Collaborate Disseminate
I checked established connections with "netstat" command in command prompt, and I found that there are some connections with ip’s of microsoft (I checked ip online) that have http (and not https) connection established, they brin… Continue reading Why http microsoft connection in netstat check?
enter image description here
These are the output images of the netstat command I ran it shows that they’re are too many outbound connection and many dgrams and stream . I also tried to capture the output using Wireshark and then reverse… Continue reading Have I been hacked ( netstat output too many dgrams and stream connections) [closed]
I was monitoring network connections using Netstat and came across netstat -tlnp. I was wondering what this is, what it does, and how the command works. I have checked the netstat man pages for my distro however, I cannot se… Continue reading Netstat switches [on hold]
I executed netstat -t on my linux terminal and noticied a tor relay running on port 9001. I’ve search about the IP address of relay on shodan and got a result that address is from Russia, after that i have “googled” it and found some websi… Continue reading Tor relay on port 9001 TCP
On Debian, Linux, I am using netstat to monitor connections. After waking my system from sleep, I noticed a change in one of the connections, using port 6667 for irssi (identified by PID).
I like to suspend my computer and w… Continue reading Connection changes after waking from sleep
I am working on a PoC and I am currently adding APT (Advanced Persistent Threat). I would like to know if anyone knows how to edit Linux source code so that netstat and/or ss tools are modified to not show connections on cert… Continue reading Edit netstat and ss to prevent show connections on certain ports [on hold]
Background:
I have what I believe is a serious malware problem but virtually all scanning tools won’t detect anything or if they do rarely do so consistently. I believe the malware (in some way/shape/form) sets up a VM on m… Continue reading Understanding, Interpreting and Taking Action on Established Connections [on hold]
I’ve seen that checking the netstat output is a recurrent practice in the post-exploitation phase to privilege escalate. But I don’t understand how I can use the output. Could you help me?
Continue reading Use netstat output in post-exploitation phase to privilege escalate [on hold]
I’m trying to build a port scanner for windows. I initially used netstat command to the see the ports that were open (LISTENING). Now I download a sample port scanner and scan.
Now I see ports that didn’t show up on netstat…. Continue reading What exactly does a port scanner do? [on hold]
I have executed the command netstat and does somebody sees something that is suspicious about this output that I have been hacked?
I googled the IP addresses with port 9001 and I found that these IP addresses are coming from … Continue reading Have I been DNS tunneled? [on hold]