Last updated at Wed, 30 Aug 2017 16:02:46 GMT
Yesterday I asked a question on Twitter and got a lot of responses from the security community.
I was finishing up a Metasploit module that I was coding last weekend. I posed the challenge to myself of scanning for egress port while not actually inside a network. I accomplished this task setting up multiple listeners, and embed HTTP tags in a webpage. This can easily be done with Metasploit Framework. I created a report page and a stealth page with no images. Metasploit keeps track of the connections on the attacker side as well. I also wanted to do this module without Javascript because browsers are getting smarter about Javascript doing weird things. Also I have some ports on here (23, 25, etc) that are blocked by some browsers, but you never know so I included them as well.
You can download the module at my Github https://github.com/threatagent/egress_scan/blob/master/egress_scan.rbor wait for it to appear in the Metasploit trunk. In the meantime if you have a question about it, please leave a comment below.
