4 ms·
Its not even obscurity: nmap --script ssh2-enum-algos target.ip -p 22-65535 -v Sure it takes a while longer, but the interesting attackers -- the ones that tar
by maze-le 6y ago
Its not even obscurity: nmap --script ssh2-enum-algos target.ip -p 22-65535 -v
Sure it takes a while longer, but the interesting attackers -- the ones that target a specific organization, not the ones enumerating whole ip ranges over and over again -- do have this time.
- elmo2you 6y agoObscurity doesn't mean undetectable. Also: you would still need to do a more elaborate (and therefore more "expensive") full range port scan, compared to scanning just the standard ports. That doesn't scale so well for scanning many IP address (e.g. criminals scanning the internet for potential targets).
- rocqua 6y agoGetting a hit on port 22 doesn't mean much. Getting hit by a full port-scan is more of a signal of being specifically targeted though.
- jopsen 6y agoI suppose your network provider (cloud provider) might have counter measures for port-scanning. (Personally, I'd prefer use port 22, just because it's less configuration)