full-disclosure - Re: Nmap Online

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 1 Dec 2006 06:56:43 -0600
From: "Jason Miller" <jammer128@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Nmap Online

I agree with Dave on this one. Dude Van, I thought it was illegal in the
states..? Or am I mistaken? Also, think of this from the ISP's view, do they
really want a service port scanning their users? And look at it this way,
said target has a proxy server on it, attacker proxies into the proxy and
scans the target server with that service, since he is now on the targets IP
address, I think you understand what I'm getting at by now. nmap is made to
find exploits, that is what this service is going to wind up being abused
for (in most cases that i know).

On 12/1/06, Dave Moore <dave.j.moore@...il.com> wrote:
>
> On 12/1/06, Mike Huber <michael.huber@...il.com> wrote:
> > first of all, IANAL, but the TOS seem to cover the basics...  However, I
> am
> > unsure whether they would hold up under strict legal scrutiny.  As far
> as I
> > can tell, they may hold up under US criminal law, but not under civil
> law,
> > as tort law has its own wonderful little eccentricities.  The best
> safeguard
> > they seem to have is that they must log the source IP of all scan
> > requests...  As far as I know, anyone who takes the time to read the
> nmap
> > man page should be able to craft a scan which won't be detected by the
> > scanned host (can someone be a definitive source on this point?), and
> anyone
> > taking malicious action ought to be taking sufficient precautions to
> avoid
> > detection anyway.  None-the-less, my 8-ball sees litigation in their
> future.
>
> All nmap scans are detectable. All port scans are detectable. Just
> depends on how hard you're looking.
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/