Network Scanning Techniques

• Scanning is performed for network scanning to identify "alive" machines in a network.
• Port scanning to determines which ports are open and "listening".
• OS Fingerprinting to identify the OS, version, and service pack.
• Vulnerability scanning to identify vulnerabilities on a target system.

Scanning Outline

• Host Discovery: Identifying active hosts on a network.
• Port Scanning: Determining open ports and services on target hosts.
• Software Fingerprinting: Identifying software and versions running on target hosts.
• Vulnerability Scanning: Identifying potential vulnerabilities on target systems.

Host Discovery

• Host Discovery: The process of identifying active hosts on a network.
• Ping sweepers ping a machine to detect if it is on the network.
• ICMP scanning is another name for pinging
• Ping sweepers can scan different machines in parallel
• Ping sweepers can be easily detected and blocked by IDS firewalls and can use TCP/UDP or ARP scans instead

ICMP Message Types

• Echo request (8): A ping message to check if a host is reachable.
• Timestamp request (13): Obtains the system time of the target, with the response indicating the number of milliseconds since 00:00 GMT.
• Subnet Mask Request (17): Obtains the subnet mask used by the target.
• Transport level "ping” a port and if there is a reply, the host is up

Nmap

• Available at https://www.youtube.com/watch?v=0PxTAn4g20U
• Nmap was first released in 1997
• Command line and GUI versions exist for *nix and Windows
• Nmap is noted as the richest scanning tool.
• Downloadable at https://nmap.org/download.html
• Other scanners include Unicornscan, which specializes in advanced UDP scans

Nmap Host Discovery Scan Types

• -P: Used for various ICMP scans.
• -PE: Scans using ICMP echo (ping).
• -PP: Scans using ICMP timestamps instead of ICMP ping.
• -PM: Scans using ICMP netmask requests.
• IP Higher-level Protocol Pings:
• -PO : Sends ICMP, IGMP, and IP-in-IP packets; ICMP, IGMP, and IP-in-IP are sent by default.

TCP's Handshake

• Reminds of the TCP’s handshake of the client(Alice), server(bob)
• SYN(SequenceNum=x)
• SYN+ACK(SequenceNum=y, AcknowledgNum=x+1)
• ACK(AcknowledgeNum=y+1)

Nmap Host Discovery - Scan Type

• -PS ports: TCP SYN scans a list of ports.
• -PA ports: TCP ACK scans a list of ports.
• -PU ports: UDP scans a list of ports.
• -PY ports: SCTP scans a list of ports.
• Multiple –P scans can be combined.
• https://nmap.org/book/man-host-discovery.html

Nmap Targets

• Single IP address or domain name: Scans a specific target.
• Classless Inter-Domain Routing (CIDR) notation: Scans a range of IP addresses (e.g., 10.0.0.1/24 covers all hosts on the 10.0.0.1-255 network with a 255.255.255.0 netmask).
• Ranges: Use nmap -p 179 10.0-255.0-255.1,254 to scan specific IP ranges. Scans all .1 and .254 to identify those that use BGP.
• -iL: Parse hosts from a list.
• -n: No reverse DNS resolution for discovered IPs.

Nmap Behavior

• Use the flag "-packet-trace" to monitor network activity, for example: sudo nmap -sn 192.168.231.2 -packet-trace
• -sn (used to be -sP):
  • If the user has privileges, Nmap sends a TCP SYN packet to port 443, a TCP ACK packet to port 80, and an ICMP timestamp request.
  • If the user lacks privileges, Nmap falls back to TCP connect to ports 80 and 443.
  • If the scanned hosts are on the same LAN, ARP is used, which is detect faster and harder to detect.

Port Scanning Overview

• Port Scanning: Process of identifying open ports and services on a target system.
• Ports numbers are from 0 to 65,535
• http://www.iana.org/assignments/port-numbers

Well-known TCP Ports (0-1023)

• ECHO: 7
• FTP: data 20, control: 21
• SSH: 22
• Telnet: 23
• SMTP: 25
• HTTP: 80
• POP3: 110
• NetBIOS: 137-139
• HTTPS: 443

Port Categories

• Registered Ports: 1024 – 49151
  • Window Internet Name Service, WINS: 1512
  • Remote Desktop: 3389
• Recommended Dynamic and/or Private Ports: 49152 – 65535

Port Scanning detection

• Probes each port
• Provides more information but easier to detect
• If only established TCP connections are logged, TCP SYN scan will be undetected as it does not establish full TCP connections

TCP Flags

• SYN: Initiates a communication + counter
• ACK: Acknowledgement
• URG: Message is processed immediately by the receiver ( e.g. abort signal over a remote shell )
• PSH: Message is processed immediately, immediate processing at both sender and receiver
• RST: Reset the connection, sent back when a service that does not exist is requested, can be useful
• FIN: Closes a connection, “= I will stop sending”
• Order : CWR ECE URG ACK PSH RST SYN FIN
  • 0x14 ACK + RST

TCP/UDP scans

• TCP scanner sends a TCP SYN to each port If the port replies: open then Client(Alice)-SYN (SequenceNum=x) to Server(Bob), SYN+ACK(SequenceNum=y, AcknowledgeNum=x+1) is sent back and ACK(AcknowledgeNum=y+1) to the client.
• If a TCP RST is sent: closed
• If no reply: no host or por is filtered

UDP Scans

• UDP scan is harder as it is the application layer that decides on the response
• Then an ICMP port unreachable message is sent if there is no application listening, the If an ICMP port unreachable is received, then port closed
• TCP scans are more common.

Nmap Port Scan

• Will by default, nmap target scan about 1000 ports
• -F flag will make the scan a fast scan thus less ports
• -p specifies the port to scan, can be used to provide ranges and be separated by commas
  • nmap -p 21-25,80, nmap -p10000-, nmap -p-1023, nmap -p-
• -p T scans TCP ports
• -p U scans UDP ports
• sudo nmap 192.168.1.1 -sU -sS -sY -p U:53,111,137,T:21-25,80,139,8080,S:9

Nmap TCP Scans

• Using connect scan, indicated by the -sT flag
• If the port is open, then Alice sends SYN to the server, server sends SYN/ACK to Alice, Alice sends ACK to the server
• If the port is closed, then the server sends a RST/ACK to Alice
• This is easily detected

TCP SYN Scans

• SYN scan (half-open SYN) using the -sS flag
• If the port is open, then Alice sends SYN to the server, server sends SYN/ACK to Alice, Alice sends RST to the server
• If the port is closed, then the then the server sends a RST/ACK to Alice
• Stealthier than connect, but not enough
• When running Nmap as root, the default scan type is TCP SYN (-sS)

Nmap TCP Scan Option

• -SA: ACK scan, an unfiltered port (whether open or closed) replies with a RST message.
• Open ports are shown as "unfiltered", it allows for identifying firewall filtering rules

Nmap TCP Scans Techniques

• Inverse TCP flag scanning involves sending malformed TCP packets.
  • Only closed ports respond with RST/ACK (RFC 793).
• NULL Scan (-sN): All flags disabled.
• FIN Scan (-sF): Only FIN is enabled.
• Xmas Scan (-sX): FIN, PSH, and URG flags are enabled. Different OS may react differently. Maimon Scan (-sM): FIN and ACK flags are enabled. Flags are enabled.
• Stateful firewalls filter these scans.

Nmap UDP Scan

• Sends empty packets
• Run using nmap -sU target
• Unicornscan is an advanced UDP scan option that can distinguish between open and filtered ports.
• Port Unreachable means the port is closed, otherwise open, filtered or no host

Software Fingerprinting

• Software Fingerprinting: Identifying software and versions running on open ports.
  • -sV: tries to identify applications running on all the open ports on a target.
  • uses established database of application behaviors
  • if Nmap is unable to identify the application, insecure.org is notified
  • open a session using telnet IP port to check the banner

Nmap OS Fingerprinting

• sends, extra packets and analyses responses
  • compared to "signatures" in a database
  • nmap -O
  • can send malformed/unexpected packets to trigger error responses (vary more than normal responses; the latter are more standard.

Vulnerability Scanning

• The identification of vulnerabilities associated with discovered services.
• Vulnerability Identification consists of finding vulnerabilities for discovered services where common vulnerabilities and exposures are handled by Mitre, a non-for-profit project (https://cve.mitre.org/).
• The department of Homeland defense maintains a similar list and the CVE list feeds into NVD’s, then NVD adds extra information.

Exploit Databases

• Exploit databases are utilized to find exploits for discovered vulnerabilities.
• They can be used manually by using the exploit database download, rewrite, compile and run.
• Important to have a database as it is a bad idea to run some code provided by others if you do not understand it !!
• Sometimes the exploit will do more than what is in its description: crash target, delete data, create a zombie for the original code author.

Exploit Unavailability

• It is important to identify what to do when no exploit exists for the vulnerability.
• Nothing!
• Include the vulnerability in the penetration test report and move to the next vulnerability.

Process Automation

• Vulnerability scanners: Nessus, OpenVAS, GFI LANguard, Retina, Core Impact. Vulnerability exploiters: Metasploit, Core Impact, Canvas.
• Top 100 security tools: www.sectools.org
• The ability to schedule tests is an important asset for tools.

VULNERABILITY SCANNING: NESSUS

• Includes 2 components: server and client.

  • either or both can be installed, the can run on different platforms such as Linux server and a client with Win 10
    • Client: defines the scan tasks
      • if installed under windows, must use the admin privileges
  • Plug-in: implements a security check - Communications between the server between the server and clients.
    • Written in Nessus Attack Scripting language (NASL)

• Could run credentials machine to check the security of products installed

• Uses the "safe checks" option by default to avoid crashing

Scan Summary

• Host Discovery: Identifying active hosts using tools like Scapy and Nmap.
• Port Scanning: Identifying open ports using TCP and UDP protocols and tools like Scapy and Nmap.
• OS Fingerprinting: Identifying the operating system by checking banners and triggering error packets.
• Vulnerability Scanning: Checking product versions against CVE databases to identify vulnerabilities.

Nmap Tricks

• Nmap -sL hw.ac.uk/28
• --source-port (or -g) <portnum>: Specify source port number
• -f: Fragments packets to fool naive firewalls
• Scanning timing: -T Sneaky, stealthier
• Choose which TCP flags to set -Syntax: nmap -scanflags FLAGS target -Example: nmap -scanflags SYNURG target --6: to scan IPv6 targets --A: does OS detection, version detection, script scanning, and traceroute -sW:
  • Same as sA but examines the Window size in the response
  • If RST with positive window size, then the port is open
  • -vand -reasonfor more verbosity
  • Scanrand, an alternative to nmap: https://manned.org/scanrand/b9a07a7a
  • nmap -script 'not intrusive' 192.168.231.2

Resources

• Nmap Resources
  • https://danielmiessler.com/study/nmap/
  • https://www.oreilly.com/library/view/network-security-assessment/9780596510305/ch04.html
  • https://nmap.org/book/man-briefoptions.html
  • https://linux.die.net/man/1/nmap
  • https://www.tutorialspoint.com/nmap-cheat-sheet
  • https://nmap.org/book/nmap-phases.html
  • https://nmap.org/book/port-scanning-options.html
  • https://nmap.org/book/scan-methods-udp-scan.html
  • https://nmap.org/book/man-briefoptions.html
  • https://nmap.org/book/host-discovery-techniques.html
  • https://nmap.org/book/host-discovery-controls.html
  • https://nmap.org/book/man-host-discovery.html

Scapy Resources

• https://www.mmu.ac.uk/media/mmuacuk/content/documents/school-of-computing-mathematics-and-digital-technology/blossom/PythonScriptingwithScapyLab.pdf
  • https://thepacketgeek.com/scapy/building-network-tools/part-06/
  • https://scapy.net/html.old/demo.html

  - A bit outdated, but has some useful tricks