1. Information Networking Security and Assurance Lab National Chung Cheng University 1 Port Scanners

2. Information Networking Security and Assurance Lab National Chung Cheng University 2 Introduction The first step in the process of hacking  Discover the services  Version label  Operation System Send few packets to the host

3. Information Networking Security and Assurance Lab National Chung Cheng University 3 Pre Study TCP Packet Header

4. Information Networking Security and Assurance Lab National Chung Cheng University 4 TCP conversation ClientServer SYN SYN/ACK ACK Connection Established ClientServer FIN ACK/FIN ACK ConnectionClosed Connect Disconnect Three-way handshake

5. Information Networking Security and Assurance Lab National Chung Cheng University 5 TCP Flag Definitions Flag SYNThe beginning of a connection ACKAcknowledge receipt of a previous packet or transmission FINClose a TCP connection RSTAbort a TCP connection

6. Information Networking Security and Assurance Lab National Chung Cheng University 6 Scanning for Hosts Is the host alive ? Method  Ping nmap –sP 192.168.0.1  TCP Ping nmap –sT 192.168.0.1

7. Information Networking Security and Assurance Lab National Chung Cheng University 7 Scanning for TCP Ports TCP connect  nmap –sT 192.168.0.1 RCP service  nmap –sR 192.168.0.1

8. Information Networking Security and Assurance Lab National Chung Cheng University 8 SYN Scan Nmap sends to Host Port Nmap receives from Host Port Nmap Assumes SYNSYN/ACKPort is open Host is up SYNRSTPort is closed Host is up SYNNothingPort is blocked by firewall Or Host is down Nmap –sS

9. Information Networking Security and Assurance Lab National Chung Cheng University 9 ACK Scan Nmap sends to Host Port Nmap receives from Host Port Nmap Assumes ACKRSTPort is not firewall-protect Port may be open or closed Host is up ACKNothing or ICMP unreachable Port is blocked by firewall if host is up No firewall~ Protected by firewall~ Nmap –sA

10. Information Networking Security and Assurance Lab National Chung Cheng University 10 FIN Scan Nmap Host Connect FIN RST Nmap sends to Host Port Nmap receives from Host Port Nmap Assumes FINRSTPort is closed Host is up FINNothingPort is open if host is up and not firewall-protected Nmap –sF

11. Information Networking Security and Assurance Lab National Chung Cheng University 11 Xmas Scan Non-normal TCP operation Set the flags FIN,URG,PUSH With –sX Nmap –sX

12. Information Networking Security and Assurance Lab National Chung Cheng University 12 Null scan Turn off all flags With -sN Nmap –sN

13. Information Networking Security and Assurance Lab National Chung Cheng University 13 Scanning for UDP Ports Nmap Host Connect Empty UDP Packet ICMP unreachable Nmap sends to Host Port Nmap receives from Host Port Nmap Assumes Empty UDP packet NothingPort assumed open if host responds to Ping. Port may be closed if firewall blocking ICMP Empty UDP packet ICMP unreachablePort is closed Nmap –sU

14. Information Networking Security and Assurance Lab National Chung Cheng University 14 Scanning for Protocol IP Header Nmap –sO

15. Information Networking Security and Assurance Lab National Chung Cheng University 15 Decoys Fragmentation Hiding Your Scan (-D) (-r)(-f) Nmap –sS –f With –sS –sF –sN -sX FTP Bounce Nmap –b anonymous@ –p Nmap –D Disable Randomizing Ports Nmap –r

16. Information Networking Security and Assurance Lab National Chung Cheng University 16 Timing Your Scan Time-based algorithm Using -T option Nmap –T nameProbe Response Timeout Time Spent on One Host Time between Probes Use Parallelized Probes Paranoid5 minUnlimited5 minNo Sneaky15 secUnlimited12 secNo Polite6 secUnlimited0.4 secNo Normal6 secUnlimitedNoneNo Aggressive1 sec5 minNoneYes Insane0.3 sec75 secNoneYes

17. Information Networking Security and Assurance Lab National Chung Cheng University 17 TCP Reverse Ident Scanning Who runs the process (-I) Nmap –I

18. Information Networking Security and Assurance Lab National Chung Cheng University 18 OS Fingerprinting With –O flag Sending specially TCP and UDP headers Analyze the result and compare information OS information

19. Information Networking Security and Assurance Lab National Chung Cheng University 19 OS Detection on Linux Nmap –O 192.168.0.1

20. Information Networking Security and Assurance Lab National Chung Cheng University 20 Mapping Networks Scanning a Class C subnet

21. Information Networking Security and Assurance Lab National Chung Cheng University 21 Mapping Networks Port scans in IP section

22. Information Networking Security and Assurance Lab National Chung Cheng University 22 Scanning Tools on windows Netscantools Superscan IPEYE WUPS

23. Information Networking Security and Assurance Lab National Chung Cheng University 23 Netscantools Powerful tools Port scanner+finger+whois+traceRoute...etc

24. Information Networking Security and Assurance Lab National Chung Cheng University 24 Super Scan

25. Information Networking Security and Assurance Lab National Chung Cheng University 25 IPEYE TCP stealth scan SYN, FIN, Xmas tree, and null scan

26. Information Networking Security and Assurance Lab National Chung Cheng University 26 WUPS Scanning UDP ports for Windows

27. Information Networking Security and Assurance Lab National Chung Cheng University 27 Banner Identification Get the information normally  Hostname  Program  Version

28. Information Networking Security and Assurance Lab National Chung Cheng University 28 Using your “Telnet” Try this FTP ServiceTelnet Service World Wide Web Service

29. Information Networking Security and Assurance Lab National Chung Cheng University 29 Message log Generate TCP connect() method Normal timing option System Log

30. Information Networking Security and Assurance Lab National Chung Cheng University 30 Summary Protect your host Dishonesty Footprints in the sand show where one has been.

31. Information Networking Security and Assurance Lab National Chung Cheng University 31 Reference Nmap www.insecure.org/nmap/www.insecure.org/nmap/ Tcmpdump www.tcpdump.org/www.tcpdump.org/ Superscan www.foundstone.com/resources/proddesc/superscan.h tm www.foundstone.com/resources/proddesc/superscan.h tm Netscanools www.netscantools.comwww.netscantools.com RFC 1700 RFC 793

32. Information Networking Security and Assurance Lab National Chung Cheng University 32 What is RPC Service ? Remote Procedure Call 程序呼叫  一個程式裡一部份呼叫另一部份去做某項工作

33. Information Networking Security and Assurance Lab National Chung Cheng University 33 UDP_SCAN

34. Information Networking Security and Assurance Lab National Chung Cheng University 34 UDP_SCAN