Penetration Testing mailing list archives
Re: All tcp ports open?
From: "Kevin Sheldrake" <kev () electriccat co uk>
Date: Sun, 29 Aug 2004 16:59:35 +0100
Sounds like a honeypot. You might want to use amap or the -sV option of nmap to try and enumerate the real services in amongst the fake ones. Never done it so unsure of the results but logic dictates that it'll work, even if takes "a very long time" (TM).
Kev
I am not sure what is doing this, but I assume it is a software (or some kind of) firewall/hids, can anybody point me in the right direction?I am pen-testing a Windows webserver, and a port scan reveals ALL tcp ports open. hping also confirms that a SA is returned for any S packets sent to any port I try. I can connect via netcat any of the ports, and send data, but nothing is returned. In order to verify services, I am required to connect and check for a banner or send appropriate protocol commands to elicit a response.Has anyone seen this, or have any idea of what this is? Thanks. ------------------------------------------------------------------------------ Ethical Hacking at the InfoSec Institute. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interactionwith one of our expert instructors. Check out our Advanced Hacking course, learn to write exploits and attack security infrastructure. Attend a coursetaught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of your organization. http://www.infosecinstitute.com/courses/ethical_hacking_training.html -------------------------------------------------------------------------------
-- Kevin Sheldrake MEng MIEE CEng CISSP Electric Cat (Bournemouth) Ltd ------------------------------------------------------------------------------ Ethical Hacking at the InfoSec Institute. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. Check out our Advanced Hacking course, learn to write exploits and attack security infrastructure. Attend a course taught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of your organization. http://www.infosecinstitute.com/courses/ethical_hacking_training.html -------------------------------------------------------------------------------
Current thread:
- All tcp ports open? Ben Timby (Aug 29)
- RE: All tcp ports open? Massimo Cetra (Aug 29)
- Re: All tcp ports open? Andres Riancho (Aug 29)
- Re: All tcp ports open? Bill Burge (Aug 29)
- Re: All tcp ports open? dreamwvr () dreamwvr com (Aug 29)
- Re: All tcp ports open? Tim (Aug 29)
- Re: All tcp ports open? Kevin Sheldrake (Aug 29)
- Re: All tcp ports open? Jose Maria Lopez (Aug 29)
- Re: All tcp ports open? Varun Pitale (Aug 29)
- RE: All tcp ports open? Mike Sues (Aug 30)
- Re: All tcp ports open? Jack Burton (Aug 30)
- Re: All tcp ports open? GUsh-T (Aug 30)
- Re: All tcp ports open? Chris Brenton (Aug 30)
- Re: All tcp ports open? Nathan R. Valentine (Aug 30)
- Re: All tcp ports open? sol seclists (Aug 30)
- <Possible follow-ups>
- RE: All tcp ports open? Don Parker (Aug 29)
- RE: All tcp ports open? Meidinger Chris (Aug 30)
(Thread continues...)
- RE: All tcp ports open? Massimo Cetra (Aug 29)