1 Hands-On Ethical Hacking and Network DefenseChapter 5 Port Scanning Updated 11/7/ jw

2 Objectives Describe port scanningDescribe different types of port scans Describe various port-scanning tools Explain what ping sweeps are used for Explain how packet generation works

3 Introduction to Port ScanningDetermine which applications/ services are offered by a host Identifies vulnerabilities Open services can be used on attacks Identify a vulnerable port Launch an exploit Scan all ports when testing Not just well-known ports

4 Angry IP Port Scanner

5 Introduction to Port Scanning (continued)Port scanning programs report Open ports Closed ports Filtered ports Best-guess assessment of which OS is running

6 Port Scanning ArtifactsIDS/IPS alerts referencing port/protocol scans. Firewall logs showing blocked attempts to access large number of ports, in close sequence, on single host, in short time TCP session initiated to IP address, immediately terminated, not followed by additional communication, observable in firewall log TCP session only half set up then abandoned, potentially observable in firewall log

7 Is Port Scanning Legal? The legal status of port scanning is unclearIf you have permission, it's legal If you cause damage of $5,000 or more, it may be illegal For more info, see links: https://www.sans.org/reading-room/whitepapers/legal/ethics-legality-port-scanning-71

8 Using Port-Scanning ToolsHundreds available Not all are accurate Be familiar with a variety of tools Practice often to gain proficiency Do not use one tool exclusively Some tools include: Nmap Nessus and OpenVAS Using Port-Scanning Tools Port-scanning tools Hundreds available Not all are accurate Be familiar with a variety of tools Practice often to gain proficiency Do not use one tool exclusively Some tools include: Nmap Nessus and OpenVAS

9 Nmap

10 Nmap Originally written for Phrack magazineOne of the most popular tools GUI versions ZenMap, Xnmap and Ubuntu's NmapFE Makes working with complex options easier Open source tool Standard tool for security professionals

11 Types of Port Scans Ping scanSimplest method sends ICMP ECHO REQUEST to the destination(s) TCP Ping sends SYN or ACK to any port (default is port 80 for Nmap) Any response shows the target is up Example - nmap -sn *

12 Normal TCP Handshake After this, you are ready to send dataClient SYN  Server Client  SYN/ACK Server Client ACK  Server After this, you are ready to send data

13 SYN Port Scan Client SYN  Server Client  SYN/ACK ServerClient RST  Server The server is ready, but the client decided not to complete the handshake Example - nmap -sS * -reason

14 Types of Port Scans SYN scanStealthy scan, because session handshakes are never completed That keeps it out of some log files Three states Closed Open Filtered Example - nmap -sS *

15 Types of Port Scans Connect scan Completes the three-way handshakeNot stealthy--appears in log files Three states Closed Open Filtered Example - nmap -sT * -reason

16 Types of Port Scans NULL scan All the packet flags are turned offTwo results: Closed ports reply with RST Open or filtered ports give no response Example - nmap -sN * -reason

17 Types of Port Scans XMAS scan FIN, PSH and URG flags are setWorks like a NULL scan – a closed port responds with an RST packet Example - nmap -sX * -reason

18 Types of Port Scans FIN scan Only FIN flag is setClosed port responds with an RST packet Example - nmap -sF * -reason

19 Windows Machines NULL, XMAS and FIN scans don't work on Windows machines Win 2000 Pro and Win Server 2003 shows all ports closed Win XP Pro all ports open/filtered See the NMAP tutorial https://nmap.org/bennieston-tutorial/

20 Types of Port Scans (continued)ACK scan Used to get information about a firewall Stateful firewalls track connection and block unsolicited ACK packets Stateless firewalls just block incoming SYN packets, so you get a RST response Example - nmap -sA * -reason

21 Types of Port Scans (continued)UDP scan Closed port responds with ICMP “Port Unreachable” message Rarely used Example - nmap -sU * -reason

22 Types of Port Scans (continued)Nping Part of the Nmap suite Open-source tool for network packet generation, response analysis and response time measurement. Nping allows users to generate network packets of a wide range of protocols, letting them tune virtually any field of the protocol headers. Examples nping -c 1 --tcp -p 80,433 scanme.nmap.org google.com nping --tcp -c p

23 Using Port-Scanning ToolsNmap (ZenMap GUI) Unicornscan NetScanTools Pro Nessus OpenVAS (or Greenbone Security Assistant)

24 Nmap OS Fingerprinting

25 Nmap Service Fingerprintingnmap -sV

26 Nmap

27 The Matrix Reloaded Trinity uses NmapVideo at https://www.youtube.com/watch?v=0PxTAn4g20U

28 Online Nmap Scanning https://pentest-tools.com/network-vulnerability-scanning/tcp-port-scanner-online-nmap

29 Unicornscan Developed in 2004 for Linux & UNIX onlyIdeal for large networks Scans 65,535 ports in three to seven seconds Optimizes UDP scanning Alco can use TCP, ICMP, or IP Free from

30 Unicornscan Scatter Connect feature – Off load scans to multiple servers

31 NetScanTools Pro Robust easy-to-use commercial tool Runs on WindowsTypes of tests Database vulnerabilities DHCP server discovery IP packets viewer Name server lookup OS fingerprinting

32

33 Nessus First released in 1998 as a free, open source remote security scanner tool Uses a client/server technology Can conduct tests from different locations Can use different OSs for client and network 2005 – Nessus 3 became a commercial product

34 Nessus (continued) Server Client Functions much like a database serverAny *NIX platform Client Can be *NIX or Windows Functions much like a database server Ability to update security checks plug-ins Some plug-ins are considered dangerous

35

36 Nessus (continued) Finds services running on portsFinds vulnerability scanning associated with identified services Real-time Vulnerability Updates Web Application Scanning Mobile Device Detection Configuration Checks Compliance Checks (PCI, CIS, FDCC, NIST, etc.) Sensitive Data Searches SCADA Audits

37

38 OpenVAS (or Greenbone Security Assistant)Open-source fork of Nessus in 2005 Now branded as Greenbone Security Assistant Capable of updating security check plug-ins Security test programs (scripts) Performs complex queries while client interfaces with server Can also determine what vulnerabilities are associated with services

39 Conducting Ping SweepsIdentify which IP addresses belong to active hosts Ping a range of IP addresses Problems Computers that are shut down cannot respond Networks may be configured to block ICMP Echo Requests Hardware and software firewalls may filter out ICMP traffic

40 FPing Ping multiple IP addresses simultaneously Command-line toolInput: multiple IP addresses To enter a range of addresses -g option Input file with addresses -f option See links - Latest Version

41 Fping To ping sweep a range of IP addresses without using an input file, use the command: fping –g BeginningIPaddress EndingIPaddress The –g parameter is used when no input file is available Example: fping –g command returns the results shown on next slide

42 Fping on Ubuntu sudo apt-get install fping

43 Hping Used to bypass filtering devices Powerful toolAllows users to fragment and manipulate IP packets Powerful tool Supports many parameters (command options) including OS Fingerprinting See links https://en.wikipedia.org/wiki/Hping https://www.ethicalhacker.net/columns/gates/tutorial-hping2-basics No Longer in Development use Hping 2 or 3

44 hping2 on Ubuntu sudo apt-get install hping2The command below sends three SYN packets to port 80 on the server Response is SYN/ACK, as expected

45

46

47

48 Broadcast Addresses If you PING a broadcast address, that can create a lot of traffic In Class A, B, and C IP addresses normally the broadcast address ends in .255 But if your LAN is subnetted with a subnet mask like (/26) There are other broadcast addresses ending in 63, 127, and 191

49 Broadcast Addresses Flooded BroadcastWorkstation:~ wagnerj$ ping PING ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=255 time=1.805 ms 64 bytes from : icmp_seq=0 ttl=64 time=2.020 ms 64 bytes from : icmp_seq=0 ttl=64 time=2.188 ms 64 bytes from : icmp_seq=0 ttl=64 time=5.243 ms 64 bytes from : icmp_seq=0 ttl=64 time= ms 64 bytes from : icmp_seq=0 ttl=64 time= ms 64 bytes from : icmp_seq=0 ttl=64 time= ms 64 bytes from : icmp_seq=0 ttl=64 time= ms 64 bytes from : icmp_seq=0 ttl=64 time= ms 64 bytes from : icmp_seq=0 ttl=64 time= ms 64 bytes from : icmp_seq=0 ttl=64 time= ms IP ADDRESS OF WORKSTATION = /22

50 Broadcast Addresses Directed BroadcastWorkstation:~ wagnerj$ ping PING ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=255 time=5.387 ms 64 bytes from : icmp_seq=0 ttl=64 time=5.572 ms 64 bytes from : icmp_seq=0 ttl=64 time=5.735 ms 64 bytes from : icmp_seq=0 ttl=64 time=5.890 ms 64 bytes from : icmp_seq=0 ttl=64 time= ms 64 bytes from : icmp_seq=0 ttl=64 time= ms 64 bytes from : icmp_seq=0 ttl=64 time= ms 64 bytes from : icmp_seq=0 ttl=64 time= ms 64 bytes from : icmp_seq=0 ttl=64 time= ms 64 bytes from : icmp_seq=0 ttl=64 time= ms 64 bytes from : icmp_seq=0 ttl=64 time= ms IP ADDRESS OF WORKSTATION = /22

51 Smurf Attack Pinging a broadcast address on an old network resulted in a lot of ping responses So just put the victim's IP address in the "From" field The victim is attacked by a flood of pings, none of them directly from you Modern routers don't forward broadcast packets, which prevents them from amplifying smurf attacks Windows and Ubuntu don't respond to broadcast PINGs See links https://en.wikipedia.org/wiki/Smurf_attack

52 Smurf Attack

53 Smurf Attack

54 Smurf Attack Mitigation techniquesConfigure individual hosts and routers not to respond to ICMP requests or broadcasts Configure routers not to forward packets directed to broadcast addresses. Network ingress filtering to reject the attacking packets on the basis of the forged source address.

55 Crafting IP Packets Packet componentsSource IP address Destination IP address Flags Crafting packets helps you obtain more information about a service

56 Crafting IP Packets ToolsScapy - Yersinia - Ostinato - Colasoft Packet Builder -http://www.colasoft.com/ Bit-Twist - Fping Hping