1 Anti-Hacker Tool Kit Port Scanners Chapter 6

2 Introduction The first step in the process of hacking –Discover the services –Version label –Operation System Send few packets to the host

3 Pre Study TCP Packet Header

4 TCP conversation ClientServer SYN SYN/ACK ACK Connection Established ClientServer FIN ACK/FIN ACK ConnectionClosed Connect Disconnect Three-way handshake

5 TCP Flag Definitions Flag SYNThe beginning of a connection ACKAcknowledge receipt of a previous packet or transmission FINClose a TCP connection RSTAbort a TCP connection

6 Scanning for Hosts Is the host alive ? Method –Ping nmap –sP –TCP Ping nmap –sT

7 Scanning for TCP Ports TCP connect –nmap –sT RCP service –nmap –sR

8 SYN Scan Nmap Host SYN SYN/ACK Connect RST Nmap sends to Host Port Nmap receives from Host Port Nmap Assumes SYNSYN/ACKPort is open Host is up SYNRSTPort is closed Host is up SYNNothingPort is blocked by firewall Or Host is down Nmap –sS

9 ACK Scan NmapHost Connect ACK RST ICMP unreachable Nmap sends to Host Port Nmap receives from Host Port Nmap Assumes ACKRSTPort is not firewall-protect Port may be open or closed Host is up ACKNothing or ICMP unreachable Port is blocked by firewall if host is up No firewall~ Protected by firewall~ Nmap –sA

10 FIN Scan Nmap Host Connect FIN RST Nmap sends to Host Port Nmap receives from Host Port Nmap Assumes FINRSTPort is closed Host is up FINNothingPort is open if host is up and not firewall-protected Nmap –sF

11 Xmas Scan Non-normal TCP operation Set the flags FIN,URG,PUSH With –sX Nmap –sX

12 Null scan Turn off all flags With -sN Nmap –sN

13 Scanning for UDP Ports Nmap Host Connect Empty UDP Packet ICMP unreachable Nmap sends to Host Port Nmap receives from Host Port Nmap Assumes Empty UDP packet NothingPort assumed open if host responds to Ping. Port may be closed if firewall blocking ICMP Empty UDP packet ICMP unreachable Port is closed Nmap –sU

14 Scanning for Protocol IP Header Nmap –sO

15 Decoys Fragmentation Hiding Your Scan (-D) (-r)(-f) Nmap –sS –f With –sS –sF –sN -sX FTP Bounce Nmap –b –p Nmap –D Disable Randomizing Ports Nmap –r

16 Timing Your Scan Time-based algorithm Using -T option Nmap –T nameProbe Response Timeout Time Spent on One Host Time between Probes Use Parallelize d Probes Paranoid5 minUnlimited5 minNo Sneaky15 secUnlimited12 secNo Polite6 secUnlimited0.4 secNo Normal6 secUnlimitedNoneNo Aggressive1 sec5 minNoneYes Insane0.3 sec75 secNoneYes

17 TCP Reverse Ident Scanning Who runs the process (-I) Nmap –I

18 OS Fingerprinting With –O flag Sending specially TCP and UDP headers Analyze the result and compare information OS information

19 OS Detection on Linux Nmap –O

20 Mapping Networks Scanning a Class C subnet

21 Mapping Networks Port scans in IP section

22 Scanning Tools on windows Netscantools Superscan IPEYE WUPS

23 Netscantools Powerful tools Port scanner+finger+whois+traceRoute...etc

24 Super Scan

25 IPEYE TCP stealth scan SYN, FIN, Xmas tree, and null scan

26 WUPS Scanning UPD ports for Windows

27 Banner Identification Get the information normally –Hostname –Program –Version

28 Using your “Telnet” Try this FTP ServiceTelnet Service World Wide Web Service

29 Message log Generate TCP connect() method Normal timing option System Log

30 Summary Protect your host Dishonesty Footprints in the sand show where one has been.

31 Reference Nmap Tcmpdump Superscan scan.htm scan.htm Netscanools RFC 1700 RFC 793

32 What is RPC Service ? Remote Procedure Call 程序呼叫 – 一個程式裡一部份呼叫另一部份去做某項工作

33 UDP_SCAN

34 UDP_SCAN