Skip to Content.
Sympa Menu

baslinux - Re: [BL] nmap and security 26

baslinux AT lists.ibiblio.org

Subject: Baslinux mailing list

List archive

Chronological Thread  
  • From: Lee Forrest <lforrestster AT gmail.com>
  • To: baslinux AT lists.ibiblio.org
  • Subject: Re: [BL] nmap and security 26
  • Date: Sun, 28 Jan 2007 12:14:34 +0000

On Sun, Jan 28, 2007 at 04:05:44PM +0200, Karolis Lyvens wrote:
[delete]
> If you want a better scanner that doesn't require javascript (maybe it
> will work even with lynx/links):
>
> http://www.hq42.net/net_tools/index.php

Interesting. Had no trouble with links-0.9.0:


Starting nmap V. 3.00 ( www.insecure.org/nmap/ )

Host Node181-42-42-66.1dial.com (66.42.42.181) appears to be up ... good.

Initiating Connect() Scan against Node181-42-42-66.1dial.com (66.42.42.181)

The Connect() Scan took 247 seconds to scan 1024 ports.

All 1024 scanned ports on Node181-42-42-66.1dial.com (66.42.42.181) are:
closed


Nmap run completed -- 1 IP address (1 host up) scanned in 250 seconds


/quote

Then I hit the link at the top of the page and ended up with this:

Starting nmap V. 3.00 ( www.insecure.org/nmap/ )

Host Node181-42-42-66.1dial.com (66.42.42.181) appears to be up ... good.

Initiating Connect() Scan against Node181-42-42-66.1dial.com
(66.42.42.181)
The Connect() Scan took 235 seconds to scan 1024 ports.

Interesting ports on Node181-42-42-66.1dial.com (66.42.42.181):

(The 972 ports scanned but not shown below are in state: closed)

Port State Service

1/tcp filtered tcpmux

21/tcp filtered ftp

28/tcp filtered unknown

31/tcp filtered msg-auth

44/tcp filtered mpm-flags

86/tcp filtered mfcobol

118/tcp filtered sqlserv

124/tcp filtered ansatrader

136/tcp filtered profile

175/tcp filtered vmnet

201/tcp filtered at-rtmp

204/tcp filtered at-echo

258/tcp filtered Fw1-mc-gui

278/tcp filtered unknown

282/tcp filtered cableport-ax

286/tcp filtered unknown

300/tcp filtered unknown

342/tcp filtered unknown

352/tcp filtered dtag-ste-sb

391/tcp filtered synotics-relay

417/tcp filtered onmux

440/tcp filtered sgcp

499/tcp filtered iso-ill

502/tcp filtered asa-appl-proto

536/tcp filtered opalis-rdv

545/tcp filtered ekshell

558/tcp filtered sdnskmp

567/tcp filtered banyan-rpc

569/tcp filtered ms-rome

577/tcp filtered vnas

635/tcp filtered unknown

654/tcp filtered unknown

659/tcp filtered unknown

684/tcp filtered unknown

691/tcp filtered resvc

713/tcp filtered unknown

729/tcp filtered netviewdm1

743/tcp filtered unknown

751/tcp filtered kerberos_master

761/tcp filtered kpasswd

764/tcp filtered omserv

796/tcp filtered unknown

820/tcp filtered unknown

873/tcp filtered rsync

876/tcp filtered unknown

888/tcp filtered accessbuilder

893/tcp filtered unknown

900/tcp filtered unknown

920/tcp filtered unknown

929/tcp filtered unknown

935/tcp filtered unknown

978/tcp filtered unknown


/quote

That's garbage. Makes it look like I'm running an incredibly busy
server with an excellent firewall. I don't have most of those
apps on this box. In fact, I've never even _heard_ of most of
them. And I'm not running any network daemons/(super)servers. I
have an FTP server, but it's not up.

Whatever they scanned, it wasn't (just) me. Must have been simple.net.

I wouldn't use this site. It could get you in trouble. They could
have nmap configured to give _your_ IP as the origin of the
probe. Such capabilities are strongly-implied in the man page.

Lee

--
BasicLinux: Small is Beautiful
http://www.basiclinux.com.ru





Archive powered by MHonArc 2.6.24.

Top of Page