lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 1 Dec 2006 06:56:43 -0600
From: "Jason Miller" <jammer128@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Nmap Online

I agree with Dave on this one. Dude Van, I thought it was illegal in the
states..? Or am I mistaken? Also, think of this from the ISP's view, do they
really want a service port scanning their users? And look at it this way,
said target has a proxy server on it, attacker proxies into the proxy and
scans the target server with that service, since he is now on the targets IP
address, I think you understand what I'm getting at by now. nmap is made to
find exploits, that is what this service is going to wind up being abused
for (in most cases that i know).

On 12/1/06, Dave Moore <dave.j.moore@...il.com> wrote:
>
> On 12/1/06, Mike Huber <michael.huber@...il.com> wrote:
> > first of all, IANAL, but the TOS seem to cover the basics...  However, I
> am
> > unsure whether they would hold up under strict legal scrutiny.  As far
> as I
> > can tell, they may hold up under US criminal law, but not under civil
> law,
> > as tort law has its own wonderful little eccentricities.  The best
> safeguard
> > they seem to have is that they must log the source IP of all scan
> > requests...  As far as I know, anyone who takes the time to read the
> nmap
> > man page should be able to craft a scan which won't be detected by the
> > scanned host (can someone be a definitive source on this point?), and
> anyone
> > taking malicious action ought to be taking sufficient precautions to
> avoid
> > detection anyway.  None-the-less, my 8-ball sees litigation in their
> future.
>
> All nmap scans are detectable. All port scans are detectable. Just
> depends on how hard you're looking.
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists