230 likes | 369 Views
Port Scanners. Introduction. The first step in the process of hacking Discover the services Version label Operation System Send few packets to the host. Pre Study. TCP Packet Header. TCP conversation. Connect. Disconnect. Client. Server. Client. Server. SYN. FIN. SYN/ACK.
E N D
Introduction • The first step in the process of hacking • Discover the services • Version label • Operation System • Send few packets to the host
Pre Study • TCP Packet Header
TCP conversation Connect Disconnect Client Server Client Server SYN FIN SYN/ACK ACK/FIN ACK ACK Connection Established Connection Closed Three-way handshake
Scanning for Hosts • Is the host alive ? • Method • Ping • nmap –sP 192.168.0.1 • TCP Ping • nmap –sT 192.168.0.1
Scanning for TCP Ports • RPC service • nmap –sR 192.168.0.1 • TCP connect • nmap –sT 192.168.0.1
SYN Scan Nmap –sS <target host>
ACK Scan No firewall~ Protected by firewall~ Nmap –sA <target host>
Connect Nmap Host FIN RST FIN Scan Nmap –sF <target host>
Xmas Scan • Non-normal TCP operation • Set the flags FIN,URG,PUSH • With –sX Nmap –sX <target host>
Null scan • Turn off all flags • With -sN Nmap –sN <target host>
Connect Nmap Host Empty UDP Packet ICMP unreachable Scanning for UDP Ports Nmap –sU <target host>
Scanning for Protocol IP Header Nmap –sO <target host>
Hiding Your Scan • FTP Bounce • Decoys • Disable Randomizing Ports • Fragmentation (-D) (-f) (-r) • With –sS –sF –sN -sX Nmap –r <target host> Nmap –b anonymous@<ftp server> –p <targer port> <target host> Nmap –sS –f <target host> Nmap –D <spoof host> <target host>
Timing Your Scan • Time-based algorithm • Using -T option Nmap –T <name> <target host>
TCP Reverse Ident Scanning • Who runs the process (-I) Nmap –I <target host>
OS Fingerprinting • With –O flag Sending specially TCP and UDP headers Analyze the result and compare information OS information
OS Detection on Linux • Nmap –O 192.168.0.1
Mapping Networks • Scanning a Class C subnet
Mapping Networks • Port scans in IP section
Scanning Tools on windows • Netscantools • Superscan • IPEYE • WUPS