1. Network Reconnaissance CS490 - Security in Computing Copyright © 2005 by Scott Orr and the Trustees of Indiana University

2. Section Overview Web Searches Web Searches Whois Queries Whois Queries DNS Queries / Zone Transfers DNS Queries / Zone Transfers Network Reachability Network Reachability Port Scanning Port Scanning OS Fingerprinting OS Fingerprinting User account identification User account identification

3. References Security in Computing, 3 rd Ed. Security in Computing, 3 rd Ed. Chapter 7 (pgs. 363-403) Chapter 7 (pgs. 363-403)

4. Reconnaissance Phases Footprinting Source: Hacking Exposed: Network Security: Secrets and Solutions, by S. McClure, J. Scambray, and G. Kurtz Enumeration Scanning

5. Whois Queries American Registry for Internet Numbers American Registry for Internet Numbers Domain – IP address blocks Domain – IP address blocks Europe, Asia, etc. have their own Europe, Asia, etc. have their own Internic – Registered Domain Info Internic – Registered Domain Info Domain name Domain name Registrar Registrar Name Server addresses Name Server addresses Registrar Sites Registrar Sites Domain location (mailing address) Domain location (mailing address) Administrative/Technical Contact info Administrative/Technical Contact info Name Servers Name Servers

6. DNS Zone Transfer Address (A) Address (A) maps host name to IP Pointer (PTR) Pointer (PTR) maps IP to host name Mail Exchanger (MX) Mail Exchanger (MX) Identifies email servers Conical Name (CNAME) Conical Name (CNAME) Host name aliases Service (SVC) Service (SVC) Service identification Host Info (HINFO) Host Info (HINFO) Identifies host type Text (TXT) Text (TXT) Misc. info about host Name Server (NS) Name Server (NS) Name server host IP Extract entire DNS database Query Tools: nslookup, dig

7. Network Reachability ping ping Is the host online? Is the host online? “Not Available” vs. “No Answer” “Not Available” vs. “No Answer” traceroute traceroute Lists all router hops to host Lists all router hops to host Most domain names identify location Most domain names identify location Timeouts at host may indicate presence of a firewall Timeouts at host may indicate presence of a firewall

8. Port Scanning Checking of all ports on a target Checking of all ports on a target Banner Grabbing Banner Grabbing Can looks for known service bugs/exploits Can looks for known service bugs/exploits Can leave a big footprint Can leave a big footprint Common Scanners Common Scanners Satan/Saint/Sara Satan/Saint/Sara Satan/Saint/Sara Nmap Nmap Nmap Nessus Nessus Nessus

9. OS Fingerprinting FIN Probing FIN Probing TCP ISN Sampling TCP ISN Sampling IPID Sampling IPID Sampling TCP Timestamp TCP Timestamp TCP Options TCP Options Fragmentation Handling Fragmentation Handling TCP Retransmission Timeouts TCP Retransmission Timeouts TCP Initial Window TCP Initial Window ACK Values ACK Values ICMP Error Quoting ICMP Error Quoting ICMP Error Message Echo Integrity ICMP Error Message Echo Integrity ICMP Error Message Type of Service (TOS) ICMP Error Message Type of Service (TOS) ICMP Error Message Limiting ICMP Error Message Limiting

10. User/Share Identification User accounts can provide many openings User accounts can provide many openings UNIX/Linux UNIX/Linux finger finger showmount -e showmount -e Win2000/XP Win2000/XP NULL Sessions NULL Sessions net view /domain net view /domain nbtstat -A nbtstat -A Services Services Email: EXPN Email: EXPN SNMP SNMP