Scanning and Enumeration

Scanning - discovering systems on the network and looking at what ports are open as well as applications that may be running

Connectionless Communication - UDP packets are sent without creating a connection. Examples are TFTP, DNS (lookups only) and DHCP

Connection-Oriented Communication - TCP packets require a connection due to the size of the data being transmitted and to ensure deliverability

TCP Flags

Flag	Name	Function
SYN	Synchronize	Set during initial communication. Negotiating of parameters and sequence numbers
ACK	Acknowledgment	Set as an acknowledgement to the SYN flag. Always set after initial SYN
RST	Reset	Forces the termination of a connection (in both directions)
FIN	Finish	Ordered close to communications
PSH	Push	Forces the delivery of data without concern for buffering
URG	Urgent	Data inside is being sent out of band. Example is cancelling a message

TCP Handshake

SYN -> SYN-ACK - ACK
Sequence numbers increase on new communication. Example is computers A and B. A would increment B’s sequence number. A would never increment it’s own sequence.

Port Numbers

Internet Assigned Numbers Authority (IANA) - maintains Service Name and Transport Protocol Port Number Registry which lists all port number reservations

Ranges

Well-known ports - 0 - 1023
Registered ports - 1024 - 49,151

Dynamic ports - 49,152 - 65,535

Port Number	Protocol	Transport Protocol
20/21	FTP	TCP
22	SSH	TCP
23	Telnet	TCP
25	SMTP	TCP
53	DNS	TCP/UDP
67	DHCP	UDP
69	TFTP	UDP
80	HTTP	TCP
110	POP3	TCP
135	RPC	TCP
137-139	NetBIOS	TCP/UDP
143	IMAP	TCP
161/162	SNMP	UDP
389	LDAP	TCP/UDP
443	HTTPS	TCP
445	SMB	TCP
514	SYSLOG	UDP

A service is said to be listening for a port when it has that specific port open
Once a service has made a connection, the port is in an established state
Netstat
- Shows open ports on computer
- netstat -an displays connections in numerical form
- netstat -b displays executables tied to the open port (admin only)

Subnetting

IPv4 Main Address Types
- Unicast - acted on by a single recipient
- Multicast - acted on by members of a specific group
- Broadcast - acted on by everyone on the network
  - Limited - delivered to every system in the domain (255.255.255.255)
  - Directed - delivered to all devices on a subnet and use that broadcast address
Subnet mask - determines how many address available on a specific subnet
- Represented by three methods
  - Decimal - 255.240.0.0
  - Binary - 11111111.11110000.00000000.00000000
  - CIDR - x.x.x.x/12 (where x.x.x.x is an ip address on that range)
- If all the bits in the host field are 1s, the address is the broadcast
- If they are all 0s, it’s the network address
- Any other combination indicates an address in the range

Scanning Methodology

Check for live systems - ping or other type of way to determine live hosts
Check for open ports - once you know live host IPs, scan them for listening ports
Scan beyond IDS - if needed, use methods to scan beyond the detection systems
Perform banner grabbing - grab from servers as well as perform OS fingerprinting
Scan for vulnerabilities - use tools to look at the vulnerabilities of open systems
Draw network diagrams - shows logical and physical pathways into networks
Prepare proxies - obscures efforts to keep you hidden

Identifying Targets

The easiest way to scan for live systems is through ICMP.
It has it’s shortcomings and is sometimes blocked on hosts that are actually live.

Message Types and Returns

ICMP Message Type	Description and Codes
0: Echo Reply	Answer to a Type 8 Echo Request
3: Destination Unreachable	Error message followed by these codes: 0 - Destination network unreachable 1 - Destination host unreachable 6 - Network unknown 7 - Host unknown 9 - Network administratively prohibited 10 - Host administratively prohibited 13 - Communication administratively prohibited
4: Source Quench	A congestion control message
5: Redirect	Sent when there are two or more gateways available for the sender to use. Followed by these codes: 0 - Redirect datagram for the network 1 - Redirect datagram for the host
8: Echo Request	A ping message, requesting an echo reply
11: Time Exceeded	Packet took too long to be routed (code 0 is TTL expired)

Payload of an ICMP message can be anything; RFC never set what it was supposed to be. Allows for covert channels
Ping sweep - easiest method to identify hosts
ICMP Echo scanning - sending an ICMP Echo Request to the network IP address
An ICMP return of type 3 with a code of 13 indicates a poorly configured firewall
Ping scanning tools
- Nmap
- Angry IP Scanner
- Solar-Winds Engineer Toolkit
- Advanced IP Scanner
- Pinkie
Nmap virtually always does a ping sweep with scans unless you turn it off

Port Scan Types

Full connect - TCP connect or full open scan - full connection and then tears down with RST
- Easiest to detect, but most reliable
- nmap -sT
Stealth - half-open scan or SYN scan - only SYN packets sent. Responses same as full.
- Useful for hiding efforts and evading firewalls
- nmap -sS
Inverse TCP flag - uses FIN, URG or PSH flag. Open gives no response. Closed gives RST/ACK
- nmap -sN (Null scan)
- nmap -sF (FIN scan)
Xmas - so named because all flags are turned on so it’s “lit up” like a Christmas tree
- Responses are same as Inverse TCP scan
- Do not work against Windows machines
- nmap -sX
ACK flag probe - multiple methods
- TTL version - if TTL of RST packet < 64, port is open
- Window version - if the Window on the RST packet is anything other than 0, port open
- Can be used to check filtering. If ACK is sent and no response, stateful firewall present.
- nmap -sA (ACK scan)
- nmap -sW (Window scan)
IDLE Scan - uses a third party to check if a port is open
- Looks at the IPID to see if there is a repsonse
- Only works if third party isn’t transmitting data
- Sends a request to the third party to check IPID id; then sends a spoofed packet to the target with a return of the third party; sends a request to the third party again to check if IPID increased.
  - IPID increase of 1 indicates port closed
  - IPID increase of 2 indicates port open
  - IPID increase of anything greater indicates the third party was not idle
- nmap -sI

Nmap Switches

Switch	Description
-sA	ACK scan
-sF	FIN scan
-sI	IDLE scan
-sL	DNS scan (list scan)
-sN	NULL scan
-sO	Protocol scan (tests which IP protocols respond)
-sP	Ping scan
-sR	RPC scan
-sS	SYN scan
-sT	TCP connect scan
-sW	Window scan
-sX	XMAS scan
-A	OS detection, version detection, script scanning and traceroute
-PI	ICMP ping
-Po	No ping
-PS	SYN ping
-PT	TCP ping
-oN	Normal output
-oX	XML output
-T0 through -T2	Serial scans. T0 is slowest
-T3 through -T5	Parallel scans. T3 is slowest

Nmap runs by default at a T3 level
Fingerprinting - another word for port sweeping and enumeration

Hping

Another powerful ping sweep and port scanning tool
Also can craft packets
hping3 -1 IPaddress

Switch	Description
-1	Sets ICMP mode
-2	Sets UDP mode
-8	Sets scan mode. Expects port range without -p flag
-9	Listen mode. Expects signature (e.g. HTTP) and interface (-I eth0)
–flood	Sends packets as fast as possible without showing incoming replies
-Q	Collects sequence numbers generated by the host
-p	Sets port number
-F	Sets the FIN flag
-S	Sets the SYN flag
-R	Sets the RST flag
-P	Sets the PSH flag
-A	Sets the ACK flag
-U	Sets the URG flag
-X	Sets the XMAS scan flags

Evasion

To evade IDS, sometimes you need to change the way you scan
One method is to fragment packets (nmap -f switch)
OS Fingerprinting
- Active - sending crafted packets to the target
- Passive - sniffing network traffic for things such as TTL windows, DF flags and ToS fields
Spoofing - can only be used when you don’t expect a response back to your machine
Source routing - specifies the path a packet should take on the network; most systems don’t allow this anymore
IP Address Decoy - sends packets from your IP as well as multiple other decoys to confuse the IDS/Firewall as to where the attack is really coming from
- nmap -D RND:10 x.x.x.x
- nmap -D decoyIP1,decoyIP2….,sourceIP,…. [target]
Proxy - hides true identity by filtering through another computer. Also can be used for other purposes such as content blocking evasion, etc.
- Proxy chains - chaining multiple proxies together
  - Proxy Switcher
  - Proxy Workbench
  - ProxyChains
Tor - a specific type of proxy that uses multiple hops to a destination; endpoints are peer computers
Anonymizers - hides identity on HTTP traffic (port 80)

Vulnerability Scanning

Can be complex or simple tools run against a target to determine vulnerabilities
Industry standard is Tenable’s Nessus
Other options include
- GFI LanGuard
- Qualys
- FreeScan - best known for testing websites and applications
- OpenVAS - best competitor to Nessus and is free

Enumeration

Defined as listing the items that are found within a specific target
Always is active in nature

Windows System Basics

Everything runs within context of an account
Security Context - user identity and authentication information
Security Identifier (SID) - identifies a user, group or computer account
Resource Identifier (RID) - portion of the SID identifying a specific user, group or computer
The end of the SID indicates the user number
- Example SID: S-1-5-21-3874928736-367528774-1298337465-500
- Administrator Account - SID of 500
- Regular Accounts - start with a SID of 1000
- Linux Systems used user IDs (UID) and group IDs (GID). Found in /etc/passwd
SAM Database - file where all local passwords are stored (encrypted)
- Stored in C:\Windows\System32\Config
Linux Enumeration Commands
- finger - info on user and host machine
- rpcinfo and rpcclient - info on RPC in the environment
- showmount - displays all shared directories on the machine

Active - sending specially crafted packets and comparing responses to determine OS
Passive - reading error messages, sniffing traffic or looking at page extensions
Easy way to banner grab is connect via telnet on port (e.g. 80 for web server)
Netcat can also be used to banner grab
- nc
Can be used to get information about OS or specific server info (such as web server, mail server, etc.)

NetBIOS Enumeration

NetBIOS provides name servicing, connectionless communication and some Session layer stuff
The browser service in Windows designed to host information about all machines within domain or TCP/IP network segment
NetBIOS name is a 16-character ASCII string used to identify devices
Command on Windows is nbtstat
- nbtstat (gives your own info)
- nbtstat -n (gives local table)
- nbtstat -A IPADDRESS (gives remote information)
- nbtstat -c (gives cache information)

Code	Type	Meaning
<1B>	UNIQUE	Domain master browser
<1C>	UNIQUE	Domain controller
<1D>	GROUP	Master browser for subnet
<00>	UNIQUE	Hostname
<00>	GROUP	Domain name
<03>	UNIQUE	Service running on system
<20>	UNIQUE	Server service running

NetBIOS name resolution doesn’t work on IPv6
Other Tools
- SuperScan
- Hyena
- NetBIOS Enumerator
- NSAuditor

SNMP Enumeration

Management Information Base (MIB) - database that stores information
Object Identifiers (OID) - identifiers for information stored in MIB
SNMP GET - gets information about the system
SNMP SET - sets information about the system
Types of objects
- Scalar - single object
- Tabular - multiple related objects that can be grouped together
SNMP uses community strings which function as passwords
There is a read-only and a read-write version
Default read-only string is public and default read-write is private
These are sent in cleartext unless using SNMP v3
Tools
- Engineer’s Toolset
- SNMPScanner
- OpUtils 5
- SNScan

Other Enumerations

LDAP
- Connects on 389 to a Directory System Agent (DSA)
- Returns information such as valid user names, domain information, addresses, telephone numbers, system data, organization structure and other items
- Tools
  - Softerra
  - JXplorer
  - Lex
  - LDAP Admin Tool
NTP
- Runs on UDP 123
- Querying can give you list of systems connected to the server (name and IP)
- Tools
  - NTP Server Scanner
  - AtomSync
  - Can also use Nmap and Wireshark
- Commands include ntptrace, ntpdc and ntpq
SMTP
- VRFY - validates user
- EXPN - provides actual delivery address of mailing list and aliases
- RCPT TO - defines recipients

CEHv10_Ultimate_Study_Guide