1. Hands-On Ethical Hacking and Network Defense Second Edition Chapter 5 Port Scanning

2. Objectives After reading this chapter and completing the exercises, you will be able to: –Describe port scanning and types of port scans –Describe port-scanning tools –Explain what ping sweeps are used for –Explain how shell scripting is used to automate security tasks Hands-On Ethical Hacking and Network Defense, Second Edition2

3. Introduction to Port Scanning Port Scanning –Finds which services are offered by a host –Identifies vulnerabilities Open services can be used on attacks –Identify vulnerable port and launch exploit Scans all ports when testing –Not just well-known ports Hands-On Ethical Hacking and Network Defense, Second Edition3

4. 4 Figure 5-1 The AW Security Port Scanner interface

5. Introduction to Port Scanning (cont’d.) Port scanning programs report: –Open ports –Closed ports –Filtered ports –Best-guess running OS Hands-On Ethical Hacking and Network Defense, Second Edition5

6. Types of Port Scans SYN scan –Stealthy scan Connect scan –Completes three-way handshake NULL scan –Packet flags are turned off XMAS scan –FIN, PSH and URG flags are set Hands-On Ethical Hacking and Network Defense, Second Edition6

7. Types of Port Scans (cont’d.) ACK scan –Used to get past firewall FIN scan –Closed port responds with an RST packet UDP scan –Closed port responds with ICMP “Port Unreachable” message Hands-On Ethical Hacking and Network Defense, Second Edition7

8. Using Port-Scanning Tools Port-scanning tools –Hundreds available –Not all are accurate Be familiar with a variety Practice often Some tools include: –Nmap –Unicornscan –Nessus and OpenVAS Hands-On Ethical Hacking and Network Defense, Second Edition8

9. Nmap Originally written for Phrack magazine –One of the most popular tools –New features frequently added GUI front end –Zenmap Standard tool for security professionals –Command: nmap 193.145.85.201 Scans every port on computer with this IP address Hands-On Ethical Hacking and Network Defense, Second Edition9

10. 10 Figure 5-2 The Nmap help screen

11. Unicornscan Developed to assist with large network tests –Ideal for large-scale endeavors –Scans 65,535 ports in three to seven seconds Handles port scanning using: –TCP –ICMP –IP Optimizes UDP scanning Hands-On Ethical Hacking and Network Defense, Second Edition11

12. Nessus and OpenVAS Nessus –First released in 1998 –No longer under GPL license Still available for download OpenVAS –Open-source fork of Nessus –Performs complex queries while client interfaces with server –Capable of updating security check plug-ins Security test programs (scripts) Hands-On Ethical Hacking and Network Defense, Second Edition12

13. Hands-On Ethical Hacking and Network Defense, Second Edition13 Figure 5-3 OpenVAS with a safe checks warning

14. Hands-On Ethical Hacking and Network Defense, Second Edition14 Figure 5-4 OpenVAS discovers a vulnerability

15. Conducting Ping Sweeps Ping sweeps –Identify which IP addresses belong to active hosts Ping a range of IP addresses Problems –Shut down computers cannot respond –Networks may be configured to block ICMP Echo Requests –Firewalls may filter out ICMP traffic Hands-On Ethical Hacking and Network Defense, Second Edition15

16. FPing Ping multiple IP addresses simultaneously Accepts a range of IP addresses –Entered at a command prompt –File containing multiple IP addresses Input file –Usually created with shell-scripting language Hands-On Ethical Hacking and Network Defense, Second Edition16

17. Hands-On Ethical Hacking and Network Defense, Second Edition17 Figure 5-5 Fping parameters

18. Hands-On Ethical Hacking and Network Defense, Second Edition18 Figure 5-6 Results of an Fping command

19. Hping Used to: –Perform ping sweeps –Bypass filtering devices Allows users to inject modified IP packets Powerful tool –All security testers must be familiar with tool –Supports many parameters Hands-On Ethical Hacking and Network Defense, Second Edition19

20. Hands-On Ethical Hacking and Network Defense, Second Edition20 Figure 5-7 Hping help, page 1

21. Hands-On Ethical Hacking and Network Defense, Second Edition21 Figure 5-8 Hping help, page 2

22. Hands-On Ethical Hacking and Network Defense, Second Edition22 Figure 5-9 Hping help, page 3

23. Crafting IP Packets Packet components –Source IP address –Destination IP address –Flags Helps obtain information about a service Tools: –Hping –Fping Hands-On Ethical Hacking and Network Defense, Second Edition23

24. Understanding Scripting Modify tools to better suit your needs Customized scripts –Automates tasks –Time saving –Requires basic programming skills Hands-On Ethical Hacking and Network Defense, Second Edition24

25. Scripting Basics Similar to DOS batch programming Script or batch file –Text file –Contains multiple commands Repetitive commands –Good candidate for scripting Practice is the key Hands-On Ethical Hacking and Network Defense, Second Edition25

26. Hands-On Ethical Hacking and Network Defense, Second Edition26 Table 5-1 Summary of vi commands

27. Hands-On Ethical Hacking and Network Defense, Second Edition27 Figure 5-10 A shell script

28. Summary Port scanning (i.e., service scanning) –Scanning a range of IP address –Determines running services Port scan types –SYN –ACK –FIN Hands-On Ethical Hacking and Network Defense, Second Edition28

29. Summary (cont’d.) Port scanning tools –Nmap –Nessus –OpenVAS –Unicornscan Ping sweeps –Determine which computers are “live” Scripts –Automate time-consuming tasks Hands-On Ethical Hacking and Network Defense, Second Edition29