM thing.

5:06 AM

@TerryChia hmmm that's a bit unclear to me. I read it as he likes to use Java for being safer to use than C... which is true in the context of programming languages, but does not necessarily directly translate to safe as in non-exploitable

and I think OP seems to be confusing one with the other... I might be wrong, tho

@TildalWave I guess it's better to wait for him to clarify.

@TerryChia Yup, cheers

Nom nom. Waddimiss?

@TildalWave @TerryChia Either of you fine folks have a simple way of deleting every second line of approx 1200 lines of text?

or. every line that's 1-3 chars long?

@D3C4FF Sounds like you need some serious awk-ing.

You could probably string something up, but I wouldn't call it simple.

@D3C4FF fire up some database -> import as CSV -> run "SELECT * FROM table1 WHERE Len(table1.field1) > 3"

5:14 AM

What about how to rip all IP's out of the Nmap results? :P

Gah. I don't have any Database servers handy .-.

Deleting every second line is probably simple. Just write a script to iterate through the text and delete every alternate line. Some looping and if/else should do it.

@D3C4FF Work with the XML files. Waaaaaaay easier.

@D3C4FF want me to write some JS? so... you need only lines that would be longer than 3 chars, right?

grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' file.txt

Yeah

@TildalWave that'd be awesome :D

is there a way to say 'NOT' in regex?

so search anything except for (above regex)

Regex hurts my brain. :(

Even the simplest ones make me stop and think for a few minutes.

Same... :P

okay.... ^(?![0-9]*\.[0-9]*\.[0-9]*\.[0-9]*) SEEMS to do something along the lines of what i want

DAMNIT REGEX. FUCK

5:40 AM

@D3C4FF jsfiddle.net/97mpR/4

sorry it took so long but ... DAMNIT JAVASCRIPT. F*** :)

Haha. I just figured out in Notepad++

(\d+\.\ (etc)).*

then mark all as bookmarks.

and delete the inverse

:D

@D3C4FF well yes of course, or that :)))

xD

@D3C4FF That's no fun.

but does notepad++ have a nomnom function that eats all the short lines? :P

5:44 AM

@TildalWave Javascript is a weird choice. I'd have done it in python (or perl if you are a sadist).

@TerryChia well sure but I wanted smthng that I can give as a working demo, not just copy/paste the code

@TildalWave Fine, fine. :P

@TerryChia but do think of me next time you make a new EC2 subscription :P

Hahaha

@TildalWave sadly no it does not

@TildalWave EC2? I don't have a EC2 subscription.

5:51 AM

Fark. The 4G here is shocking D:

2 hours later…

7:27 AM

I'm answered one question on SO that has a bounty of 500 rep on it. I did post it here 1st, if someone else would be interested to answer and suggested how (what I thought the problem was and how to solve it). OP is satisfied, but the problem is that I've actually helped OP first in the comments, and posted a real answer later, and OP didn't come back yet. The bounty's grace period is now expiring in an hour, and no1 cares to up-vote my answer as the question isn't gaining much interests.

What's the suggested course of action? Is it OK to ask for peer-review here and if some1 feels it's worth an up-vote to do so?

@TildalWave What's the answer? I'll upvote if it's good. :)

Link?

10

Q: Intermittent receive failure using mvc webgrid on server only

I am using the System.Web.Helpers.WebGrid extensively throughout our application, and for the most part it is fine and in fact running locally it is always fine or with a self SSL on the server it is also fine. So I don't know if the problem could actually be with IIS or a firewall, or the actual...

c# asp.net-mvc iis webgrid

Answer is what I could muster given the circumstances, but OP is satisfied as he said in the comments.

@TildalWave Got my +1. You just need 1 more and it will automatically be awarded to you.

But you will only get half of it sadly.

@TerryChia Thanks! I feel rather awkward for even mentioning it and asking for peer-review, but it would be a waste of a nice bounty IMO and I'm kinda capturing the flag for the team, as I probably wouldn't have thought of the solution if I wasn't hanging here so much.

7:33 AM

CTFFTW!

@TildalWave If you feel awkward over here, you probably shouldn't be in this room. Just saying.

2

@TerryChia well you know what I meant, not awkward for being here, but it does feel almost like begging for attention, which would be lame on my part,... in this sense ;)

@D3C4FF cheers!

@TildalWave Well, this room is home to a couple of repwhores, especially @Polynomial. So no shame!

;)

@TerryChia not being as bad as @Polynomial is not much consolation.

ROFL... frankly, I'd much rather gain more rep here than on SO, but with such fierce competition it'll take some time

7:38 AM

@AviD Morning.

You wanna throw this over to SU?

1

Q: How can i get a different IP address for wireless connection

I always get same IP address for my wireless adapter. so far i have tried ipconfig /dnsflush followed by ipconfig /renew net stop dnscache but it still keeps getting me the same ip address. does our router at workplace store mac address of machine & then assign same ip address again....

windows operating-systems dhcp

not in a hurry to gain it tho, i'd much rather take time to answer questions that I can and properly than do the aszad on them

@TildalWave np

@TildalWave Here's a tip. Answer the questions tagged password.

You will be surprised how much rep you can gain for common-sense answers.

@TerryChia no, its a crap question. We Don't Migrate Crap.

poor aszad, he'll become a meme one day xD

7:40 AM

@D3C4FF We already have an Andrew. It's enough IMO.

@TerryChia yeah I know which questions are rep trains, but I'm actually more into web-app security than really good at expressing myself with others, and of course, some I still don't really get... but we have our Ursus for those LOL

@TerryChia oooh? Whats an Andrew? (i'm new remember! Don't hate me!)

5

A: The Memes of IT Security

Meme: Tinfoil Hattery Originator: Some say @Rook invented tinfoil hattery, but that's just a coverup. It was really invented by the Illuminati, in an attempt to make us all look crazy. Cultural Height: TBD Background: Tinfoil hattery is a term used to describe any behaviour that is paranoid be...

1 1 11

web-application passwords authentication network hash firewalls email

Note the suspension YEAR.

@TildalWave so go for the Unanswered questions. It's always a good thing to shorten that pile..

What about AES? For low wadges, they could be researching and analysing like NSA. Or factoring keys using scientific calculators with wifi. When human decision making makes difference, why not. – Andrew Smith Aug 9 '12 at 21:04

7:43 AM

LOL Rook @ Tinfoil :)

That's beautiful. It brought a tear to my eye

@D3C4FF You should go through some of his answers sometime.

@AviD I thought I was? Problem is, no1 really notices those, not even you :P

@D3C4FF Do yourself a favor - stop reading his work now. Before your head implodes and takes the whole neighborhood into the black hole.

@AviD well not a problem... just a joke

7:44 AM

Morning all

-9

A: Is multiple encryption a good idea?

In the following scenario, the encryption makes sense, because the information is protected when going over the internet the way, that even the internet endpoints are compromised, the data stays secure. This is also reason why to build high security encrypted networks on the back-bone level, and ...

just cleaned up a bit and commented:

This is one of my favourites.

@asadz - It's not void of service detection at all, don't know where you're getting that from. The description clearly states Unicornscan has Asynchronous stateless TCP banner grabbing abilities, protocol specific UDP Scanning, and Active and Passive remote OS, application, and component identification by analyzing responses. What more would you want in the service detection sense? — TildalWave 5 hours ago

@RoryAlsop @Rory!

7:45 AM

@RoryAlsop morning rory... how was your 1st day at the new job?

@AviD double pinging, eh

@TildalWave nah - I start next week

:-)

heh, who doesnt appreciate a good doublepinging in the morning

about to fight the blizzards to get the kids to school :-)

@AviD nearly made me snort my cornflakes

@AviD hahaha!

right - snow time. Back in a bit

7:45 AM

@RoryAlsop ha, bet you miss the mideastern sun now, eh? ;-)

@D3C4FF @TerryChia Morning guys, just as potential help what I do for discovery is start with -sP -PS<rangeofports> so essentially a modified ping scan with common ports (21,22,23,25,80,135,139,443,445 something like that) then use that as the input to a "proper" scan

@RoryAlsop don't get it, is something wrong with my reply there?

@RoryAlsop yeah I hope it gets a bit better for tomorrow, I've got an on-site in Dalkeith..

@TildalWave I think he was just showing appreciation.

@TerryChia That's the most bizzare thing i've ever seen here. And also the lowest scoring xD

7:46 AM

@AviD oh so that's how it looks like :)))

@RoryMcCune Morning to you to. Thanks dude :) I rarely have to scan such large networks so quickly so its an unusual challenge for me.

@TildalWave no, we usually show appreciation with a doublepinging.

@RoryMcCune I think -sP is an old flag? -sn is the newer version.

@AviD nothing like a quick doubleping in the morning to wake you up eh?

But yes, agreed on the -PS for common ports.

7:48 AM

@AviD you should only ever do a single ping, aren't you a security analyst? :P :P

@D3C4FF I've never had a /8 to do, but have had enough large ranges in tight deadlines that I researched the nmap options a bit. Another thing to look at is the timing flags if you're in a hurry. --max-rtt-timeout --max-retries --scan-delay are all useful and on an internal with a good network you can tighten up a lot from the defaults.

@TildalWave well I have protection

-sN Is no port scan.

@TerryChia

@TerryChia could well be, must admit I still use -sP as it works, but wouldn't be surprised to see it's changed.

@D3C4FF -sN is the NULL flag. -sn is the ping one. They are two different flags. ;)

7:50 AM

@TerryChia ah sorry, i missed the lacks of caps

@RoryMcCune Yeah, -sP is still supported, but -sn is the recommended one in the nmap docs I think.

No clue what's the difference.

@RoryAlsop thanks for the comments

@TerryChia dunno for me the -sP makes more sense, but hey it's their program :)

@TerryChia IIRC one is ICMP ping?

Now that I think about it, the nmap flags are a real mess. I agree with @ScottPack.

7:52 AM

@RoryAlsop as to really understand how does this works I have an example for some self-reflection. I got (-1) plus a silver badge on question related to 'How to detect if files were saved or copied to a USB drive?'. This is how effective the irony really is.

@TildalWave According to the docs, -sP is being phased out in favor of -sn.

-1

Q: How to detect if files were saved or copied to a USB drive?

I want to know if files from my computer were copied to a USB storage device. I want to know if there is a solution that would work in post activity scenario (e.g considering files have already been copied). I have already used a software which would pull the information from registry (HKEY_LOCA...

windows forensics usb-drive

Not sure if there is an actual difference though.

@TerryChia I've seen some discussion about it recently, let me google for it

@RoryAlsop i love to read a FAQ about this grey-areas

7:53 AM

@asadz A widely viewed question might not be a good question deserving of upvotes. There is a distinction.

@RoryMcCune I'll check em out thanks! :)

@TerryChia Seconded @asadz

@TerryChia hmmm no I was wrong -PI is an ICMP echo, but I'm not sure for inclusion of syn packets with -sn or -sP

good versus 2500+ people who may have benefited from its analysis? called it quantitative or qualitative analysis its just misses the entire scope and purpose.

I guess silver badge is white silver talking in pixel just a integer value lol

Also, please understand that votes are an individual opinions. If you are getting a lot of downvotes, it is clear that the community as a whole disagrees with the value of your question/answer. One vote however doesn't really indicate much.

Please do not take votes so personally.....

lol

i guess its not me lol its the rest of the world having the same issues with SE

but i guess it just need some googling to see what the other side says

i'm not the only ONE

7:56 AM

Does anyone else feel like they're in the matrix when they VPN into work, then RDP to another machine, boot up a vpn, connect to a different VPN network and then RDP into yet another machine to do work on a remote web-console?

4

others have been victim too.

Cause i sure do.

@D3C4FF That gave me a headache.

What sort of latency are you experiencing?

@TerryChia Welcome to remote management! :D

anyhow, i was here for @RoryAlsop

bye guys

:)

7:58 AM

@TildalWave Yeah, nmap is incredibly complex... IIRC the sn flag does some other stuff besides a simple ICMP ping.

@TerryChia Y'know. Its not that bad actually. I'm on a lot of fat pipes

@RoryAlsop You can come out now! asadz is gone! :D

@TildalWave Yeah, it does. nmap.org/book/man-host-discovery.html

> The default host discovery done with -sn consists of an ICMP echo request, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request by default. When executed by an unprivileged user, only SYN packets are sent (using a connect call) to ports 80 and 443 on the target.

Mar 8 at 13:54, by AviD

@Adnan First rule of Stack Exchange: BE NICE.

@TerryChia IIRC the full paper book has more detail as well. 468 pages of nmap goodness amazon.co.uk/Nmap-Network-Scanning-Official-Discovery/dp/…

well worth reading if you do a lot of portscanning...

@RoryMcCune Yeah, I have that book on my shelf. It's a good read on the workings of nmap.

Lazy to open it up just to search for a small tidbit of information though. Google is so much simpler. :P

@TerryChia Okay okay! I'll be nice! Sorry asadz!

8:07 AM

@TerryChia Thanks, that's the link I was reading not a few days ago. But I still don't get it how's that different to -sP flag? I'm sorry if I sound anal, but wouldn't -sP do the same one *nix (but not on Windows, obviously)?

@TildalWave I think the -sn flag is just replaces the -sP flag. Probably no real difference.

The windows thing is just because Windows doesn't support manipulating raw packets I think.

@TerryChia So, me not getting it where's the difference + there is no difference = me getting it? YAY! My Schwartz is strong today!

@TildalWave My guess is that Fyodor just woke up one morning and decided he likes the sound of -sn better than -sP.

well 'small s, capital P' does sound a bit "dickish" :)

yaknow, all this nmap discussion, is really disgusting me. It's ruining my morning.

Screw you guys, I'm goin' home.

8:17 AM

@AviD So's your face.

@AviD what from your office? that's a looooong walk

@TildalWave hehe, actually I meant to my office. From this hellbound nmap talk.

like the Space balls teleportation scene, or you could do that The Men Who Stare at Goats i'm going to the next room' scene :)))

Aww @AviD why no love for nmap?

Any way this could be genuine?

0

Q: Linux based virus / malware source code in C

I am working on project of metamorphic code generator. In order to test this project I need some virus source codes in C. Since I have developed this tool on Linux. I need virus codes which are Linux based. Are there any good links from where I can download such virus codes?

@D3C4FF Wow!!

8:20 AM

no. it's bullshit.

Isn't metamorphic code a way for viruses to avoid detection by AVs? Why would he want more payloads on that, he's building Skynet?

he's talking shit basically.

@AntonyVennard I think its weird that someone who's trying to make 'metamorphic' code can't find/write his own basic linux malware?

But i could be wrong, maybe he wants something more complex

@D3C4FF you mean like a brain?

@D3C4FF precisely.

plus he keeps saying "virus codes" which is kinda... skiddish

I don't think he's ever written a line of C in his life, personally.

8:29 AM

@Polynomial G1b c0d3 pl0x.

^

@D3C4FF Yep. And you don't need virus codes to write metamorphic code. Any simple program would do.

4

Q: Grepping for CIDR ranges

From time to time I want to grep CIDR ranges out of my Apache log files. This is easy for ranges that fall on the natural boundaries (/8, /16 and /24) but not so easy for other ranges such as /17 and /25. Examples: # 192.168.0.0/16: (easy) grep " 192\.168\." access_log # 192.168.128.0/17: (mo...

ip regex grep cidr

@D3C4FF Thought that might be useful. :-)

@Ladadadada damn, there's a tool for everything these days

Oh, and grep -v <REGEX> inverts the selection so it prints out everything that doesn't match the regex.

8:34 AM

yeah, that's a fun one

I use that one to get a list of apache logs that aren't 200 OK or 30x redirects

@Ladadadada Haha thanks :) I actually ended up using an unholy combination of regex in notepad++ and excel spreadsheets to parse the data.

@Ladadadada That's bloody useful though! Cheers

@D3C4FF oh you ended up doing much more than that and you know it! I felt like an effin AIBO :P

@TildalWave Yeah, that's true. I spent a good 40 minutes fucking around with that

@D3C4FF what's your progress now? ETA?

Also securityartwork.es/2013/02/07/…

8:51 AM

@TildalWave I've actually left the client site and the box is just humming away scanning. It's been going since our intial discussion and hadn't finished yet so... shrugs

I'll letcha know exactly how long it took tomorrow :P

@D3C4FF if you're really doing this on /8 range, that's then 16777216 IPs... just saying that if I was in your shoes, I'd rather have a rough estimate on ETA than be surprised it's still crunching it in a weeks time LOL

@TildalWave It's lucky he isn't using the -A flag now.

That will probably take a month to complete.

@TildalWave well, it did /16's in a reasonable amount of time :P So i figure it should be fine.

If not, i've still got other machines scanning away regardless.

@TerryChia xD

(scanning on smaller subnets i should add)

@TerryChia that's resolving DNS, right? by my stats here, you can add roughly 0.2s per each IP then, depends on the timeout on failed ones, which is 4s with my code... so... 38 days, 20 hours,... not nice :)

@TildalWave No. -A is basically combining the -sV flag with the NSE.

Needless to say, that takes hella long.

9:03 AM

"This option enables additional advanced and aggressive options. I haven't decided exactly which it stands for yet. Presently this enables OS detection (-O), version scanning (-sV), script scanning (-sC) and traceroute (--traceroute). More features may be added in the future. The point is to enable a comprehensive set of scan options without people having to remember a large set of flags..."

It's quite tricky to navigate through nmap documentation, no wonder I'm still lost with it :(

I like the 'I haven't decided exactly which it stands for yet.' part. Makes it so much clearer :))))

@TildalWave @TerryChia FYI, out of a /16 subnet, approx 600 live hosts.

But that's a 'busy' subnet

@D3C4FF Oh, don't dump them into a -A scan straightaway. 600 live hosts is still gonna take quite a while. I'd run a -sS scan to narrow them down further first.

I really doubt your pen testing scope involves breaking into what should mostly be workstations anyway.

9:20 AM

Actually, mostly not workstations....

I've excluded those subnets from the scans

600 live servers? Woah...

Yeah.

Its a uni shrugs

What did you say you were pen testing again?

oh.

Ahhh.

9:21 AM

And they share resources with 'other things'

and companies

Sounds like you have a real fun job ahead of you.

I don't know how that works exactly.

Yeah. I'm already in... Just gotta get me some admin privs...

Plan is A) Find computer room, B) flash BIOS, C) bootdisk to recover SAM files D) crack on GPU cluster in other office E) go to different computer using same local admin, recover BIOS password (if possible), F) recover any cached creds G) Assume local admin for desktops is the same as for servers I) ??? J) PROFIT! :D

Yay - that was fun. The entire neighbourhood is one big skid pan! Just over 5 inches of snow overnight. If only those other pesky drivers would get off it it would be mine all MINE

@RoryAlsop You don't sound old. I'm shocked.

@asadz - no grey area at all. Comments are for clarification. Once clarified, questions or answers can be tweaked and the outdated comments removed. They are not for extended discussion, name calling, arguments...yadda yadda

@TerryChia ah hahahaha

9:25 AM

Does anyone know how to pinpoint what version of IBM AIX a server is running via a reverse proxy? :)

Also @asadz - you can get whatever badges, upvotes and downvotes on any post. No irony needed - it's all just votes and views, at the end of the day

@D3C4FF RTFM. :P

@D3C4FF fingerprinting ? or have you got command line?

@TerryChia @RoryAlsop Fingerprinting. No command line. Just a webservice.

command line is just lslpp -L bos.net.tcp.client

@D3C4FF Can't nmap grab that info for you?

Might not be really accurate though.

9:27 AM

Apparently not :(

@TerryChia this'll sound retarded but is there any super accurate (probably slow) scan that NMAP can do to be as accurate as possible?

Like if you had a single high value target and wanted to make sure that its scanning correctly etc

@D3C4FF hmmm - not sure. Was going to say nmap would probably be your best bet but then saw ^

@D3C4FF The -sV and -O scans are fairly accurate if enough ports are opened.

If you really want to be 100% accurate, no choice but to enable --packet-trace and sort through the information yourself.

Alright, brb food.

Packet-trace awayyyy!!!!! woosh!

@TerryChia do you know if -A actually includes -O -sV by default (like does it enable and use them or just 'enable the ability to use them'?)

cause i've always errd on the side of caution and gone -O -A -sV

@D3C4FF It's on by default if you use -A.

awesome

so i'm gonna try "nmap -sT -p 443 -T3 -A -Pn --packet-trace 1.2.3.4"

Seem legit?

9:38 AM

@asadz - also, regarding plagiarism. Xander and Gilles edited that acknowledgement in - it wasn't you! And remember, on Stack Exchange, people will upvote you when they think your answer is good and downvote when they think it is bad. Simple as that. That is how this site is supposed to work.

@TerryChia seemed to work, scan took a mere 53 seconds. But still not enough detail. No version info :(

No, you have to use --packet-trace with the usual flags like -sV or -A. Then trace through the packets sent and received together with their headers to determine if the results nmap displays is accurate.

It's an incredibly time-consuming process though.

9:56 AM

wholly carp, don't you people ever work?

@AviD Holidays bitch. Deal with it.

.... today?

Until the end of April actually.

« first day (824 days earlier) ← previous day next day → last day (4061 days later) »

Transcript for

Mar '1319

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile