Intelligent Port Scanning
One concept I have been throwing around with the group is the idea of more intelligent port scanning. I think it would be great to have a port scanner that could detect an IPS and adjust appropriately. By feeding the tool "previously known open ports", it could have sort of a heartbeat back to the target to detect if there has been a service crash or IPS interference. Ideally, it could run the check from separate IP addresses to differentiate between the two. The below file is a simple interactive perl script as a proof of concept to this theory. As I get more development cycles I would like to expand on this idea. As opposed to writing a whole new port scanner maybe just create a script to kick off and monitor the tried and true Nmap scanner.
StatefulTCPScanner.pl
Updated Version
IntelliScan0.02.pl
StatefulTCPScanner.pl
Updated Version
IntelliScan0.02.pl
0 TrackBacks
Listed below are links to blogs that reference this entry: Intelligent Port Scanning.
TrackBack URL for this entry: http://www.securityexperiment.com/cgi-bin//mt/mt-tb.cgi/8
Leave a comment