AntiHacker Tool Kit

1
Anti-Hacker Tool Kit
Chapter 6

• Port Scanners

2
Introduction

• The first step in the process of hacking
• Discover the services
• Version label
• Operation System
• Send few packets to the host

3
Pre Study

• TCP Packet Header

4
TCP conversation
Connect
Disconnect
Client
Server
Client
Server
SYN
FIN
SYN/ACK
ACK/FIN
ACK
ACK
Connection Established
Connection
Closed
Three-way handshake
5
TCP Flag Definitions
6
Scanning for Hosts

• Is the host alive ?
• Method
• Ping
• nmap sP 192.168.0.1

• TCP Ping
• nmap sT 192.168.0.1

7
Scanning for TCP Ports

• RCP service
• nmap sR 192.168.0.1

• TCP connect
• nmap sT 192.168.0.1

8
SYN Scan
Nmap sS lttarget hostgt
9
ACK Scan
No firewall
Protected by firewall
Nmap sA lttarget hostgt
10
FIN Scan
Nmap sF lttarget hostgt
11
Xmas Scan

• Non-normal TCP operation
• Set the flags FIN,URG,PUSH
• With sX

Nmap sX lttarget hostgt
12
Null scan

• Turn off all flags
• With -sN

Nmap sN lttarget hostgt
13
Scanning for UDP Ports
Nmap sU lttarget hostgt
14
Scanning for Protocol
IP Header
Nmap sO lttarget hostgt
15
Hiding Your Scan

• Decoys

• FTP Bounce

• Disable Randomizing Ports

• Fragmentation

(-D)
(-r)
(-f)

• With sS sF sN -sX

Nmap r lttarget hostgt
Nmap b anonymous_at_ltftp servergt p lttarger portgt
lttarget hostgt
Nmap sS f lttarget hostgt
Nmap D ltspoof hostgt lttarget hostgt
16
Timing Your Scan

• Time-based algorithm
• Using -T option

Nmap T ltnamegt lttarget hostgt
17
TCP Reverse Ident Scanning

• Who runs the process (-I)

Nmap I lttarget hostgt
18
OS Fingerprinting

• With O flag

• Sending specially TCP and UDP headers

• Analyze the result and compare information

OS information
19
OS Detection on Linux

• Nmap O 192.168.0.1

20
Mapping Networks

• Scanning a Class C subnet

21
Mapping Networks

• Port scans in IP section

22
Scanning Tools on windows

• Netscantools
• Superscan
• IPEYE
• WUPS

23
Netscantools

• Powerful tools
• Port scannerfingerwhoistraceRoute...etc

24
Super Scan
25
IPEYE

• TCP stealth scan
• SYN, FIN, Xmas tree, and null scan

26
WUPS
Scanning UPD ports for Windows
27
Banner Identification

• Get the information normally
• Hostname
• Program
• Version

28
Using your Telnet
FTP Service
Telnet Service
World Wide Web Service
Try this
29
System Log
Generate
TCP connect() method Normal timing option
Message log
30
Summary

• Protect your host
• Dishonesty
• Footprints in the sand show where one has been.

31
Reference

• Nmap www.insecure.org/nmap/
• Tcmpdump www.tcpdump.org/
• Superscan www.foundstone.com/resources/proddesc/su
  perscan.htm
• Netscanools www.netscantools.com
• RFC 1700
• RFC 793

32
What is RPC Service ?

• Remote Procedure Call
• ????
• ????????????????????

33
UDP_SCAN
34
UDP_SCAN