Nmap

Blackbox Asset Management: Discovering and Identifying IT Infrastructure Without Direct Access

Security Vision expert Fedor Bokov explains how organizations can manage IT assets in blackbox mode when customers refuse to provide credentials or internal documentation. The approach begins with network scanning using tools such as nmap and masscan to detect live hosts and open ports across external and internal perimeters. Identification relies on banner grabbing, HTTP header analysis, favicon inspection, HTML structure, and service fingerprinting to determine exact software versions and operating systems. Examples include extracting Ubuntu 22.04 LTS details from an OpenSSH banner and identifying Checkpoint Gaia from specific HTTP responses on port 443. Further analysis of ports like 1433 and 443 reveals Microsoft SQL Server 2017, nginx 1.28.0, PHP 8.2.29, and Bitrix-Site-Manager instances. The methodology concludes with continuous monitoring cycles that track version changes, new services, and configuration deviations to prioritize vulnerability remediation without traditional inventory access.

Developer Releases PhishIntel Open-Source Tool for Phishing Site Analysis and Risk Scoring

A developer has published PhishIntel, a lightweight Python-based OSINT application designed to analyze domains and evaluate phishing risk. The tool performs extensive checks including domain structure analysis, DNS records, RDAP and WHOIS data, TLS certificates, HTTP redirects, page content, security headers, and JavaScript static analysis. It generates structured JSON reports containing risk scores with explanatory indicators. Optional integrations with VirusTotal, Google Safe Browsing, URLhaus, Nmap, Nuclei, ZAP, and Playwright enable reputation checks, dynamic browser analysis, and active scanning. The project aims to help identify suspicious sites used in schemes such as the recent fake fuel sales campaign that defrauded victims of at least 3.7 million rubles. The author invites feedback from security professionals to improve the codebase.

Third Edition of The Ultimate Kali Linux Book Released with Expanded OSINT and Pentesting Coverage

The publishing house Piter has released the third international edition of The Ultimate Kali Linux Book by Glen Singh. The updated volume provides comprehensive guidance on using Nmap, Metasploit, Aircrack-ng and Empire for ethical hacking and penetration testing. Significant revisions include a new chapter on OSINT, refreshed practical exercises and clearer descriptions of virtual lab environments. The book targets both beginners and experienced IT professionals seeking to master vulnerability assessment, wireless network testing and web application exploitation. Readers learn to build testing labs, perform reconnaissance, exploit network weaknesses and evaluate corporate infrastructure security. Author Glen Singh holds an MSc and multiple certifications from EC-Council, Cisco and Check Point, bringing real-world Red Team and Blue Team experience to the material.

New Russian Translations of Leading Cybersecurity Books on Ethical Hacking, Reverse Engineering, Malware Analysis, and Privacy Released

A popular Russian library project has published fresh translations of more than a dozen top-tier English-language books covering ethical web hacking, bug bounty hunting, network protocol attacks, binary reverse engineering, malware analysis, fuzzing, and privacy protection. The updates continue the long-running “Materials on Hacking in Russian” series, with all books made freely available through the Hackbooks platform. Titles include Web Hacking 101, Real-World Bug Hunting, the official Nmap guide, Attacking Network Protocols, a comprehensive beginner’s reverse engineering textbook, and specialized works on binary format analysis, obfuscation techniques, Windows security internals, Practical Malware Analysis, Evasive Malware, and The Fuzzing Book. Additional volumes address the history of state surveillance, Crypto Wars, and the societal implications of mass data collection. Each book entry features detailed descriptions, practical examples, and direct links to the corresponding Hackbooks cards, enabling Russian-speaking researchers and students to study advanced information security topics without language barriers.