Network Security: December 2007 Archives

This is an updated version of the StatfulTCPScanner.pl proof of concept in regards to intelligent port scanning.  It now supports command line arguments, ability to adjust the error threshold, and verbose mode.

IntelliScan0.02.pl

One concept I have been throwing around with the group is the idea of more intelligent port scanning.  I think it would be great to have a port scanner that could detect an IPS and adjust appropriately. By feeding the tool "previously known open ports", it could have sort of a heartbeat back to the target to detect if there has been a service crash or IPS interference.  Ideally, it could run the check from separate IP addresses to differentiate between the two.  The below file is a simple interactive perl script as a proof of concept to this theory.  As I get more development cycles I would like to expand on this idea.  As opposed to writing a whole new port scanner maybe just create a script to kick off and monitor the tried and true Nmap scanner.

StatefulTCPScanner.pl
Updated Version
IntelliScan0.02.pl