{
    "id": "e9205cb4-1d5a-4ac5-8faf-b238764132f4",
    "name": "Investigating Network Scans",
    "slug": "investigating-network-scans",
    "status": "published",
    "lab_type": "pta",
    "is_sample": false,
    "duration_in_seconds": 1800,
    "metadata": {
        "courses": [
            "cd60ce4a-1b83-48c4-8d38-7e6bfeab4a1e"
        ],
        "pta_sdn": "58",
        "pta_namespace": "my.ine",
        "learning_paths": [],
        "has_published_parent": true
    },
    "session": null,
    "company": "a491bc32-c056-4946-9169-cc053387bada",
    "created": "2022-03-30T03:08:14.760905Z",
    "modified": "2024-04-30T14:37:35.918897Z",
    "is_beta": false,
    "lab_objectives": [],
    "main_learning_area": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
    "learning_areas": [
        {
            "id": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
            "name": "Cyber Security",
            "slug": "cyber-security"
        }
    ],
    "categories": [],
    "tags": [],
    "difficulty": null,
    "is_web_access": false,
    "is_lab_experience": false,
    "is_featured": false,
    "cve": null,
    "severity": null,
    "year": null,
    "classification": null,
    "external_url": "",
    "solution_video": null,
    "explanation_video": null,
    "description": "# Scenario\n\nThe network is being scanned by various techniques for open ports and live IPs. Your job is to determine the types of scans and their target and, if possible, the source.\n\n# Goals\n\n-   Examine the traffic generated by the scanners\n-   Determine the technique used\n-   Find the source and the goal\n\n# What you will learn\n\n-   Analyze traffic looking for attacks\n-   Discover spoofing attempts\n\n# Recommended tools\n\n- **Wireshark**",
    "description_html": "<h1>Scenario</h1>\n<p>The network is being scanned by various techniques for open ports and live IPs. Your job is to determine the types of scans and their target and, if possible, the source.</p>\n<h1>Goals</h1>\n<ul>\n<li>Examine the traffic generated by the scanners</li>\n<li>Determine the technique used</li>\n<li>Find the source and the goal</li>\n</ul>\n<h1>What you will learn</h1>\n<ul>\n<li>Analyze traffic looking for attacks</li>\n<li>Discover spoofing attempts</li>\n</ul>\n<h1>Recommended tools</h1>\n<ul>\n<li><strong>Wireshark</strong></li>\n</ul>",
    "tasks": "# Tasks\n\n## Task 1: Examine the First Captured File Named 1.pcapng \n\nAnalyze the first provided PCAP file [located at **Desktop/Module7/Lab21/1.pcapng**] and try to identify:\n\n1.  Who is the attacker and who is the victim\n2.  What type of scan is being conducted\n3.  Two open ports and two closed ones\n\n## Task 2: Examine the Second Captured File Named 2.pcapng \n\nAnalyze the second provided PCAP file [located at **Desktop/Module7/Lab21/2.pcapng**]. Try to determine and write down the following.\n\n1.  What type of scan is being conducted this time?\n2.  How is this scan different from the previous one?\n\n## Task 3: Examine the Third Captured File Named idle.pcapng \n\nFinally, analyze the third provided PCAP [located at **Desktop/Module7/Lab21/idle.pcapng**]. Try to determine and write down the following.\n\n1.  What type of scan is being conducted this time?\n2.  Who is the attacker?\n3.  What ports is he/she scanning?\n\n## Task 4: Find a Way to Make Sure that the Identified IP is Actually the One of the Attacker\n\nYou confronted the person whose IP you discovered in the analyzed traffic earlier. However, he denied that he has anything to do with it. After you examined his machine, it turned out to be an old Windows XP machine with no network scanning tools installed. How can you prove that the owner of this machine is being framed?",
    "tasks_html": "<h1>Tasks</h1>\n<h2>Task 1: Examine the First Captured File Named 1.pcapng</h2>\n<p>Analyze the first provided PCAP file [located at <strong>Desktop/Module7/Lab21/1.pcapng</strong>] and try to identify:</p>\n<ol>\n<li>Who is the attacker and who is the victim</li>\n<li>What type of scan is being conducted</li>\n<li>Two open ports and two closed ones</li>\n</ol>\n<h2>Task 2: Examine the Second Captured File Named 2.pcapng</h2>\n<p>Analyze the second provided PCAP file [located at <strong>Desktop/Module7/Lab21/2.pcapng</strong>]. Try to determine and write down the following.</p>\n<ol>\n<li>What type of scan is being conducted this time?</li>\n<li>How is this scan different from the previous one?</li>\n</ol>\n<h2>Task 3: Examine the Third Captured File Named idle.pcapng</h2>\n<p>Finally, analyze the third provided PCAP [located at <strong>Desktop/Module7/Lab21/idle.pcapng</strong>]. Try to determine and write down the following.</p>\n<ol>\n<li>What type of scan is being conducted this time?</li>\n<li>Who is the attacker?</li>\n<li>What ports is he/she scanning?</li>\n</ol>\n<h2>Task 4: Find a Way to Make Sure that the Identified IP is Actually the One of the Attacker</h2>\n<p>You confronted the person whose IP you discovered in the analyzed traffic earlier. However, he denied that he has anything to do with it. After you examined his machine, it turned out to be an old Windows XP machine with no network scanning tools installed. How can you prove that the owner of this machine is being framed?</p>",
    "published_date": "2020-10-20T15:32:26Z",
    "solutions": "# Solutions\n\n## Task 1: Examine the First Captured File Named 1.pcapng\n\nLet's load the first provided PCAP file [located at **Desktop/Module7/Lab21/1.pcapng**] in Wireshark.\n\nWe know that most types of TCP scans start with a SYN message.\n\nAn attacker conducting Port scanning will likely be sending a large number of SYN segments.\nWe can filter for TCP messages with SYN Flags in Wireshark in order to identify the IP address of the attacker.\n\n![1](https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/1.png)\n\nAfter using the proper filter, we can see that most of the SYN segments are coming from the IP: **192.168.153.133**\n\nIn order to determine the type of scan, we need to examine at least one port being scanned. We can filter the traffic looking for segments going or coming from a certain port and examine how this port was scanned.\n\nFor this example will examine how Port 80 was scanned. Using filter `tcp.port==80`\n\n![2](https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/2.png)\n\nWe can see that the attacker has completed the three-way handshake before sending the RST segment to end the connection.\n\nThis suggests that this is a full TCP scan.\n\nWe can also verify that Port 80 was opened on the machine that was being scanned because the victim machine replied with SYN ACK message.\n\nTo examine more open ports we need to look for SYN-ACK messages which originated from the victim machine.\n\nUsing the proper Wireshark filter we can get all the messages which originated from open ports\n\n```\n(tcp.ack==1 and tcp.flags.syn==1) and ip.src==192.168.153.130\n```\n\n![3](https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/3.png)\n\n## Task 2: Examine the Second Captured File Named 2.pcapng\n\nLet's now load the second provided PCAP file [located at **Desktop/Module7/Lab21/2.pcapng**] in Wireshark.\n\nTo examine the differences between this type of scan and the previous one, we need to examine how at least one port was scanned.\n\nLet's examine port 445 which is usually opened by default on most windows systems. Using filter `tcp.port==445`\n\n![4](https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/4.png)\n\nWe can see that the attacker terminated the connection immediately after receiving the SYN, ACK message from the client.\n\nThis suggests that this is a half-open scan where the attacker 192.168.153.133 is scanning 192.168.153.130.\n\nSame as before, we can examine the open ports by filtering the messages which originated from the server and have both the SYN and ACK flags set. \n\n![5](https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/5.png)\n\n## Task 3: Examine the Third Captured File Named Idle.pcapng\n\nLet's load the third provided PCAP file [located at **Desktop/Module7/Lab21/idle.pcapng**] in Wireshark.\n\nFrom the first look at it, this seems like the other typical scans we have examined earlier. We can use Wireshark filters to review the syn segments being sent\n\n```\ntcp.flags.syn==1 and tcp.flags.ack==0\n```\n\n![6](https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/6.png)\n\nWe can see that the machine with IP 192.168.153.140 seems to be scanning the 192.168.153.130 machine.\n\nFrom the first look at the transport layer headers there doesn't seem to be anything wrong just a typical half-open scan being conducted and the opened ports are replying with SYN, ACK messages.\n\n```\ntcp.flags.syn==1 and tcp.flags.ack==1 and ip.src==192.168.153.130\n```\n\n![7](https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/7.png)\n\nThe only noticeable difference is the number of repeated segments being sent which we haven't seen when we examined the half-open scan in the previous task.\n\n## Task 4: Find a Way to Make Sure that the Identified IP is Actually the One of the Attacker \n\nIf what the owner of the 192.168.153.140 machine is saying is true, then there is someone forging packets, putting his address on it, and sending it on its behalf.\n\nOne way to prove that an impersonator exists in the network is to find two packets with the same Source IP address on them (zombie's IP) but with different machine-related headers such as the TTL and the MAC address.\n\nBasically, if we find two packets with the same Source IP address and different Mac addresses, this means that there are two different sources for those packets.\n\nLet's first filter and examine the SYN segments which have the zombie's IP address on it.\n\n```\nip.src==192.168.153.140\n```\n\n![8](https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/8.png)\n\nWe'll examine two different segments (a SYN and a RST), frames 56 and 57 to verify whether they have been sent from the same machine or not.\n\n![9](https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/9.png)\n\nBy listing the headers of the two messages, we can clearly see that there are many differences in machine-related fields between the two packets.\n\nFirst, even though the two packets have the same Source IP, they have a different source MAC address and different TTL, which is more than enough to suggest that the two packets originated from different network interface cards.\n\nIn order to find the true attacker behind this, we can use the MAC addresses we got to search the packet file for packets that have the same MAC but different IP addresses. Those packets should belong to the true attacker's machine.\n\nSince we know by now that this is a \"zombie scan\" attempt, there is no need to try and lookup both Mac addresses.\n\nWe know that the first step in a \"zombie scan,\" is when the attacker forges a SYN message with the zombies Source IP address on it.\n\nSo the MAC address on the forged SYN message the victim has received is the attacker's true Mac address.\n\nTo easily find the packet we're looking for, we can filter and look for packets which have the source Mac address we're looking for and doesn't have the zombie's IP address.\n\n```\neth.src==00:0c:29:20:bc:14 and !(ip.addr==192.168.153.140)\n```\n\n![10](https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/10.png)\n\nIt seems that the true attackers IP address is 192.168.153.133.",
    "solutions_html": "<h1>Solutions</h1>\n<h2>Task 1: Examine the First Captured File Named 1.pcapng</h2>\n<p>Let's load the first provided PCAP file [located at <strong>Desktop/Module7/Lab21/1.pcapng</strong>] in Wireshark.</p>\n<p>We know that most types of TCP scans start with a SYN message.</p>\n<p>An attacker conducting Port scanning will likely be sending a large number of SYN segments.\nWe can filter for TCP messages with SYN Flags in Wireshark in order to identify the IP address of the attacker.</p>\n<p><img alt=\"1\" src=\"https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/1.png\" /></p>\n<p>After using the proper filter, we can see that most of the SYN segments are coming from the IP: <strong>192.168.153.133</strong></p>\n<p>In order to determine the type of scan, we need to examine at least one port being scanned. We can filter the traffic looking for segments going or coming from a certain port and examine how this port was scanned.</p>\n<p>For this example will examine how Port 80 was scanned. Using filter <code>tcp.port==80</code></p>\n<p><img alt=\"2\" src=\"https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/2.png\" /></p>\n<p>We can see that the attacker has completed the three-way handshake before sending the RST segment to end the connection.</p>\n<p>This suggests that this is a full TCP scan.</p>\n<p>We can also verify that Port 80 was opened on the machine that was being scanned because the victim machine replied with SYN ACK message.</p>\n<p>To examine more open ports we need to look for SYN-ACK messages which originated from the victim machine.</p>\n<p>Using the proper Wireshark filter we can get all the messages which originated from open ports</p>\n<pre class=\"codehilite\"><code>(tcp.ack==1 and tcp.flags.syn==1) and ip.src==192.168.153.130</code></pre>\n\n<p><img alt=\"3\" src=\"https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/3.png\" /></p>\n<h2>Task 2: Examine the Second Captured File Named 2.pcapng</h2>\n<p>Let's now load the second provided PCAP file [located at <strong>Desktop/Module7/Lab21/2.pcapng</strong>] in Wireshark.</p>\n<p>To examine the differences between this type of scan and the previous one, we need to examine how at least one port was scanned.</p>\n<p>Let's examine port 445 which is usually opened by default on most windows systems. Using filter <code>tcp.port==445</code></p>\n<p><img alt=\"4\" src=\"https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/4.png\" /></p>\n<p>We can see that the attacker terminated the connection immediately after receiving the SYN, ACK message from the client.</p>\n<p>This suggests that this is a half-open scan where the attacker 192.168.153.133 is scanning 192.168.153.130.</p>\n<p>Same as before, we can examine the open ports by filtering the messages which originated from the server and have both the SYN and ACK flags set. </p>\n<p><img alt=\"5\" src=\"https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/5.png\" /></p>\n<h2>Task 3: Examine the Third Captured File Named Idle.pcapng</h2>\n<p>Let's load the third provided PCAP file [located at <strong>Desktop/Module7/Lab21/idle.pcapng</strong>] in Wireshark.</p>\n<p>From the first look at it, this seems like the other typical scans we have examined earlier. We can use Wireshark filters to review the syn segments being sent</p>\n<pre class=\"codehilite\"><code>tcp.flags.syn==1 and tcp.flags.ack==0</code></pre>\n\n<p><img alt=\"6\" src=\"https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/6.png\" /></p>\n<p>We can see that the machine with IP 192.168.153.140 seems to be scanning the 192.168.153.130 machine.</p>\n<p>From the first look at the transport layer headers there doesn't seem to be anything wrong just a typical half-open scan being conducted and the opened ports are replying with SYN, ACK messages.</p>\n<pre class=\"codehilite\"><code>tcp.flags.syn==1 and tcp.flags.ack==1 and ip.src==192.168.153.130</code></pre>\n\n<p><img alt=\"7\" src=\"https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/7.png\" /></p>\n<p>The only noticeable difference is the number of repeated segments being sent which we haven't seen when we examined the half-open scan in the previous task.</p>\n<h2>Task 4: Find a Way to Make Sure that the Identified IP is Actually the One of the Attacker</h2>\n<p>If what the owner of the 192.168.153.140 machine is saying is true, then there is someone forging packets, putting his address on it, and sending it on its behalf.</p>\n<p>One way to prove that an impersonator exists in the network is to find two packets with the same Source IP address on them (zombie's IP) but with different machine-related headers such as the TTL and the MAC address.</p>\n<p>Basically, if we find two packets with the same Source IP address and different Mac addresses, this means that there are two different sources for those packets.</p>\n<p>Let's first filter and examine the SYN segments which have the zombie's IP address on it.</p>\n<pre class=\"codehilite\"><code>ip.src==192.168.153.140</code></pre>\n\n<p><img alt=\"8\" src=\"https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/8.png\" /></p>\n<p>We'll examine two different segments (a SYN and a RST), frames 56 and 57 to verify whether they have been sent from the same machine or not.</p>\n<p><img alt=\"9\" src=\"https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/9.png\" /></p>\n<p>By listing the headers of the two messages, we can clearly see that there are many differences in machine-related fields between the two packets.</p>\n<p>First, even though the two packets have the same Source IP, they have a different source MAC address and different TTL, which is more than enough to suggest that the two packets originated from different network interface cards.</p>\n<p>In order to find the true attacker behind this, we can use the MAC addresses we got to search the packet file for packets that have the same MAC but different IP addresses. Those packets should belong to the true attacker's machine.</p>\n<p>Since we know by now that this is a \"zombie scan\" attempt, there is no need to try and lookup both Mac addresses.</p>\n<p>We know that the first step in a \"zombie scan,\" is when the attacker forges a SYN message with the zombies Source IP address on it.</p>\n<p>So the MAC address on the forged SYN message the victim has received is the attacker's true Mac address.</p>\n<p>To easily find the packet we're looking for, we can filter and look for packets which have the source Mac address we're looking for and doesn't have the zombie's IP address.</p>\n<pre class=\"codehilite\"><code>eth.src==00:0c:29:20:bc:14 and !(ip.addr==192.168.153.140)</code></pre>\n\n<p><img alt=\"10\" src=\"https://assets.ine.com/content/ptp/lab_21_investigating_network_scans/10.png\" /></p>\n<p>It seems that the true attackers IP address is 192.168.153.133.</p>",
    "flags": [],
    "min_points_to_pass": null,
    "access_type": "default",
    "user_status": "unstarted",
    "user_lab_status": null,
    "user_status_modified": null,
    "user_flags": [],
    "global_running_session": null
}