Penetration Testing
run nmap automatically from index.html (??) Nov 16 2011 02:09PM
Kathy Simm (kathys39 hotmail com) (7 replies)
RE: run nmap automatically from index.html (??) Nov 16 2011 08:50PM
Ward, Jon (Jon_Ward SYNTELINC COM) (2 replies)
Re: run nmap automatically from index.html (??) Nov 17 2011 08:41AM
arvind doraiswamy (arvind doraiswamy gmail com)
I second this. In addition to it, its going to flood your network as
well and trigger off plenty of filtering devices as well if they
aren't tuned correctly.

Wouldn't an easier way be:
--- Have a simple policy that covers users connecting external devices
to the network
--- Have a good access control policy in place [operational and
technical(firewalls etc)] that limits access to anything new

If this is done, you've already isolated things to an extent and
prevented compromised machines from "connecting" to the rest of the
network.

--- Now if you're serious, create a policy/document/whatever which
maps applications in your environment to "what ports it opens". This
becomes your baseline which is continuously edited as and when you're
network changes.

--- After that's in place and ONLY after that's in place, an
Nmap/whatever tool scan once a week,month etc etc [You decide the
period] will give you what is open and non conformant against your
baseline.

That I think should be enough :)

I understand this is a slightly lengthy way to do it; but IMHO the
only good way. Please correct me if I am wrong.

Thanks
Arvind

> 3.) Figure out how you're going to keep from filling up the web server's
> DASD with loads of nmap output.  Think also about the processing power
> of the server.  If 50 clients all connect and run nmap at the same time,
> how's that going to affect things?  This could quickly turn into an easy
> to DoS your own web server.

------------------------------------------------------------------------

This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[ reply ]
RE: run nmap automatically from index.html (??) Nov 16 2011 11:10PM
Ward, Jon (Jon_Ward SYNTELINC COM)
Re: run nmap automatically from index.html (??) Nov 16 2011 05:48PM
Mihai Nitulescu (mihai nitulescu gmail com)
RE: run nmap automatically from index.html (??) Nov 16 2011 04:23PM
Kettlewell, Nate \(Kansas City\) (Nate Kettlewell fishnetsecurity com)
Re: run nmap automatically from index.html (??) Nov 16 2011 04:16PM
securityfocus rawchaos com (1 replies)
Re: run nmap automatically from index.html (??) Nov 16 2011 05:26PM
Daniel Miller (bonsaiviking gmail com)
Re: run nmap automatically from index.html (??) Nov 16 2011 03:26PM
Justin Rogosky (jrogosky gmail com) (1 replies)
Re: run nmap automatically from index.html (??) Nov 16 2011 04:47PM
Sarah Loyd (sarahloyd mac com)
Re: run nmap automatically from index.html (??) Nov 16 2011 02:57PM
John Mason Jr (john mason jr cox net)
Re: run nmap automatically from index.html (??) Nov 16 2011 02:56PM
Guillaume Friloux (guillaume friloux asp64 com)


 

Privacy Statement
Copyright 2010, SecurityFocus