Re: Host responses only in case of range scan

[Matias Katz <matias () matiaskatz com>]

Hey Martin,

Doing a parallel scan in an entire range splits the scan across hosts,
lowering the number of packets sent to the same host in a row, thus
cheating the IDS.

That's what could be happening to you.

Bye!

Matias Katz

Mail: matias () matiaskatz com
GPG:  0x8C7C3B7E
TW:   @matiaskatz
Blog: www.matiaskatz.com

Buenos Aires, Argentina


On 13/09/11 06:49, TAS wrote:
> You can reduce the subnet to include 10.10.10.1 and still do a range
> scan without the grep and see the results.
>
> -
> TAS
> http://twitter.com/p0wnsauc3
>
>
>
>
> On 11 September 2011 05:32, Martin T <m4rtntns () gmail com> wrote:
> > Hello,
> > if I execute following command:
> >
> > nmap -PN -p443 -T4 -sS --reason 10.10.10.0/27 | grep -A3 10.10.10.1
> >
> > ..I get following results:
> >
> > [root@ ~]# nmap -PN -p443 -T4 -sS --reason 10.10.10.0/27 | grep -A3
10.10.10.1
> > Nmap scan report for 10.10.10.1
> > Host is up, received user-set (0.019s latency).
> > PORT    STATE SERVICE REASON
> > 443/tcp open  https   syn-ack
> > [root@ ~]#
> >
> > Now if I scan only this particular host:
> >
> > nmap -PN -sS -p443 -T4 --reason 10.10.10.1
> >
> > ..the TCP port 443 seems to be filtered:
> >
> > [root@ ~]# nmap -PN -sS -p443 -T4 --reason 10.10.10.1
> >
> > Starting Nmap 5.51 ( http://nmap.org ) at 2011-09-11 02:53 EEST
> > Nmap scan report for 10.10.10.1
> > Host is up, received user-set.
> > PORT    STATE    SERVICE REASON
> > 443/tcp filtered https   no-response
> >
> > Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
> > [root@ ~]#
> >
> > How to explain this?
> >
> >
> > regarding,
> > martin
> >
> > ------------------------------------------------------------------------
> > Securing Apache Web Server with thawte Digital Certificate
> > In this guide we examine the importance of Apache-SSL and who needs
an SSL certificate.  We look at how SSL works, how it benefits your
company and how your customers can tell if a site is secure. You will
find out how to test, purchase, install and use a thawte Digital
Certificate on your Apache web server. Throughout, best practices for
set-up are highlighted to help you ensure efficient ongoing management
of your encryption keys and digital certificates.
> >
http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> > ------------------------------------------------------------------------
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an
SSL certificate.  We look at how SSL works, how it benefits your company
and how your customers can tell if a site is secure. You will find out
how to test, purchase, install and use a thawte Digital Certificate on
your Apache web server. Throughout, best practices for set-up are
highlighted to help you ensure efficient ongoing management of your
encryption keys and digital certificates.
>
http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> ------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------