Re: http-open-proxy.nse question

[ToddAndMargo <ToddAndMargo () zoho com>]

On 10/01/2013 05:22 AM, Leon Jacobs wrote:
> On Mon, Sep 30, 2013 at 8:42 PM, ToddAndMargo <ToddAndMargo () zoho com
> <mailto:ToddAndMargo () zoho com>> wrote:
>
>     Hi All,
>
>     I just read an article over at SANS,
>
>     
> https://isc.sans.edu/forums/__diary/Do+you+have+your+__network+perimeter+secured+__against+downloading+malicious+__content+/16676
>     
> <https://isc.sans.edu/forums/diary/Do+you+have+your+network+perimeter+secured+against+downloading+malicious+content+/16676>
>
>     It uses the
>     nmap --script http-open-proxy.nse 192.168.0.0/24 <http://192.168.0.0/24>
>     script to check for free proxies.
>
>     Looking at the result of the scan, I am having a bit
>     of trouble figuring out how its shows free proxies.
>     I just see a bunch of open ports.  What am I missing?
>
>     Many thanks,
>     -T
>
>
> Hi T,
>
> The script checks potential proxy ports if a HEAD request to
> www.google.com <http://www.google.com> returns a valid status code of
> 200, 301 or 302. In this case, port 8080 allows such a request to
> complete. I'll suggest you read the sources of the .nse for complete
> specifics on what it does :)
>
> --
> Regards
> L.

On 10/01/2013 07:54 AM, Mikhail A. Utin wrote:> Hi,
> The idea of this Nmap scanning  is that a client computer is not likely having open ports like 80, 8080, or 443, which are server 
> ports associated with http and https respectfully. When DeleGte installs, it opens such ports to communicate with your internal 
> software, actually forwarding your originated internet requests to new ports (i.e. new internal proxy) instead of 
> "official" proxies, which then will communicate with free proxies on Internet.
>
>
> Mikhail Utin, CISSP
> Information Security Analyst

Hi Leon, Oleg, Nikhail,

Now I get it.  Thank you for the light bulb moment.  He should
only have the follow showing, "at the most":

PORT    STATE  SERVICE      REASON
137/tcp closed netbios-ns   reset
138/tcp closed netbios-dgm  reset
139/tcp open   netbios-ssn  syn-ack
445/tcp closed microsoft-ds reset

-T

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Computers are like air conditioners.
They malfunction when you open windows
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------