Tool Tuesday – nmap
One tool which should be installed on every pentester PC is nmap. This command line tool is the Swiss army knive for penetration tests on network level, but also used regularly by system administrators.
nmap scans one or more target systems for open ports. Such ports are used to offer services running on the computer to users on the network.
In a network or system level pentest, nmap often finds ports which are not necessary for a productive environment with end users. If the software running behind such ports is poorly configured or outdated, vulnerabilities potentially can be exploited.
Generally, the attack surface of every server should be kept as small as possible. Only services which are actually required to be reachable from the outside should be exposed – for a web application this means only ports for HTTP: 80 and 443.
Do you want us to check the attack surface of your servers? Please feel free to contact us!
Recent posts
NinjaDVA – Our Training Environment
The NinjaDVA is our comfortable and flexible training environment.
Tool Tuesday – sqlmap
Is your web application vulnerable to SQL Injection? With sqlmap you can test it.
Attack Afternoon – CSRF Countermeasures #1
CSRF Countermeasures #1: One possibility to prevent CSRF is the usage of an anti-CSRF token.
Attack Afternoon – CSRF
CSRF stands for “Cross-Site Request Forgery” and is a classic among web application attacks. With this attack, it is possible to perform certain user actions without them noticing it. But how exactly does this attack work?
it-sa 2019 – Lean Application Security
At the it-sa 2019 we will present our innovative consulting concept Lean Application Security.
