Dr. Hidaia Mahmood Alassouli - Hacking of Computer Networks

The Idel scan is another way of scan. We want when we make scan, the destination does not register that I made the scan, but the IDS registers the Zombie that made the scan. The destination must be Idle. This technique used with the printer networks. The hacker sends SYN/ACK to zombie and it responses with RST signal. We write the packet ID. We will make packet spoofing IP. We will send the packet SYN to the target and so the target will answer to the Zombie with SYN ACK and the Zombie will answer with RST if the port is open. We will send SYN ACK again to the Zombie and we will take the packet ID. If the packet ID increased with two numbers, the port is open. If the packet ID increased with one number, the port is close.

In UDP scan, the hacker sends UDP probe to the destination. If the destination did not answer, then the port open otherwise it is close.

# nmap –sU 192.168.28.138 –p- (all ports)

It will show all open UDP ports.

Firewalking: It is the combination of portscanning and tracerouting technique.

# hping3 --scan 1-1024 -S - t 5 scanme.nmap.org

d) Understanding the Port Scan Decoys:

The scan decoys is hiding process.

To slow down scans write

# nmap –T1 192.168.28.138 -p445

To bypass firewalls so it will not detect the nmap

# nmap –n –PN -g53 192.168.28.138 -p445

e) Understanding operating system fingerprinting

To do fingerprinting, we have many tools: NetworkMiner, P0f, Satori

In backtrack there is tool called p0f

#p0f –i eth0

Active fingerprinting

#nmap –O -v 192.168.28.135

i. Banner grapping

You can get the type of operating system by writing

# telnet 192.168.1.20 80

GET/HTTP/1.1

In my computer, It will shows the operating system is linux. Besides it told the web server apache and the web application php

ii. Network Scan Tools

You can use the superscan windows tool

You can use the advanced IP scanner

In backtrack you can do scan using nmap

# nmap -sV 192.168.28.139

You can use Znmap tool

You can use the nmap command

# nmap –A –v –oA report 192.168.1.0/24 –p-

If you want to make scan without showing the offline hosts, remove –v.

# nmap –A –oA report 192.168.1.0/24 –p-

Use the program Dradis. Go backrack, reporting tools, evidence management, dradis. It works https. Go to the browser and write https//127.0.0.1:3004. Write the username admin and the password admin.

In dradis, click on import from file> Choose the xml file and make upload. You will get all destinations in the subnetwork.

Scan by metasploit armtage

Go to backtrack, exploitation tools, network exploitation tools, metasploit framework, armitage

We can use Cobalt Strike tool. You must buy the tool as it is not free

iii. Vulnerability Scanning

There are many programs for vulnerability scanning: Nessus, acunetix, w3af, armitage, netsparker, cobalt strike.

Nmap scripting engines.

You can check using nmap on the version detection and operating system detection, traceroute. You can scan your host using a script in your computer

Nessus scan

In backtrack write

# apt-get install nessus

Go to Nessus in /opt/nessus

# cd /opt/Nessus

# cd sbin the add user with the command Nessus-adduser

To register in Nessus

# cd /opt/Nessus/bin

After you finish, go to applications, backtrack, vulnerability assessment, vulnerability scanners, nessus

In browser write htps:// 127.0.0.1:8834

add the network subnet to scan

Use the Acunetix web vulnerability scanner

W3af Web Vulnerability scanner

Go to Vulnerability Assessment, Web Application Assessment, Web Vulnerability Scanner, w3af gui