Member Avatar for ! !

Had to share this online tool - been using it a while now, has been helpful - if you know of any others, won't you please share them:idea:

https://www.grc.com/x/ne.dll?bh0bkyd2


Please take just a moment to read and consider these three points:[img]https://www.grc.com/transpixel.gif[/img]
Your use of the Internet security vulnerability profiling services on this site constitutes your FORMAL PERMISSION for us to conduct these tests and requests our transmission of Internet packets to your computer. ShieldsUP!! benignly probes the target computer at your location. Since these probings must travel from our server to your computer, you should be certain to have administrative right-of-way to conduct probative protocol tests through any and all equipment located between your computer and the Internet.

  • 3 Contributors
  • 4 Replies
  • 121 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by catch

Dani AI

Generated

's share is a useful example of an external "what does the internet see?" test. Those quick probes are good for a first look, but they only show one vantage point. For practical coverage, combine a few complementary online checks and some internal validation so results are meaningful and actionable.

Useful online services (each gives a different angle):

  • Qualys SSL Labs SSL Test — deep TLS/HTTPS configuration analysis.
  • SecurityHeaders.com — quick check for HTTP security headers (HSTS, CSP, etc.).
  • Shodan and Censys — internet-wide visibility: what devices and banners are visible for your IPs/domains.
  • — external port/service probing from a third-party vantage.
  • Sucuri SiteCheck and VirusTotal — web/malware/URL reputation and passive DNS/history checks.

Practical workflow to get reliable results: (1) run external scans from two independent services, (2) test TLS and headers, (3) search asset engines (Shodan/Censys) to catch historical exposure, (4) validate findings locally (banner checks, logs, or an authorized internal scan), and (5) document and retest after fixes. Always test from a different network (mobile tether or cloud VM) to avoid NAT/ISP artifacts.

This ties back to 's caution: one test can mislead, so corroborate results before acting. And echoing 's concern about firewall behavior: different responses and timing can reveal more than you expect, so the real goal is to reduce exposed services and fix root causes rather than rely on obscurity. For production-critical systems, follow up with scheduled scans and a formal penetration test.

Recommended Answers

All 4 Replies

Member Avatar for DMR

/dons Kevlar underware to deflect flame...:

Steve Gibson has been around for loooonnngg time, as has his site with the Shields Up! test. I'm not going to place any overall judgement on the guy, but let's just say that he has history of being very opinionated about things, sometimes to the point of being what you could call "adamantly wrong" .

I do have to say that this side of his personality definitely comes into play when he dives into the waters of security-related issues. I've seen him try to make monsters out of what are, in reality, relatively minor security problems/exploits, and I've also seen him defend his positions against overwhelming evidence to the contrary put forth by security experts more respected than he.

Don't get me wrong; his online tests do have more than some merit, but they also have their flaws in terms of their comprehensiveness and accuracy. In addition to that, the analysis you'll get from a Shields Up! scan can be a bit more on the "alarmist" side than is really necessary.

Given that, I'd suggest that you run some of your own Intrusion Detection tests against the computers on your network. Links in this Google search should yield some options in that regard:

http://www.google.com/search?hl=en&q=%22intrusion+detection%22+software&btnG=Google+Search

Member Avatar for ! !

Please - no personal attacks - it might dissuade others from contributing

of course, one could do a Google Search (these readers are savy) - but that defeats that purpose of getting Personal Opinions on Personally Tested online tools

Member Avatar for DMR

Not a personal attack at all.

I would give a very similar critique of, and similar advice regarding, any network security service or software which represented itself to be a more "be all and end all" tool than it really was.

Additionally, I do tend to be a bit more adamant about my assessment when the accompanying text that describes the tool and the dangers that one faces without it are written in such a way that they may (purpously?) instill in the average user a bit more fear of threats than is actually warranted.

That said, my assessment of the usefullness of GRC's offerings stands, as does my statement that doing your own Intrusion/penetration/etc. testing will give you a much better idea of how secure your particular network is a whole.

Member Avatar for catch

Are you going to take the word of a guy whos network was breached by a 13y/o? Seriously, "stealthing" under many situations can actually give back _more_ information than just having the port closed, especially on server system. This "stealthing' is just another farce from the Steve Gibson camp. If you have a system that is listening on port 80 and stealthing everything else, the attacker obviously knows that a system exists there, and using timing attacks a sophistocated attack can even determine the type of firewall you are running as stealthing adds more latency than having the port just not being open. This latency may be calculated be using a carefully constructed request to any open services. Once this is accomplished, the attacker can make a good guess about the firewall based on this data.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.