Active scanning is done through sending multiple requests and recording the responses because passive
scanners are limited to looking at existing traffic.
They suffer in terms of overall completeness and accuracy.
For example a passive scanner can't detect an application that no one ever uses and it can be fooled
easily by a system intentionally spewing out misinformation and disinformation.
The tools seen on the slide are a few examples of active scanning tools.
In this course, we will examine the NMAP and Nessus tools in detail.
Hping: is an excellent command-­line oriented TCP/IP packet assembler/analyser. The interface is inspired by the ping(8)
unix command
but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-­IP protocols,
has a traceroute mode, ability to send files between a covered channel, and many other features.
So a subset of the stuff you can do using hping: Firewall Testing, Advanced Port Scanning Network, Network
testing, using different protocols, TOS, fragmentation manual path MTU discovery, Advanced Traceroute,
under all the supported protocols
Remote OS fingerprinting, Remote uptime guessing and don't forget TCP/IP stacks auditing
Hping can also be useful to students that are learning TCP/IP. Although it's a packet analyzer tool is widely used for
DoS.
(Denial of Service) tests and attacks to create IP-­spoofed packets and send them to the target system.
Let’s see how we can use HPING command to scan the network simply: • Go to Kali and open a terminal screen
hping3 is embedded into Kali and defined in the path,
so you can use it anywhere.
Just typing the name of the command, hping3. Type ”hping3 -­h” or “hping3 -­help”
to see the detailed usage of hping3 command.
Let’s look at a few parameters important for scanning mode: Under the “mode” title
we have a scan mode and the help shows a sample usage of the mode as well.
We’ll use "scan" or "­8 parameter" to use hping in scan mode. Under TCP/UDP title,
we have the parameters to set the flags of TCP or UDP packets. Well,
you’ll see the flags and meaning in this course in following lectures, so, just see the hping in
action now.
For example, -­S (uppercase S) or -syn parameter is used to set the SYN flag of TCP or UDP packets. Let`s prepare the hping
the command to make a network scan.
The first parameter is scan.
” to use hping in scan mode. Here we should say in which ports we will scan. In this example, 0-­500 means that the ports between 0 and 500 will be scanned.
In this example, 0-­500 means that the ports between 0 and 500 will be scanned.
You can give a port range like this with a dash between the lower bound and the upper bound.
Or you can give the ports one by one separating them by a comma or you can use a combination of these
two.
Now I want to set the SYN flag of the packet. Because all TCP connections start with a SYN packet.
Well, again, we’ll show you how a TCP handshake is made later on in the following lectures.
Here comes the IP address to scan. Hit enter to start the scan.
Here we have the responding ports. And flags column says what the reply is. We sent SYN packets
and get SYN-­ACK packets,
that means, ports are accessible and open to us.
Now let’s make another scan. In this time, I’ll use -­X (uppercase X) to make an Xmas scan. In this scan, PUSH,
URGENT and FIN flags are set in the packet, which is not seen in regular traffic. Since the packets they
received are not valid packets.
they dropped them, and returned no response.
Although it’s not the subject of our course, because it’s very common usage,
I’d like to show you how to perform an IP-­Spoofed DoS (Denial of Service) attack using hping tool.
I’m going to attack my own server. First, I test if I can connect to the application.
So open a terminal screen and ping the application: www.owaspbwa.com. OK,
I have a connection through the application. Open a browser and visit the website.
Here I click a few links to show the response time of the server.
Ok it's really fast.
It responses as soon as a click to links.
Now let’s prepare the hping command to prepare a DoS attack.
The first parameter of the command is “-­flood”.
Let’s run “hping3 -­-­help” in another terminal screen to see the meanings of the
parameters.
Flood parameter is used to send packets as fact as possible. To make it a SYN flood attack
I set the SYN flag using -­S parameter. When I send a SYN packet,
since it’s a legitimate TCP handshake starter, the server will try to response all the packets at the
the start of the TCP communication. ­
So the server will be very very busy. -V is to open verbose mode,
that means, we’d like to see the results of sent packets.
The next parameter is Rande source.
This parameter will randomize the source IP addresses as if they are requested by different systems.
So the attack is distributed denial of service now and since the IP addresses are random the victim
doesn't know about you.
You have the target domain as a last parameter.
Oh by the way the order of the parameters is not important.
It does start the attack because we're in flood mode.
No replies has shown.
Let's try to click a few links to see the response time of the server while it's under attack.
Click a link.
It's waiting waiting.
Waiting is obviously so down.
Maybe our request will be time down.
So this is how a simple denial of service attack is perform. I stop the flood by stopping the run of the command
using “ctrl + c” keys. As you see, in less than a minute,
we sent more than 1 million SYN packets to the victim server.
No packets received because we randomise the source IP addresses of the packet.
That means the responses were sent to different IP addresses.
This is why we didn't receive any packets since I stopped sending packets.
The servers now responding in good time again.
Now let’s repeat the attack while Wireshark is running to see what is happening under the hood. Start Wireshark.
Wireshark.
Since we’re using the eth0 interface of Kali, I double click to eth0 on the home screen to start
to start to listen to the traffic passing thorough the eth0 interface. There are still some packets
on the queue because of our previous attack.
I restart capturing by pressing the green button at the upper left corner of Wireshark to clean the
screen before the second attack. Continue without saving.
OK Wireshark is running and clean.
We're ready to repeat the attack.
You can see the number of packets at the bottom of Wireshark. As you see
we sent hundreds of thousands of packets in seconds.