-: Welcome to the scanning and enumeration phase. 2 2
In this phase, we're going to be poking around 3 3
until we can find the hole for us 4 4
to exploit in our next phase. 5 5
So, going back to our attacker's methodology, 6 6
we've already performed our reconnaissance, 7 7
and so now we're actually going to be looking 8 8
at doing our scanning and enumeration. 9 9
After this, we're going to move into gaining our access, 10 10
which is going to be where we actually 11 11
are going to do our exploit. 12 12
So, scanning and enumeration. 13 13
Scanning is, again, that active connecting to the system. 14 14
We're actually starting to poke at the system, 15 15
try to figure out what ports are open, 16 16
what services they're running, 17 17
and what versions they're running. 18 18
Now, enumeration's when we start doing 19 19
the in-depth gathering. 20 20
At this point with our enumeration, 21 21
we actually have found the open ports, 22 22
and now we're going to identify those services 23 23
on those ports. 24 24
So, for example, if I found that they're running port 21 25 25
as open, that's an FTP port. 26 26
That's scanning, but once I go and do 27 27
a little bit further research, and I figure out 28 28
that they're actually using VSFTP, 29 29
that actually is going to be enumeration. 30 30
We're going to compile all this information 31 31
so that we have a lot of information to work with 32 32
as we begin doing our exploits. 33 33
The last piece of this phase, 34 34
after we have scanned and enumerated, 35 35
is identifying what those vulnerabilities are 36 36
and what exploits may be available, 37 37
so that we can move into our gaining access 38 38
in the next phase. 39 39
So, the question always is, "What tool should I use?" 40 40
And there's a lot of different tools out there for this. 41 41
Now, there's no good single tool. 42 42
There's no one single source, 43 43
and the reason for that is every tool 44 44
does something a little bit differently. 45 45
Some tools you have to pay for. 46 46
Some are free and open source. 47 47
Some tools are easily detected, 48 48
while some others are more covert. 49 49
So it's really going to depend on what you want to do. 50 50
There's other tools out there that when you run them, 51 51
they're going to crash services on the victim machine, 52 52
which then is going to create a denial of service, 53 53
and you're going to get caught. 54 54
So you have to be very careful with some of these tools. 55 55
So what are we going to use in our class? 56 56
Well, we're going to use Zenmap, 57 57
and Zenmap is a graphical front end 58 58
for the Nmap scanning program. 59 59
Now, Nmap is by far the most popular scanning program 60 60
in the world, and Zenmap lets us harness all that power 61 61
in an easy-to-use graphical format. 62 62
It's a free and open source product. 63 63
It runs on Windows, it runs on Mac, and it runs on Linux, 64 64
and is installed by default in Kali Linux, 65 65
which is our penetration testing platform. 66 66
With Zenmap, we're going to be able to do 67 67
our scanning of our targets. 68 68
We're going to do this in a couple of different ways. 69 69
We can do an ARP scan. 70 70
We can do a ping scan. 71 71
We can do NetBIOS scans, 72 72
or we can even do passive collection 73 73
using something like Wireshark, 74 74
and we'll talk about these as we go through as well. 75 75
So the first one we wanted to talk about is ARP scanning. 76 76
Now, when you use this with Nmap, the command is 77 77
nmap-PR, and then the IP address, 78 78
and this will do the scanning using ARP. 79 79
There's a lot of advantages to this. 80 80
It's low-level, it looks like legitimate traffic, 81 81
and it's never going to be blocked by a target 82 82
because you physically have to have 83 83
ARP enabled for your networks to run. 84 84
Essentially what ARP does is 85 85
it's address resolution protocol. 86 86
It's what translates the Mac addresses 87 87
into IPs and IPs into Mac addresses. 88 88
Now, the disadvantages that we have with this is that 89 89
you can't go across to a different subnet. 90 90
So in our lab, for instance, 91 91
we're going to be using the 192.168.56 dot something subnet, 92 92
and so if we had somebody on the 93 93
192.168.1 dot something subnet, 94 94
we won't be able to use ARP to do that scanning. 95 95
Now, for us, that would be fine because we're going to 96 96
keep everything inside the same subnet, but by doing that, 97 97
you have to have access to that network. 98 98
That's a drawback of using ARP. 99 99
So how do we get by that? 100 100
Well, you migrate on to what we call ping. 101 101
Now, when we do a ping scan, we're actually using 102 102
ICMP traffic, internet control messaging protocol. 103 103
And the way we do this is we can use a regular ping command 104 104
in Windows or Unix, and we just do that 105 105
by doing ping and the IP address. 106 106
Or we can use Nmap to do it by doing 107 107
Nmap-sn, and the IP address. 108 108
The advantages of this is 109 109
you can use this locally or remotely. 110 110
It can go across subnets, which is great 111 111
because we couldn't do that with ARP. 112 112
The other thing that's nice about it 113 113
is it uses the Layer 3 protocol, 114 114
so we're going to get back a time to live. 115 115
Now, the usefulness of having a time to live 116 116
is we're going to be able to make a determination, 117 117
at least a rough guess, on what operating system 118 118
it's using, based on the time to live that we receive, 119 119
and we'll talk about that in a minute as well. 120 120
So, what are the disadvantages to ping? 121 121
Well, it's blocked by many firewalls. 122 122
Some Network IDSs are going to log ping activity, 123 123
and so you may get caught if you're doing 124 124
a bunch of ping sweeps, and it's typically used 125 125
by both system admins and hackers. 126 126
The good news there is, system admins use it, 127 127
so it can look like legitimate traffic. 128 128
The bad news is, lots of hackers use it, 129 129
so it also puts you in that negative category, 130 130
which is why those Network IDSs are logging this activity. 131 131
So, beyond ping, we can actually move into 132 132
what's called traceroute, and we talked about this 133 133
in the last lecture for reconnaissance as well, 134 134
and we can do that using Nmap as well. 135 135
We can do nmap-traceroute, and the IP address. 136 136
The nice thing about doing it this way, 137 137
as opposed to a ping, is we're also going to get 138 138
all the IPs of the routers along the way. 139 139
Now the bad thing of this is it is blocked 140 140
by some firewalls, just like ping, 141 141
because again, it's that ICMP traffic. 142 142
The next one that we can use is NetBIOS, 143 143
and NetBIOS is actually something that's used by Windows. 144 144
It blends into a Windows environment very well 145 145
because Windows is sending NetBIOS requests all the time, 146 146
and what NetBIOS does is it converts the IP addresses 147 147
to that Windows work group name 148 148
or that host name on the network. 149 149
This will actually be able to give us 150 150
a lot of details about the host. 151 151
We can find out if it's a member 152 152
of a work group or a domain. 153 153
We can find out its host name. 154 154
We can find out its Mac address, 155 155
and we can find out if it's doing file 156 156
and print sharing across Windows, and if it is, 157 157
these are vulnerabilities we can later exploit. 158 158
Now, the thing you have to be careful with NetBIOS is, 159 159
if you try to do a NetBIOS lookup on a Unix machine, 160 160
that's going to look really odd because Unix doesn't use it. 161 161
This is really noticeable, 162 162
and it can really flag the defenders. 163 163
So we talked a minute ago about time to live. 164 164
Now, when we do a ping, we do get back the time to live, 165 165
and that is probably one of the simplest ways 166 166
to fingerprint and figure out what OS they're running. 167 167
You'll be able to tell if it's Unix, Linux, Cisco IOS, 168 168
like a router, or a Mac system, based on that time to live. 169 169
It's not accurate, though, because those defaults 170 170
can be changed by the system administrator. 171 171
Most people don't change their defaults, 172 172
so it will be fairly accurate as far as that goes, 173 173
but just realize that somebody could change 174 174
their time to live and make it look like a Windows machine, 175 175
even if they're running Linux. 176 176
So if you're running Linux or Mac OSX, 177 177
you're going to have 64 as your time to live by default. 178 178
If you're running Windows, it's 128. 179 179
If you're running something like Solaris or Cisco, it's 255. 180 180
Now these are just some basic numbers to use, 181 181
and again, they're defaults. 182 182
They're not the hard and fast rule, 183 183
but they do give you a good starting point, 184 184
as you're trying to fingerprint that OS. 185 185
So the next stage after we do our scanning 186 186
is our enumeration. 187 187
And we talked about this before, 188 188
that enumeration is finding out those nitty, gritty details. 189 189
We're going to determine the OS and the service pack 190 190
that we're running, and we can identify the machine's role. 191 191
Is it a workstation, a server, a router, 192 192
some other infrastructure device? 193 193
These are all important things to understand. 194 194
And we're going to use this information to find 195 195
the vulnerabilities for the identified services. 196 196
Now, by doing this, and getting more information, 197 197
we can be quieter in our attacks. 198 198
The more we know about the victim, 199 199
the more quieter and well-refined our attack can be, 200 200
the less likely we're going to get caught. 201 201
So, as I'm doing my scanning and enumeration, 202 202
what are the kind of things I should be looking for? 203 203
I need to look for ports, and the reason 204 204
I want to look for ports is that there's 205 205
a port associated with a service. 206 206
So, for example, if I have a web server running, 207 207
it's going to have port 80 or port 443 208 208
if it's unsecure or secure. 209 209
If I'm running FTP, I'll have port 20 and 21 open. 210 210
If I'm running something like SSH, it's 22. 211 211
If I'm running SMTP, it's 25. 212 212
If I'm running a POP server, it's 110, 213 213
IMAP, 143, Remote Desktop, 3389. 214 214
All those ports that become important 215 215
in your certification exams are now coming back, 216 216
and we can identify those. 217 217
Now, what are some of the ones 218 218
that I would really want to look for? 219 219
Myself, I like to identify if it's Windows or Linux. 220 220
If it's Windows, I'm going to see things 221 221
like 135, 139, and 445. 222 222
Those are NetBIOS file sharing in Windows. 223 223
They're very common in Windows environment, 224 224
not very common in a Unix environment. 225 225
Port 445 may be open in a Unix environment as well, 226 226
and the reason for that is they will run something called 227 227
Samba, but you're never going to see that port 135 open. 228 228
That's pretty much a dead giveaway on the Windows side. 229 229
The next thing I look for is if it's Linux. 230 230
If it's port 111, 631, or 2049, 231 231
those are common Linux ports, 232 232
111 being remote procedure call mapping, 233 233
631 being Cups, which is printer services, 234 234
and 2049 being NFS, which is file sharing. 235 235
So these are some common ports you can identify 236 236
whether it's a Windows or a Linux machine. 237 237
Now just because I've identified if it's Windows or Linux, 238 238
I still haven't identified whether it's Windows XP, 239 239
Windows 2003, Windows 7, Windows 8, Windows 10, 240 240
I just know that it's Windows in general. 241 241
So we'll talk about how to get that specific version 242 242
identification a little bit later on. 243 243
So what are some enumeration methods? 244 244
Well, we can do manual enumeration 245 245
through something called banner grabbing, and what that is, 246 246
is we're going to connect to the target using Telnet. 247 247
So if I had, for instance, I found port 21 was open, 248 248
which is an FTP server, I can Telnet against that port 21, 249 249
and I'll get a response saying, "Welcome to the FTP server," 250 250
and part of that will tell me the version number. 251 251
That's called the banner, 252 252
and so I can get the operating system this way. 253 253
I can get the version of the software 254 254
they're running this way, 255 255
and that's going to give me more details to do more attacks. 256 256
Very common things with banners: FTP, SSH, Telnet, 257 257
and web browsing, so if you find those ports open, 258 258
do a banner grab and find out what they've got. 259 259
There's also other tools that will do 260 260
automatic enumeration for you. 261 261
So, what's the tool we're going to use? 262 262
Again, we're going to use Nmap. 263 263
I know I said earlier, 264 264
"There is no single tool for everything," 265 265
but Nmap is a really great tool for a lot of things, 266 266
and so we're going to use it. 267 267
Nmap is a great tool because it allows us 268 268
to scan different layers of the TCP IP stack. 269 269
We're going to be able to do pings and traceroutes, 270 270
NetBIOS, TCP, UDP, and more using Nmap or Zenmap, 271 271
and that's why we're going to use it for our labs. 272 272
So what's the great thing about Nmap? 273 273
It's going to do the scanning for us, 274 274
and it's going to do the enumeration for us. 275 275
So, when you run Nmap, 276 276
you can run it very quietly and be very precise, 277 277
or you can be more broad and more intense. 278 278
We'll talk about those different profiles in a bit, 279 279
but if we go more intense, we have the ability to do 280 280
some of the enumeration inversion controls for us, 281 281
and we're going to do that. 282 282
Now, one of the ways that Nmap works 283 283
is it uses different TCP flags, 284 284
and the way it does that is it's going to actually use 285 285
the URG, the ACK, the push, the reset, the SYN, 286 286
and the FIN and tell us, 287 287
based on the way that it sets or doesn't set those flags 288 288
and the responses it gets what ports are open, 289 289
what things are answering up, what services they are, 290 290
what operating system, and what versioning. 291 291
That's how it does it. 292 292
It's all about TCP flag manipulation. 293 293
For example, the URG, which is urgent, 294 294
even if it's out of order, it's going to transmit first 295 295
because it wants to get those packets out 296 296
as quickly as possible. 297 297
This goes back to our TCP fundamentals 298 298
that you may have learned in earlier networking classes. 299 299
ACK is the acknowledgement of the sender's request. 300 300
Push is push the buffer data to the receiving application 301 301
as quickly as possible. 302 302
Reset is when you want to tear down the connection. 303 303
SYN is used to agree on the number of sequences 304 304
and start beginning that sequence of exchanges, 305 305
and then FIN is when we do the graceful shutdown. 306 306
We finish the connection, we say, 307 307
"Hey, I'm done sending you stuff, you may now reset." 308 308
So, normally when we do a handshake, 309 309
we do a SYN that says, 310 310
"Hey, I want to make a connection with you." 311 311
A SYN-ACK is received back from that server, saying, 312 312
"I acknowledge that you want to talk with me," 313 313
and then we send back the ACK, which acknowledges it, 314 314
and then we can start communicating. 315 315
Well, Nmap is going to do some of that, 316 316
whether it's a full three-way handshake 317 317
or parts of that handshake, 318 318
and that's how it's going to do the manipulation 319 319
to figure out what is being used on the distant side. 320 320
Nmap also has the ability to do OS detection. 321 321
It can determine what the operating system is. 322 322
Now, when we do an OS detection, 323 323
this is a noisy process in Nmap. 324 324
So it's actually going to scan 1,000 ports 325 325
on the remote host, and it's going to do it twice. 326 326
So it's going to do it once, and it's going to do it again. 327 327
Now, when it does it, it sends out 328 328
six TCP packets with the SYN flag set. 329 329
It gets back with the sequence numbers and the window size, 330 330
and based on those sequence number and window size, 331 331
it can determine if it's Windows or Linux. 332 332
Now, it's also going to send out two ICMP echo packets, 333 333
and when it does that, it's checking the reply 334 334
and the sequence numbers that it gets, and by doing that, 335 335
it's able to get a more refined understanding 336 336
of what version of Windows 337 337
or what version of Linux you're using. 338 338
It also has one UDP packet that's sent out to a closed port 339 339
because closed ports are just as important as open ports. 340 340
When I send something to a closed port, 341 341
and I see that response, 342 342
it tells me a lot about that operating system. 343 343
And then, I'm also going to send out six TCP packets 344 344
to open ports with various flag sets, 345 345
going back with that acknowledge, the SYN, the reset, 346 346
and see how those respond. 347 347
Based on all those sending and receiving of responses, 348 348
I'm going to be able to get a really good idea 349 349
and get pretty accurate in knowing if it's Windows, 350 350
Linux, and what version of Windows or Linux it is, 351 351
and we're going to go through that in the lab as well. 352 352
The next thing that Nmap can do for us 353 353
is it can do version scanning. 354 354
So, because we've identified that port 21 is FTP, 355 355
we can actually do a version scan and determine, 356 356
not only is it FTP, but it's VSFTP, version 2.3. 357 357
It's going to be based on when we send packets of data 358 358
to that port and the responses we get back. 359 359
Again, the scans take a long time, 360 360
so it's best to use less ports. 361 361
It's also very noisy. 362 362
So if I have 1,000 ports, I don't want to scan all 1,000. 363 363
I might choose FTP, and I might choose web browsing 364 364
and go after those two first. 365 365
It's going to send a SYN. 366 366
It's going to get back a SYN/ACK, and once it receives that, 367 367
it's going to send a reset 368 368
which is going to tear down that link. 369 369
The nice thing about this is it doesn't make 370 370
a full connection, so it doesn't get logged into those IDSs, 371 371
but as soon as it's done with that, 372 372
it actually will go ahead and do a full three-way handshake, 373 373
which is, again, going to be logged, 374 374
and that's where it's going to review that response 375 375
to be able to determine exactly the version you have. 376 376
So that first SYN, SYN/ACK and reset 377 377
is just to find if the port's open. 378 378
The second one is really to understand the response, 379 379
and then do that version scanning. 380 380
So earlier, I talked about the fact that we're going 381 381
to use Zenmap, which is a graphical environment, 382 382
and Zenmap has five default profiles, 383 383
five basic default profiles. 384 384
They are ping, quick, regular, 385 385
intense, and slow comprehensive. 386 386
Now, what a ping does is just that. 387 387
It just sends out pings. 388 388
It tells you is the host up or down? 389 389
When we do our lab later, we're going to start out with ping 390 390
and determine what hosts are available on the network. 391 391
So we're going to start with a slash 24 392 392
which has 254 possible hosts on it, 393 393
and we're going to do a ping to find out 394 394
that there's only two that are actually up. 395 395
Then, based on knowing those two are up, 396 396
we're going to do a quick scan of those two. 397 397
And what a quick scan does, 398 398
is it does the first 100 common ports 399 399
and comes back with the information on those. 400 400
After that, we can go to a regular, 401 401
which does the 1,000 most common ports, 402 402
and then we can even go into an intense 403 403
or a slow comprehensive, which again, gets us more detail. 404 404
When I do something like an intense scan, 405 405
I actually run about 150 different scripts on it, 406 406
so that I can get NetBIOS information, version information, 407 407
operating system information. 408 408
All of that enumeration is done for me 409 409
inside that intense scan. 410 410
So again, it's a little bit noisier, 411 411
but I'm going to get a lot of great details back. 412 412
And then, slow comprehensive, 413 413
it's going to do even more of that. 414 414
It's going to scan every port. 415 415
It's going to scan every host on the network, 416 416
and it's going to really run a ton of scripts 417 417
just to find out as much information as it can. 418 418
This is really, really noisy. 419 419
If you're not the system administrator, 420 420
you don't want to be running slow comprehensive. 421 421
I would not run slow comprehensive if I was a hacker. 422 422
I would get caught too easily. 423 423
And finally, that brings us down to, 424 424
now that we have done our scanning and our enumeration, 425 425
what are we going to do with that information? 426 426
Well, let's assume that I went 427 427
and I scanned a Windows machine, 428 428
and on that Windows machine, I found that 429 429
port 135, 139, and 445 were open. 430 430
That's Windows file share. 431 431
Now, I can go to cve.mitre.org, 432 432
which is the common vulnerability and exposure database. 433 433
In there, I can search for the operating system version 434 434
I found, Microsoft XP, for instance. 435 435
I can search for the fact that they're using file sharing, 436 436
because I found those ports open, 437 437
and find out what vulnerabilities exist. 438 438
Now, as I go through there, 439 439
I'm going to find a vulnerability that exists, 440 440
for instance the one we're going to use, Microsoft 08-067. 441 441
That particular code is the Microsoft knowledge base 442 442
article for a bug that they found in 2008 443 443
to the Windows XP operating system. 444 444
Now, what we're going to do is we're going to match 445 445
that vulnerability to that code, and that code 446 446
we're then going to use inside our exploitation 447 447
in our next phase, which we're going to use 448 448
a program called Metasploit. 449 449
And in there, we're going to be able to set that exploit. 450 450
So now we have a vulnerability and an exploit, 451 451
and when we match those up, we then have an exploitation, 452 452
and that's how we're going to gain our access. 453 453
So, at this point, we're going to move on 454 454
and go into our lab environment. 455 455
Here we're going to actually practice 456 456
some of these scanning techniques that we just talked about.