Читать книгу Hacking of Computer Networks - Dr. Hidaia Mahmood Alassouli - Страница 12

c) Understanding the ping sweep technique.

It will find which devices are actives in the network. There are many tools to make ping sweep: angry and hping and nmap.

 Use nmap

#nmap –sn 192.168.28.0 /24

 Use hping

 Use in windows angry tools

 Use the nmap to know the open ports in a host

#nmap –sT 192.168.152.130 -p 80

 Use the nmap to make scan on all ports

#nmap 192.168.152.130

 Use the metasploit for same purpose

#msfconsole

Msf> search scanner/portscan

Msf> Use auxiliary/scanner/tcp

Msf> Info

Msf> Set RHOSTS 192.168.28.139

Msf> Set PORTS 1-1000

Msf> run

 The problem if there is firewall we will not get results. In stealth scan or half open scan

# nmap –sS 192.168.28.13 -p 80

Use the metasploit for same purpose

#msfconsole

Msf> search scanner/portscan

Use auxiliary/scanner/syn

Info

Set RHOSTS 192.168.28.139

Set PORTS 1-1000

Run

 We can use the ACK to know the unfiltered ports on firewall

# nmap –sA 192.168.28.138 -p138

It will tell you it is unfiltered port in the firewall

 Use the metasploit for same purpose

#msfconsole

Msf> search scanner/portscan

Use auxiliary/scanner/ack

Info

Set RHOSTS 192.168.28.139

Set PORTS 3380-3390

Run

It will tell you the unfiltered ports

 The FIN scan is another way of scan. The computer sends FIN packet and if the host answered it, it is open port otherwise it is closed port

# nmap –sF 192.168.28.138 -p1-1000

 The XMAS scan is another way of scan. The source machine sends FIN and URG and PUSH and if the destination did not answer, then the port open and if it did answer with RST then the port close.

# nmap –sX 192.168.28.138 -p80

 Here the source machine sends TCP packet with NO flag set. If the destination did not answer, then the port open and if it did answer with RST then the port close.

# nmap –sN 192.168.28.138 -p80

 The Idel scan is another way of scan. We want when we make scan, the destination does not register that I made the scan, but the IDS registers the Zombie that made the scan. The destination must be Idle. This technique used with the printer networks. The hacker sends SYN/ACK to zombie and it responses with RST signal. We write the packet ID. We will make packet spoofing IP. We will send the packet SYN to the target and so the target will answer to the Zombie with SYN ACK and the Zombie will answer with RST if the port is open. We will send SYN ACK again to the Zombie and we will take the packet ID. If the packet ID increased with two numbers, the port is open. If the packet ID increased with one number, the port is close.

 In UDP scan, the hacker sends UDP probe to the destination. If the destination did not answer, then the port open otherwise it is close.

# nmap –sU 192.168.28.138 –p- (all ports)

It will show all open UDP ports.

 Firewalking: It is the combination of portscanning and tracerouting technique.

# hping3 --scan 1-1024 -S - t 5 scanme.nmap.org