portscan

random port, you can use UDP on the 1433 port to query specifically which port is listening.Use auxiliary/scanner/mssql/mssql_ping Ssh_version identifying the SSH software versionAuxiliary/scanner/ssh/ssh_version Ftp_version looking for FTP server in Target network Brute Force hack Kali with a dictionary path/usr/share/metasploit-framework/data/wordlists Auxiliary/scanner/mysql/mysql_loginAuxiliary/scanner/http/tomcat_mgr_log

Metasploit can not only use the third-party scanner nmap, etc., in its auxiliary module also contains several built-in port scanners.View the port scanning tools provided by the Metasploit framework:msf > Search portscanmatching modules================ Name Disclosure Date Rank Description----------- -----------------------auxiliary/scanner/http/wordpress_pingback_access normal WordPress PINGB Ack Locator auxiliary/scanner/natpmp/natpmp_portscan normal NAT-PMP External Port scanner A Uxiliary/sc

*) p_ptr) = FIX (MAGIC ); If (sendto (sock, packet, IPH + MAGIC + 1, 0, (struct sockaddr *) sin,Sizeof (struct sockaddr) =-1){Perror ("\ nsendto ");Free (packet );Exit (1 );}Free (packet );} U_long name_resolve (u_char * host_name){Struct in_addr addr;Struct hostent * host_ent; If (addr. s_addr = inet_addr (host_name) =-1){If (! (Host_ent = gethostbyname (host_name) return (0 );Bcopy (host_ent-> h_addr, (char *) addr. s_addr, host_ent-> h_length );}Return (addr. s_addr );} Void usage (u_char

access to only certain network segments and 22/TCP ports of a Linux host. if the administrator's IP address changes frequently, in this case, iptables is difficult to apply to such an environment. You can use the following two rules to solve the problem by using the recent module:-A input-p tcp-m tcp -- dport 22-m state -- state NEW-m recent -- update -- seconds 60 -- hitcount 4 -- name SSH -- rsource-j DROP-A input-p tcp-m tcp -- dport 22-m state -- state NEW-m recent -- set -- name SSH -- rso

Port 2.1 scanner, Content: port scanner-script call parameters, multi-thread scanning, and Nmap port scanning codeEnvironment: python + kali, target: win2003Written in five steps############## 1. script call Parameters import optparseparser = optparse.OptionParser('usage %prog -H View Code ############### 2. Generate connScan and portScan Functions from socket import *def connScan(tgtHost, tgtPort): try: connSkt = socket(AF_INET, SOCK_STREAM

4 -- name SSH -- rsource-j DROP-A input-p tcp-m tcp -- dport 22-m state -- state NEW-m recent -- set -- name SSH -- rsource-j ACCEPTAfter this rule is applied, if an IP address initiates more than four new connections to the Linux host 22/TCP port within one minute, the newly initiated connections will be discarded. 2. The recent module prevents port scanning.-A input-m recent -- update -- seconds 60 -- hitcount 20 -- name PORTSCAN -- rsource-j DROP-

frequently, in this case, iptables is difficult to apply to such an environment. The following two rules can be used to solve the problem by using the recent module: -A input-p tcp-m tcp -- dport 22-m state -- state NEW-m recent -- update -- seconds 60 -- hitcount 4 -- name SSH -- rsource-j DROP -A input-p tcp-m tcp -- dport 22-m state -- state NEW-m recent -- set -- name SSH -- rsource-j ACCEPT After this rule is applied, if an IP address initiates more than four new connections to the Linux h

, in this case, iptables is difficult to apply to such an environment. The following two rules can be used to solve the problem by using the recent module: -A input-p tcp-m tcp -- dport 22-m state -- state NEW-m recent -- update -- seconds 60 -- hitcount 4 -- name SSH -- rsource-j DROP -A input-p tcp-m tcp -- dport 22-m state -- state NEW-m recent -- set -- name SSH -- rsource-j ACCEPT After this rule is applied, if an IP address initiates more than four new connections to the Linux host 22/TCP

ImportJava.net.Socket; Public classPortscanextendsThread {Private intMinport; Private intMaxport; PublicPortscan (intMinport,intMaxport) { This. Minport =Minport; This. Maxport =Maxport; } Public voidrun () { for(intI=minport; i) { Try{Socket Socket=NewSocket ("127.0.0.1", i); System.out.println (string.valueof (i)+ ": OK"); Socket.close (); } Catch(Exception e) {}}} Public Static voidMain (string[] args) {intMinport = Integer.parseint

frag2Preprocessor stream4: detect_scansPreprocessor stream4_re0000tPreprocessor portscan: $ HOME_NET 4 3 portscan. log# Set outputOutput database: log, mysql, user = rootDbname-snort host = localhost# RulesAlert tcp $ HOME_NET 7161-> $ EXTERNAL_NET any(Msg: "MISC Cisco Catalyst Remote Access ";Flags: SA; reference: arachnids, 129;Reference: cve, CVE-1999-0430;Classtype: bad-unknow; sid: 513; rev: 1 ;)# Set

packages: adodb452.tar.gz?phplot-5.0rc1.tar.gzand acid-0.9.6b23.tar.gz. The installation process is very simple. You only need to extract the three software packages and expand them under the Apache server's document root directory. As follows: (the document directory of this server is/www/ids) # Cd/www/ids/ # Gzip-d-c adodb452.tar.gz | tar xvf- # Gzip-d-c phplot-5.0rc1.tar.gz | tar xvf- # Gzip-d-c acid-0.9.6b23.tar.gz | tar xvf- 　　 Then, start the configuration and go to the acid directory to

Part of the code:#-*-Coding:utf-8-*-"""Module implementing Portscan."""From Pyqt4.qtcore import pyqtsignatureFrom Pyqt4.qtgui import QdialogFrom PYQT4 import Qtgui,qtcoreFrom Ui_portscan import Ui_portscanImport socketClass Portscan (Qdialog, Ui_portscan):"""Class documentation goes here."""def __init__ (self, Parent=none):"""Constructor @param parent reference to the parent widget (Qwidget)"""Qdialo

? $ HOME_NETVar DNS_SERVERS 192.168.1.250/32 var RULE_PATH ./ # Set preprocessors Preprocessor frag2Preprocessor stream4: detect_scansPreprocessor stream4_re0000tPreprocessor portscan :? $ HOME_NET 4 3 portscan. log # Set output Output database: log, mysql, user = rootDbname-snort host = localhost # Rules Alert tcp? $ HOME_NET 7161->? $ EXTERNAL_NET any (msg: "MISC Cisco Catalyst Remote Access"; flags: SA;

192.168.1.250/32 Var RULE_PATH ./ 　　 # Set preprocessors Preprocessor frag2 Preprocessor stream4: detect_scans Preprocessor stream4_re0000t Preprocessor portscan: $ HOME_NET 4 3 portscan. log 　　 # Set output Output database: log, mysql, user = root Dbname-snort host = localhost 　　 # Rules Alert tcp $ HOME_NET 7161-> $ EXTERNAL_NET any (Msg: "MISC Cisco Catalyst Remote Access "; Flags: SA; reference: arachn

complex task. snort also provides powerful intrusion detection functions. here I will only make a brief introduction so that you can have a concept. if the real object is used as an NIDS. more complex actions are required. for example, set a better rules and regularly update snort. rules defined in conf (when a new attack method appears, it should be updated in time)First, you need to change/etc/snort. conf to your own machine.# Set the location where logs are storedConfig logdir:/var/log/snort

being a warrior is not a simple thing, it is an endless struggle that lasts until the last moment of our lives. No life down is a warrior, like no life down is doomed mediocre, is we let ourselves become such or that!--Natsume StoneDesign ideas:Call Optparse. Optionparse () method, build option parser, accept host name (or IP address), scan port list two parameters. Build two functions Portscan and Connscan,portsc