Footprinting, Scanning, and Enumeration Philip Robbins September - PowerPoint PPT Presentation

Scanning • nmap –A –v 192.168.56.101 (against MS2) 71

Scanning • nmap 192.168.56.102 (against BT5R3) 72

Scanning • nmap –sS ‐v 192.168.56.101 (against MS2) 73

Scanning • nmap –sS ‐v 192.168.56.100‐200 (range) 74

Reconnaissance • Unicornscan Conduct tests on large networks and consolidate tools for large‐scale endeavors. ‐ Ideal for large networks. ‐ Scans 65,535 ports in 3‐7 seconds. ‐ Port scanning using TCP, ICMP, and IP. ‐ Optimizes UDP scanning. 75

Reconnaissance • fping A command‐line tool that allows you to ping multiple IP addresses simultaneously (determining which computers are “live”). 76

Reconnaissance • fping ‐h ping vs fping: specify a range 77

Reconnaissance • hping Allows you to ping sweep multiple IP addresses simultaneously while bypassing filtering devices (using modified IP packets). 78

Reconnaissance • hping3 –h | less 79

Reconnaissance • hping3 –h | less 80

Reconnaissance • hping3 –h | less set flags just like nmap… 81

Enumeration ‐ Next step after port scanning. ‐ Actually connecting to the system and obtaining information about users, passwords, and shared resources. ‐ Active / intrusive v.s. Passive 82

REVIEW: OS Vulnerabilities • Network Basic Input / Output System (NetBIOS) ‐ OSI Session Layer 5. ‐ Software that allows us to interact with a shared network resources or devices. ‐ NetBIOS frees an application from understanding the details of a network. ‐ Still used today for ensuring backward capability. ‐ Uses ports open to the internet: UDP/137 UDP/138 TCP/139 83

REVIEW: OS Vulnerabilities • Network Basic Input / Output System (NetBIOS) Why is NetBIOs over TCP/IP considered a security risk again? 84

REVIEW: OS Vulnerabilities • Network Basic Input / Output System (NetBIOS) Why is NetBIOs over TCP/IP considered a security risk again? 85

Enumeration • Network Basic Input / Output System (NetBIOS) ‐ Names have 16 char limit; 15 useable char limit. ‐ Last char reserved for service identification (00 to FF). ‐ Hackers attack Domain Controllers because of the type of info. ‐ Null Sessions (NS) is a serious vulnerability for NetBIOS systems. ‐ NS still present on Windows XP ‐ NS disabled by default in Windows Server 2003 ‐ NS not available in Windows Vista and Server 2008 ‐ NBTstat command used. 86

Enumeration 87

Enumeration 88

Enumeration • NBTscan NetBIOS over TCP/IP scan finds computers running NETBIOS. 89

Enumeration • NBTscan 90

Enumeration • nbtstat 91

Enumeration • nbtstat ‐a 92

Enumeration • net view Displays a list of domains, computers, or resources that are being shared by the specified computer. Used without parameters, net view displays a list of computers in your current domain. 93

Enumeration • net view 94

Enumeration • net view 95

Enumeration • net use Connects a computer to or disconnects a computer from a shared resource, or displays information about computer connections. Used without parameters, net use retrieves a list of network connections. 96

Enumeration • net use 97

Enumeration • DumpSec Enumeration tool for Windows systems allowing users to connect to a server and “dump” permissions for shares. It dumps the permissions (DACLs) and audit settings (SACLs) for the file system, registry, printers and shares. 98

Enumeration • DumpSec 99

Enumeration • smb4K Used to enumerate Windows computers on a network. 100