Scanning

Network tracing

discover routes that packets take between systems
- allows constructing network diagrams
sends ICMP/UDP/TCP packets with varying TTL
requires routers to properly report dropped packets
- often disabled for performance/security reasons
traceroute useful tool
web-based tools also available

important IPv4 headers
- TTL: time to live
  - tells us how many hops a package needed to make
- source and destination IP
IPv6 properties
- 128 bit addresses
- simpler than IPv4

Internet Control Message Protocol
used for diagnostic purposes
- error reporting
- router discovery
- redirect messages
ping sweeps
traceroute
redirect messages expose network topology
ICMP address mask requests: determine subnet used by target host

port scanner and all-in toolkit
important tool when performing scanning
TCP port scanning
- connect scan
  - complete 3-way handshake
  - can run without root
  - not stealthy (connections can be logged)
  - doesn't use nmap to craft packets
- syn scan/half-open scan
  - runs as root
  - only send initial SYN and listen for response
  - detectable by firewall/NIDS
- ACK scan
- playing with control bits
  - FIN scan: FIN bit of all packets set
  - NULL scan: all bits set to 0
  - Xmas tree scan: FIN, PSH, URG set
  - Maimon scan: FIN and ACK set
UDP scanning
- scans specific UDP ports
- sends protocol-specific messages to well-known ports
firewall spotting
- generate packets with invalid TCP or UDP checksum
- targets will drop these
- firewalls don't always check checksum and will send a RESET/ICMP port unreachable instead
- allows detecting firewalls
- can also look for varying TTL values
  - TTL on firewall RESET message will be higher as the firewall is closer
full support for IPv6
OS fingerprinting
- detect quirks of protocol behaviors for OS versions
- active: send special packets to detect behavior
- passive: observe patterns of network traffic (stealthy but less accurate)
version scanning
- detect versions of services running on host
- send packets to specific service types that reveal version information
- useful for crafting exploits

automated monitoring
- running nmap using cron can reveal changes in network
- tools like masscan well suited for this
- monitoring web applications also important
  - HTTPScreenshot: take screenshots of websites
  - EyeWitness: screenshots of webpages, RDP and VNC servers, tries to login with default credentials
scanning cloud infrastructure
- lots of cloud usage
- companies often don't configure cloud service correctly
- very large IP addresses to search through
- use tools like Shodan or Censys
  - automatically perform scans that can be accessed online
  - allow monitoring target without direct contact
badly configured S3
- buckets that allow writing without authorisation
- subdomain takeover allows attacker to take over bucket URL
packet crafting
- sometimes very specific/controlled packets are required
- tools like Scapy allow crafting packets for various protocols
  - Python tool
  - provides REPL to forge, send and receive packets

process used to identify security weaknesses and vulnerabilities in a system, network or application
- involves using automated tools to scan systems for known vulnerabilities and weaknesses
- critical component of a robust cybersecurity strategy
- automated scanning allows detecting problems before they're possibly exploited
key aspects
- goal: identify and address security flaws before they're exploited
- scan types
  - network scanning
  - web app scanning
  - host scanning
- process
  1. discovery: identify all relevant devices, systems and applications
  2. scanning: use automated tools to scan targets for known vulnerabilities
  3. analysis: analyse results for vulnerabilities and prioritize them
  4. reporting: generate report detailing results
- frequency: how often to perform scans
- compliance: many regulatory standards require regular vulnerability scanning

Nmap Scripting Engine (NSE)
- allows extending nmap with Lua scripts
- greatly broadens scope of nmap
- nmap comes with a ton of ready-to-use scripts
- perfect for vulnerability scanning
Tenable Nessus
- modern vulnerability scanner
- can detect tens of thousands of vulnerabilities
- free for personal use
OpenVAS
- open-source vulnerability scanner
- less expansive than Nessus

process of retrieving list of usernames for system
numerous methods
- public sources of information (websites, emails...)
- pentest: ask for list of users (grey box)
Linux
- local: /etc/passwd
- remotely
  - finger @IP
  - query NIS or LDAP server if present
  - enum4linux tool
Windows
- list users using SMB session
  - possible anonymously on older versions of Windows
  - if single user is known, listing all users is possible