Sinisterly
Network Scanning - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Network Scanning (/Thread-Network-Scanning)

Pages: 1 2

Network Scanning - Ligeti - 03-01-2014

Hello

(Source Ligeti++)

Today I will be talking about network scanning, which considered to be a very important step (pre-attack stage), because in this step you will be examining the targeted network to find vulnerabilities and holes, in details:

Objectives of Network Scanning
  • Discover lives hosts: list all live hosts on the network with and IP addresses, MAC addresses, open ports...
  • Find out the services running on the hosts and if possible the version! (This is in fact is called Enumeration)
  • Find out the what OS is operating that host, this is important so that you can focus on attacks related to that OS.

PING

Ping is a tool (a program), that can be found in almost any operating system, and I think that you already heard of it, but let's talk about it a little as it is the most basic tool used to find a live host, for example: as soon I lose Internet connection, the first thing I usually do (if not always) is to ping Google! I believe that lots of people do the same, so what does it do?

Quote:Using Internet Control Message Protocol (ICMP), Internet Layer:
Ping scan sends ICMP EHCO request to a host, if the host is up (live), it will (usually) send back a ICMP ECHO replay.

I will not go into details about ICMP now, but if you want to read more about it (and you should) you can search or just go to Wikipedia, I think it does provide good information about ICMP.

OK, back to our ping, how to use ping:

Code:
ping <options> host

The host can be in domain name or just the IP

[table]
[row]
[cell]Windows [/cell]
[cell]Linux [/cell]
[cell]Description [/cell]
[/row]
[row]
[cell]n/a [/cell]
[cell]-a [/cell]
[cell]Audibile Ping [/cell]
[/row]
[row]
[cell]-n <count>[/cell]
[cell]-c <count>[/cell]
[cell]Number of echo requests to send (Default: Windows 4, Linux inf.) [/cell]
[/row]
[row]
[cell]n/a [/cell]
[cell]-f [/cell]
[cell]Flood ping, this will echo a '.' for each ping echo request and remove it on each replay.[/cell]
[/row]
[row]
[cell]-t [/cell]
[cell](default) [/cell]
[cell]Keep pinging the target (CTRL+C to stop)[/cell]
[/row]
[row]
[cell]-a [/cell]
[cell](default) [/cell]
[cell]Resolve the address [/cell]
[/row]
[row]
[cell]-i <ttl> [/cell]
[cell]-t <ttl> [/cell]
[cell]Time to live, the maximum allowed TTL values is 255 [/cell]
[/row]
[row]
[cell]-w <timeout>[/cell]
[cell]-W <timeout>[/cell]
[cell]Time to wait for a response, in seconds for Linux and milliseconds for Windows.[/cell]
[/row]
[row]
[cell]-l <size> [/cell]
[cell]-s <size> [/cell]
[cell]Size of data: I tested this in Linux and the maximum allowed size is 65507 ([/cell]
[/row]
[row]
[cell]n/a [/cell]
[cell]-i [/cell]
[cell]Interval to send the requests in seconds, only super user can use values less than 0.2[/cell]
[/row]
[row]
[cell]n/a [/cell]
[cell]-l <preload>[/cell]
[cell]Don't wait for replay, only the super-user may use a preload more than 3.[/cell]
[/row]
[row]
[cell](default) [/cell]
[cell]-n [/cell]
[cell]Don't resolve the address (host-name)[/cell]
[/row]
[row]
[cell]n/a [/cell]
[cell]p hex [/cell]
[cell]Pattern of data, example: -p ff will send a stream of 0xff [/cell]
[/row]
[row]
[cell]n/a [/cell]
[cell]-I [/cell]
[cell]The Interface to use for the ping.[/cell]
[/row]
[/table]

[note] I apologies for not sorting the table alphabetically.

OK, so basically you should know how to ping, I would highly recommend that you practice pinging (test all the options) on your local network and don't ping anything on the Internet... yet.

So... now what?
If you can ping one target then you should try to ping multiple targets, to do so we have many options, let's look at some of those options:

Windows
Code:
for /L %x in (1,1,10) do ping -n 1 192.168.1.%x

Linux
Code:
for myIP in {1..10}; do ping -c1 192.168.1.$myIP; done;

Both codes above will loop from 1 to 10, and issue a ping request for each IP address (192.168.1.1-10), it's OK if you don't fully understand the scripts above, they are there just for demonstration, and they are not impractical! Why? because... mainly they are very slow! To understand what I am talking about, replace the 10 with a 255 and run (use CTRL+C to stop)

What you saw above is called Ping Sweep, which is used to determine live hosts on a network using a range (or a list) of IPs, there are some tools used to automate the process, and they are much faster than my two script, like:
  • nmap
  • fping
  • Angry IP Scanner
  • Colasoft Ping Tool
  • SolarWinds Toolset
  • Ping Sweep

I won't go through each tool, but I will rapidly talk about how to do a ping sweep in nmap and fping

Using fping
Code:
fping -a -g 192.168.1.1/24

Or you can use the -f option and lost the targets from a file...

[note] I like nmap better as it won't screw up my ARP table with nonsense entries as fping would do.

Using namp
Code:
nmap -sP 192.168.1.1/24
or
Code:
nmap -sn 192.168.1.1/24

[note] In previous releases of Nmap, -sn was known as -sP.

[Important] Ping sweep for IPv6 is technically/theoretically and even practically is useless! Because:
  • It is 128 bit, means that the addressing system will support 2^128 = 340,282,366,920,938,463,463,374,607,431,768,211,456 hosts, while IPv4 IP addressing system can support 2^32 = 4,294,967,296 hosts!
  • Most good scanner don't support ping sweep on IPv6 network (including nmap).
  • It is just complicated.

There are other methods to obtain a list of hosts on IPv6 network. (like monitoring the traffic, router host table, logs... )

OK, so now we know about PING tool that uses ICMP echo requests to discover live hosts, and how to ping sweep, next?

Well... What if the router filters ICMP, how to deal with this situation?

ICMP (PING) is not the only solution to scan a network, there are many other ways to do this (as we will see later), but first ... I would like to talk a little about TCP.

The reason why it is VERY IMPORTANT to understand TCP header is that we will be using it to scan a host/network, let's take a look at TCP header.

[Image: jM0puug.png]

There are 9 flags but we are interested (for now) in these:
  • URG: Urgent, Data should be processed immediately.
  • ACK: Acknowledgment, used to acknowledge the receipt of the data/packet.
  • PSH: Push, used to send all buffer data at once.
  • RST: Reset, used to reset the connection.
  • SYN: Synchronize, request to initiate a connection.
  • FIN: Finale, no more data!

TCP uses a Three-way handshake to establish a connection (between any two machines), and it is easy to understand:
  1. The host sends TCP packet with the SYN set.
  2. On the other side (the server), the machine will send back a SYN + ACK if it accepts the connection.
  3. After that the host will send a simple ACK (TCP packet with ACK flag set) to acknowledge.

The following image illustrates what I was talking about.
[Image: 300px-Tcp-handshake.png]
source:http://commons.wikimedia.org/wiki/File:300px-Tcp-handshake.png

I won't go into much details, but if you are think about what could you do using this knowledge! (DoS and DDoS for example)

OK so now we "know" the header of TCP... what's next?

Let's build some packets (like a boss)

Crafting Packets

OK I will mention two important tools to build/craft our packets, Colasoft Packet Builder, and hping2/hping3, but I will talk only about hping3 (Colasoft has GUI and really easy to figure out)

HPing3 is a packet assembler and analyzer that is used to build packets that supports ICMP, TCP, UDP and RAW-IP, it is a very important tool used in security auditing and for testing networks and firewalls.

The manual page (help page) for this tool is huge, but I highly recommend that you study it in depth. but to let you start let' see some commands:

ICMP Ping
Code:
hping3 -1 192.168.1.3
Where: (-0: rawip, -1 ICMP, -2: UDP ... default is TCP)

So to scan a UDP port
Code:
hping3 -2 192.168.1.1 -p 100
(I have no idea what that is...)

ACK scan on a port 53 (DNS)
Code:
hping3 -A 192.168.1.1 -p 53
Where -p <port>

And, to send SYN:
Code:
hping3 -S 192.168.1.1 -p 80,8080,21,53,62,23

In short, -A is ACK, -S is SYN, -F is FIN, -P is PUSH, -R is Reset and -U is URG, easy, no?

OK, so we use hping3 to send packets (custom packets), this is kind of cool, as you can do many things with this very powerful tool, to understand it's power, let's talk about scanning techniques.

Scanning Techniques using TCP/UDP

These scans are used to discover a live host and/or a port status (open/close), and they are 8 major technique, I will go rapidly through them (I know this tutorial is long and somehow can be boring)... anyway.
  • Full Open Scan (TCP): TCP three-way handshake connection is used to determine if the port is opened or not! If the port is closed then the target will respond with RST flag.
  • Stealth Scan (Half-Open Scan):
    • SYN Scan: Similar to Full open scan.
    • Xmas Scan: (Will not work on Windows OS), you send a packet with URG, ACK, RST, SYN, PSH and FIN flags set (yes this is a total chaos), if you get NO RESPONSE then the port IS OPEN! other wise (RST) means that it is closed.
    • FIN Scan: you send a FIN flagged packet, if you receive RST/ACK the port is close, if you receive NO RESPONSE the port is OPEN!
    • NULL Scan: same with FIN scan, but you clear all flags!
  • IDLE Scan: this is a long process that I will be talking about later.
  • ICMP Echo Scan: typical PING and PING Sweep Scan.
  • SYN/FIN Scanning using IP Fragments!
  • UDP Scanning: generally, if a port is closed, an "ICMP Port Unreachable" message will be received.
  • Inverse TCP Flag Scanning, Similar to NULL and Xmas scanning.
  • ACK Flag Scanning: used mainly to detect firewalls, you send a ACK prob packet with a random seq number, if you receive no reponse then the port is filtered (because RST would mean that you reached the port)

I very highly recommend that you learn how to use nmap! Because it supports (as I remember) all these scans, to learn more about nmap please visit this tutorial by @Ex094, I don't recall seeing a better nmap tutorial for beginners!

Last but not the least,

Banner Grabbing

Banner Grabbing is OS fingerprinting (determine what OS is operating/running the target host), and it has two types:
  • Active: you send some packets and look into the results (see later)
  • Passive: page extension (aspx means IIS, php usually is on Linux...), Sniffing the network, and error messages...

Well... let's see how we can determine the OS by using basic tools:
Example (nc will get the same result):
Code:
telnet localhost 80 Trying ::1... Connected to localhost. Escape character is '^]'. GET / HTTP/1.0 HTTP/1.1 200 OK Date: Sat, 01 Mar 2014 20:57:54 GMT [size=medium][color=#FF0000]Server: Apache/2.2.22 (Debian)[/color][/size] Last-Modified: Wed, 05 Feb 2014 02:13:58 GMT ETag: "10087c-164-4f19f4f3f7a6a" Accept-Ranges: bytes Content-Length: 356 Vary: Accept-Encoding Connection: close Content-Type: text/html <html><body><h1>It works!</h1> <p>This is the default web page for this server.</p> <p>The web server software is running but no content has been added, yet.</p> <p>Jalal Sela (Ligeti/78)</p> </body></html> Connection closed by foreign host.

Of course, nmap "can" also detect the OS, and there are many other tools online, I just wanted you to see how it is done from the inside.

[edit] @Geoff mentioned another way to detect the OS, using PING (TTL value of ICMP):

Quote:Basically, each operating system/network stack had a defined TTL. On Windows 9x/ME it was different from Windows NT based kernels, which was again different from Linux, or BSD, or Mac if I recall. Not all Operating systems had different TTL's, it was more just an arbitrary number an engineer working on the stack came up with afaik. But any ways, different routers, operating systems, often had different TTL's. by merely recording the number of hops a packet took and adding it to the TTL value you got back from ICMP, you would get the hosts predefined TTL value. With this you could quickly,with just a command or two at the prompt, determine the operating system brand/kernel/whatever. While the big ones were easy to remember, like 32 being Windows 9x, 64 being linux, and 128 being NT, i believe there were also lists you could find to give you an idea of what brand router it might be, as different routers running different operating systems often had different TTL values.

but any ways, you can find lists like http://www.kellyodonnell.com/content/determining-os-type-ping that will show you known responses.

its not definitive, but its so benign that its almost passive and its so quick to perform to give you a solid starting point. Its an old trick though. This is something i have known/used at least a decade ago now. I do believe its still current although perhaps not quite as useful as it once was. for example im from a time where the 9x kernel was still fairly common, and so knowing your target was a 9x machine made things easier haha. however all the windows operating systems nowadays use the same kernel/values of 128 so you'll only be able to tell that it is, in fact, probably windows. still useful though imo


So, again thank you Geoff Smile

Conclusion

Today we learned:
  • The importance of network scanning.
  • How to use PING tools (Windows and Linux).
  • What is Ping Sweep, and some tools used to conduct such a scan.
  • The header of TCP and what (some) flags are available.
  • Hping3 tools and how to use it to craft packets.
  • What scanning techniques are out there and when to use each.
  • Banner Grabbing using Netcat and Telnet.

Thanks

RE: Network Scanning - chmod - 03-01-2014

This is very nice detailed and informative good work!

RE: Network Scanning - The Real Slim Shady - 03-02-2014

Good tutorial.

Are you familiar with manual host/os enumeration using the ttl value when using ping? lol

RE: Network Scanning - Ligeti - 03-02-2014

(03-02-2014, 01:10 AM)Geoff Wrote: Good tutorial.

Are you familiar with manual host/os enumeration using the ttl value when using ping? lol

No actually I don't, I found something about the subject here http://nostromo.joeh.org/osf.pdf but I don't have much time to look into it.

Thanks for bringing it up, if you could give me a few hints I would highly appreciate it.

Thanks again Geoff!

RE: Network Scanning - The Real Slim Shady - 03-02-2014

(03-02-2014, 01:38 AM)Ligeti Wrote: No actually I don't, I found something about the subject here http://nostromo.joeh.org/osf.pdf but I don't have much time to look into it.

Thanks for bringing it up, if you could give me a few hints I would highly appreciate it.

Basically, each operating system/network stack had a defined TTL. On Windows 9x/ME it was different from Windows NT based kernels, which was again different from Linux, or BSD, or Mac if I recall. Not all Operating systems had different TTL's, it was more just an arbitrary number an engineer working on the stack came up with afaik. But any ways, different routers, operating systems, often had different TTL's. by merely recording the number of hops a packet took and adding it to the TTL value you got back from ICMP, you would get the hosts predefined TTL value. With this you could quickly,with just a command or two at the prompt, determine the operating system brand/kernel/whatever. While the big ones were easy to remember, like 32 being Windows 9x, 64 being linux, and 128 being NT, i believe there were also lists you could find to give you an idea of what brand router it might be, as different routers running different operating systems often had different TTL values.

but any ways, you can find lists like http://www.kellyodonnell.com/content/determining-os-type-ping that will show you known responses.

its not definitive, but its so benign that its almost passive and its so quick to perform to give you a solid starting point. Its an old trick though. This is something i have known/used at least a decade ago now. I do believe its still current although perhaps not quite as useful as it once was. for example im from a time where the 9x kernel was still fairly common, and so knowing your target was a 9x machine made things easier haha. however all the windows operating systems nowadays use the same kernel/values of 128 so you'll only be able to tell that it is, in fact, probably windows. still useful though imo

RE: Network Scanning - Ligeti - 03-02-2014

@Geoff, can I quote what you've just told me in the tutorial, so everyone will see it?

I know how TTL works - or thought so just because I can simulate traceroute - but I never thought about it this way! Because... what I did was incremental process (I set TTL = 1,2,3,..etc!), anyway, seems that I need more reading about the subject!

I will do more testing on this tomorrow and report back if I'll find something interesting.

Thank you for your invaluable help.

RE: Network Scanning - The Real Slim Shady - 03-02-2014

(03-02-2014, 03:18 AM)Ligeti Wrote: @Geoff, can I quote what you've just told me in the tutorial, so everyone will see it?

I know how TTL works - or thought so just because I can simulate traceroute - but I never thought about it this way! Because... what I did was incremental process (I set TTL = 1,2,3,..etc!), anyway, seems that I need more reading about the subject!

I will do more testing on this tomorrow and report back if I'll find something interesting.

Thank you for your invaluable help.


Go ahead, quote all you want.

And ya, you should probably play around with it. The last time i myself used this technique was probably 2008 in a university course i took on network security. our final assessment was a 3 day wargame involving about 20 people lol I havent set up a lab myself since then and im an ethical hacker, so i havent been using it in the wild so to speak lol so i may have missed or forgotten to mention something. let me know if you have any issues though and ill attempt to address them haha

RE: Network Scanning - Ex094 - 03-02-2014

The hping part was really helpful, I haven't used Hping that much. Been relying on nmap from the beginning.. Good work Smile

RE: Network Scanning - XTRMS4NITY - 03-09-2014

Hi,

I use ping to test connectivity to the network, too. (testing if my internet is working fine).

However I have not used it for the purpose of network scanning, so far. Though I tried flooding a network with UDP, or should I say UDP flooding. I don't know if it's a DDoS or not. Biggrin

RE: Network Scanning - hunt3r972 - 03-09-2014

Very good tutorial !!!