July 6th, 2010, 05:35 PM
The Age Old Debate
okay, so, just wondering what you guys thought about the age old debate in port scans. Do you prefer stealthed or closed or shrouded ports and why? Strictly from an administrators pov.
July 6th, 2010, 07:21 PM
If you use NMAP
nmap -p 1-65535 -T4 -A -v -PE -PS22,25,80 -PA21,23,80,3389
Thats me all the time
Your question's answer depends on the situation to be frank. I've never done a port scan outside legal boundries.
CISSP, CISM, CISA, SSCP
*Thank you GOD*
Greater the Difficulty, SWEETER the Victory.
Believe in yourself.
July 7th, 2010, 05:47 PM
Oh I do love these threads...
A port is either opened or closed. You can nat 'em, pat 'em, knock 'em, sock 'em but no matter what you do to them, they are either opened or closed.
That being said, from a port scan point of view. As a SysAdmin - I prefer closed ports.
When I'm wearing other hats, I would prefer open ports.
I love ports 80, 110, 443-5, 3306, 3334-3337. And all things UDP!
July 7th, 2010, 06:32 PM
The only reason why I'd ever scan anything is because a single threaded syn scan will always go by faster than a multithreaded attempt at actually connecting.
July 7th, 2010, 08:41 PM
But what about ports 23 and 21 dinowuff!? Also, is there really any advantages to having closed ports? The biggest advantage I can think of when using stealthed and shrouded ports is the headache the attacker receives on your system =P Stealthing/Shrouding your ports also forces the attacker to be a little noisier wouldn't you say and thus easier to for IDS to detect. On my home system, I like to set up my ports to be shrouded, but have it respond on random ports for each scan. Mostly just to mess with peoples heads >.<
July 8th, 2010, 02:34 PM
The advantage of a closed port is nothing can connect to that port.
Telnet - no use for it
FTP - I haven't tried a bounce scan in years. I don't know if the vulnerability of the FTP protocol that allowed that still exists.
July 8th, 2010, 03:16 PM
If by messing with people's heads you mean common false positives or at best 0.00001st of a nanoseconds worth of processing then uh... no.
Mostly just to mess with peoples heads >.<
July 8th, 2010, 03:33 PM
not talking about the PORT command on FTP dino >.< That is largely blocked anyhow. I was more getting along the lines of liking that port to be open as well as port 23. I am more curious on why you prefer closed ports to stealthed ports though, not open ports >.<
T-Spec, judging by your response, I would say vehemently use closed ports =P
July 8th, 2010, 04:35 PM
A stealth port is an open port. The age old argument you refer to goes like this:
-I want x ports open in case I need to use them, but want to hide them from the Internet - Reason for stealth "if hackers can't see any ports they wont try to attack"
- Bullshit only open ports that you need open, when you need them. Reason for closing ports If a port is open you can connect to it.
I am on side 1
IMHO The Sales and Marketing departments of some "Firewall/AV/Security" Vendor came up with this stealth B.S. for no other reason than a marketing strategy. I mean, really, how hard is it to allow everything but ftp on a firewall?
access-list 102 deny tcp any any eq ftp
access-list 102 deny tcp any any eq ftp-data
access-list 102 permit ip any any
So if you are discussing ports, you understand firewalls and how to use them.
If you are discussing ports, because you just left grc... That's another discussion (but I wanted to see if I could get spec fired up)
Last edited by dinowuff; July 8th, 2010 at 04:37 PM.
July 9th, 2010, 05:43 AM
If you can read this...
If you are discussing ports, because you just left grc... That's another discussion
then your overqualified as a network and systems engineer.
By Egaladeist in forum Cosmos
Last Post: August 6th, 2005, 03:06 AM
By Negative in forum Cosmos
Last Post: October 14th, 2004, 09:04 PM
Last Post: October 13th, 2004, 03:58 PM
By High2Risk in forum Cosmos
Last Post: December 24th, 2003, 07:54 AM
By Ennis in forum AntiOnline's General Chit Chat
Last Post: September 2nd, 2002, 10:51 PM