CASA ȘTIINȚEI
CASA ȘTIINȚEI este locul unde diverse subiecte sunt dezbătute și scrise.
|
Nou pe simpatie:
ramona23 la Simpatie.ro
 | Femeie
24 ani
Bucuresti
cauta Barbat
24 - 52 ani |
|
|
CASA ȘTIINȚEIInregistrareLoginPozeNu sunteti logat. Lista Forumurilor Pe Tematici
|
| #2 |
|
|
Create Custom Packets Using TCP Flags
Source: http://www.colasoft.com
Colasoft Packet Builder is a tool that allows you to create custom network packets and also
allows you to check the network against various attacks. It allows you to select a TCP packet
from the provided templates, and change the parameters in the decoder editor, hexadecimal
editor, or ASCII editor to create a packet. In addition to building packets, Colasoft Packet
Builder also supports saving packets to packet files and sending packets to the network.
1 network packet are 32bits
|
|
| |
|
| #3 |
|
|
Hping2/Hping3
Source: http://www.hping.org
HPing2/HPing3 is a command-line-oriented TCP/IP packet assembler/analyzer that sends ICMP
echo requests and supports TCP, UDP, ICMP, and raw-IP protocols. It has Traceroute mode, and
enables you to send files between covert channels. It has the ability to send custom TCP/IP
packets and display target replies like a ping program does with ICMP replies. It handles
fragmentation, arbitrary packets' body and size, and can be used in order to transfer
encapsulated files under supported protocols. It supports idle host scanning. IP spoofing and
n e tw o rk /h o s t scanning can be used to perform an anonymous probe for services.
An attacker studies the behavior of an idle host to gain information about the target such as the
services that the host offers, the ports supporting the services, and the operating system of the
target. This type of scan is a predecessor to either heavier probing or outright attacks.
Features:
The following are some of the features of HPing2/HPing3:
9 Determines whether the host is up even when the host blocks ICMP packets
e Advanced port scanning and test net performance using different protocols, packet
sizes, TOS, and Fragmentation
9 Manual path MTU discovery
9 Firewalk-like usage allows discovery of open ports behind firewalls
9 Remote OS fingerprinting
9 TCP/IP stack auditing
Windows + Linux
Comenzi:
ICMP ping
hping3 -1 10.0.0.25
ACK scan on port 80
hping3 -A 10.0.0.25 -p 80
UDP scan on port 80
hping3 -2 10.0.0.25 -p 80
Collecting initial sequence number
hping3 192.168.1.103 -Q -p 139 -s
Firewalls and time stamps
hping3 -S 72.14.207.99 -p 80 --tcptimestamp
SYN scan on port 50-60
hping3 -8 50-56 -S 10.0.0.25 -V
FIN, PUSH and URG scan on port 80
hping3 -F -p -U 10.0.0.25 -p 80
Scan entire subnet for live host
hping3 -1 10.0.1.x --rand-dest -I ethO
Intercept all traffic containing HTTP signature
hping3 9־ HTTP -I ethO
SYN flooding a victim
hping3 -S 192.168.1.1 -a 192.168.1.254 -p 22 --flood
|
|
| |
|
| #4 |
|
|
The following is the list of important reserved ports:
Name Port/Protocol Description
echo 7/tcp
echo 7/udp
discard 9/tcp sink null
discard 9/udp sink null
systat 11/tcp Users
daytime 13/tcp
daytime 13/udp
netstat 15/tcp
qotd 17/tcp Quote
chargen 19/tcp tty ts t source
chargen 19/udp tty ts t source
ftp-data 20/tcp ftp data transfer
ftp 21/tcp ftp command
ssh 22/tcp Secure Shell
telnet 23/tcp
smtp 25/tcp Mail
time 37/tcp Timeserver
time 37/udp Timeserver
rip 39/udp resource location
nicname 43/tcp who is
domain 53/tcp domain name server
domain 53/udp domain name server
sql*net 66/tcp Oracle SQL*net
sql*net 66/udp Oracle SQL*net
bootps 67/tcp bootp server
bootps 67/udp bootp server
bootpc 68/tcp bootp client
bootpc 68/udp bootp client
tftp 69/tcp Trivial File Transfer
tftp 69/udp Trivial File Transfer
gopher 70/tcp gopher server
finger 79/tcp Finger
www-http 80/tcp WWW
www-http 80/udp WWW
kerberos 88/tcp Kerberos
kerberos 88/udp Kerberos
P°P2 109/tcp PostOffice V.2
Pop3 110/tcp PostOffice V.3
sunrpc 111/tcp RPC 4.0 portmapper
sunrpc 111/udp RPC 4.0 portmapper
auth/ident 113/tcp Authentication Service
auth 113/udp Authentication Service
audionews 114/tcp Audio News Multicast
audionew s 114/udp Audio News Multicast
nntp 119/tcp Usenet Network News Transfer
nntp 119/udp Usenet Network News Transfer
ntp 123/tcp Network Time Protocol
ntp 123/udp Network Time Protocol
netbios-ns 137/tcp NETBIOS Name Service
netbios-ns 137/udp NETBIOS Name Service
netbios-dgm 138/tcp NETBIOS Datagram Service
netbios-dgm 138/udp NETBIOS Datagram Service
netbios-ssn 139/tcp NETBIOS Session Service
netbios-ssn 139/udp NETBIOS Session Service
imap 143/tcp Internet Message Access Protocol
imap 143/udp Internet Message Access Protocol
sql-net 150/tcp SQL-NET
sql-net 150/udp SQL-NET
sqlsrv 156/tcp SQL Service
sqlsrv 156/udp SQL Service
snmp 161/tcp
snmp 161/udp
snmp-trap 162/tcp
snmp-trap 162/udp
cmip-man 163/tcp CMIP/TCP Manager
cmip-man 163/udp CMIP
cmip-agent 164/tcp CMIP/TCP Agent
cmip-agent 164/udp CMIP
ire 194/tcp Internet Relay Chat
ire 194/udp Internet Relay Chat
at-rtmp 201/tcp AppleTalk Routing Maintenance
at-rtmp 201/udp AppleTalk Routing Maintenance
at-nbp 202/tcp AppleTalk Name Binding
at-nbp 202/udp AppleTalk Name Binding
at-3 203/tcp AppleTalk
at-3 203/udp AppleTalk
at-echo 204/tcp AppleTalk Echo
at-echo 204/udp AppleTalk Echo
at-5 205/tcp AppleTalk
at-5 205/udp AppleTalk
at-zis 206/tcp AppleTalk Zone Information
at-zis 206/udp AppleTalk Zone Information
at-7 207/tcp AppleTalk
at-7 207/udp AppleTalk
at-8 208/tcp AppleTalk
at-8 208/udp AppleTalk
ipx 213/tcp
ipx 213/udp
imap3 220/tcp Interactive Mail Access Protocol v3
imap3 220/udp Interactive Mail Access Protocol v3
aurp 387/tcp AppleTalk Update-Based Routing
aurp 387/udp AppleTalk Update-Based Routing
netware-ip 396/tcp Novell Netware over IP
netware-ip 396/udp Novell Netware over IP
rmt 411/tcp Remote mt
rmt 411/udp Remote mt
54erberos54-ds 445/tcp
54erberos54-ds 445/udp
isakmp 500/udp ISAKMP/IKE
fcp 510/tcp First Class Server
exec 512/tcp BSD rexecd(8)
comsat/biff 512/udp used by mail system to notify users
login 513/tcp BSD rlogind(8)
who 513/udp whod BSD rwhod(8)
shell 514/tcp cmd BSD rshd(8)
syslog 514/udp BSD syslogd(8)
printer 515/tcp spooler BSD lpd(8)
printer 515/udp Printer Spooler
talk 517/tcp BSD talkd(8)
talk 517/udp Talk
ntalk 518/udp New Talk (ntalk)
ntalk 518/udp SunOS talkd(8)
netnews 5 3 2 / tc p Readnews
uucp 540/tcp uucpd BSD uucpd(8)
uucp 540/udp uucpd BSD uucpd(8)
klogin 543/tcp Kerberos Login
klogin 543/udp Kerberos Login
kshell 544/tcp Kerberos Shell
kshell 544/udp Kerberos Shell
ekshell 545/tcp krcmd Kerberos encrypted remote shell -k fa ll
pcserver 600/tcp ECD Integrated PC board srvr
mount 635/udp NFS Mount Service
pcnfs 640/udp PC-NFS DOS Authentication
bwnfs 650/udp BW-NFS DOS Authentication
flexlm 744/tcp Flexible License Manager
flexlm 744/udp Flexible License Manager
56erberos-adm 749/tcp Kerberos Administration
56erberos-adm 749/udp Kerberos Administration
kerberos 750/tcp kdc Kerberos authentication—tcp
kerberos 750/udp Kerberos
56erberosmaster 751/udp Kerberos authentication
56erberosmaster 751/tcp Kerberos authentication
krb_prop 754/tcp Kerberos slave propagation
999/udp Applixware
socks 1080/tcp
socks 1080/udp
kpop 1109/tcp Pop with Kerberos
ms-sql-s 1433/tcp Microsoft SQL Server
ms-sql-s 1433/udp Microsoft SQL Server
ms-sql-m 1434/tcp Microsoft SQL Monitor
ms-sql-m 1434/udp Microsoft SQL Monitor
pptp 1723/tcp Pptp
pptp 1723/udp Pptp
nfs 2049/tcp Network File System
nfs 2049/udp Network File System
eklog in 2105/tcp Kerberos encrypted rlogin
rkinit 2108/tcp Kerberos remote kinit
kx 2111/tcp X over Kerberos
kauth 2120/tcp Remote kauth
lyskom 4894/tcp LysKOM (conference system)
sip 5060/tcp Session Initiation Protocol
sip 5060/udp Session Initiation Protocol
xll 6000-6063/tcp X Window System
xll 6000-6063/udp X Window System
ire 6667/tcp Internet Relay Chat
afs 7000-7009/udp
afs 7000-7009/udp
|
|
| |
|
| #6 |
|
|
Do not scan these IP Addresses:
129.51.0.0 Patrick Air Force Base
129.52.0.0 Wright-Patterson Air Force Base
129.53.0.0 - 129.53.255.255 66SPTG-SCB
129.54.0.0 Vandenberg Air Force Base, CA
129.92.0.0 Air Force Institute of Technology
129.99.0.0 NASA Ames Research Center
129.131.0.0 Naval Weapons Center
129.163.0.0 NASA/Johnson Space Center
129.164.0.0 NASA IVV
129.165.0.0 NASA Goddard Space Flight Center
129.167.0.0 NASA Marshall Space Flight Center
129.168.0.0 NASA Lewis Research Center
129.190.0.0 Naval Underwater Systems Center
129.198.0.0 Air Force Flight Test Center
129.209.0.0 Army Ballistics Research Laboratory
129.229.0.0 U.S. Army Corps of Engineers
129.251.0.0 United States Air Force Academy
RANGE 6 6.* - Army Information Systems Center
RANGE 7 7.*.*.* Defense Information Systems Agency, VA
RANGE 11 11.*.*.* D0D Intel In formation Systems, Defense Intelligence Agency, Washington DC
RANGE 21 21. - US Defense Information Systems Agency
RANGE 22 22.* - Defense Information Systems Agency
RANGE 24 24.198.*.*
RANGE 25 25.*.*.* Royal Signals and Radar Establishment, UK
RANGE 26 26.* - Defense Information Systems Agency
RANGE 29 29.* - Defense Information Systems Agency
RANGE 30 30.* - Defense Information Systems Agency
RANGE 49 49 . * - Joint Tactical Command
RANGE 50 50.* - Joint Tactical Command
RANGE 55 55.* - Army National Guard Bureau
RANGE 62 62.0.0.1 - 62.30.255.255 Do not scan!
RANGE 64
64.70.*.* Do not scan
64.2 24 .* Do not Scan
64.2 25 .* Do not scan
6 4.226.* Do not scan
RANGE 128
128.37.0.0 Army Yuma Proving Ground
128.38.0.0 Naval Surface Warfare Center
128.43.0.0 Defence Research Establishment-Ottawa
128.47.0.0 Army Communications Electronics Command
128.49.0.0 Naval Ocean Systems Center
128.50.0.0 Department of Defense
128.51.0.0 Department of Defense
128.56.0.0 U.S. Naval Academy
128.60.0.0 Naval Research Laboratory
128.63.0.0 Army Ballistics Research Laboratory
128.80.0.0 Army Communications Electronics Command
128.102.0.0 NASA Ames Research Center
128.149.0.0 NASA Headquarters
128.154.0.0 NASA Wallops Flight Facility
128.155.0.0 NASA Langley Research Center
128.156.0.0 NASA Lewis Network Control Center
128.157.0.0 NASA Johnson Space Center
128.159.0.0 NASA Ames Research Center
128.160.0.0 Naval Research Laboratory
128.161.0.0 NASA Ames Research Center
128.183.0.0 NASA Goddard Space Flight Center
128.202.0.0 50th Space Wing
128.216.0.0 MacDill Air Force Base
128.217.0.0 NASA Kennedy Space Center
128.236.0.0 U.S. Air Force Academy
129.23.0.0 Strategic Defense Initiative Organization
129.29.0.0 United States Military Academy
129.50.0.0 NASA Marshall Space Flight Center
RANGE 130
130.40.0.0 NASA Johnson Space Center
130.90.0.0 Mather Air Force Base
130.109.0.0 Naval Coastal Systems Center
130.124.0.0 Honeywell Defense Systems Group
130.165.0.0 U.S.Army Corps of Engineers
130.167.0.0 NASA Headquarters
RANGE 131
131.6.0.0 Langley Air Force Base
131.10.0.0 Barksdale Air Force Base
131.17.0.0 Sheppard Air Force Bas
131.21.0.0 Hahn Air Base
31.32.0.0 37 Communications Squadron
131.35.0.0 Fairchild Air Force Base
131.36.0.0 Yokota Air Base
131.37.0.0 Elmendorf Air Force Base
131.38.0.0 Hickam Air Force Base
131.39.0.0 354CS/SCSN
RANGE 132
132.3.0.0 Williams Air Force Base
132.5.0.0 - 132.5.255.255 49th Fighter Wing
132.6.0.0 Ankara Air Station
132.7.0.0 - 132.7.255.255 SSG/SINO
132.9.0.0 28th Bomb Wing
132.10.0.0 319 Comm Sq
132.11.0.0 Hellenikon Air Base
132.12.0.0 Myrtle Beach Air Force Base
132.13.0.0 Bentwa ters Royal Air Force Base
132.14.0.0 Air Force Concentrator Network
132.15.0.0 Kadena Air Base
132.16.0.0 Kunsan Air Base
132.17.0.0 Lindsey Air Station
132.18.0.0 McGuire Air Force Base
132.19.0.0 100CS (NET-MILDENHALL)
132.20.0.0 35th Communications Squadron
132.21.0.0 Plattsburgh Air Force Base
132.21.0.0 Plattsburgh Air Force Base
132.22.0.0 23 Communications Sq
132.24.0.0 Dover Air Force Base
132.25.0.0 786 CS/SCBM
132.27.0.0 - 132.27.255.255 39CS/SCBBN
132.28.0.0 14TH COMMUNICATION SQUADRON
132.30.0.0 Lajes Air Force Base
132.31.0.0 Loring Air Force Base
132.33.0.0 60CS/SCSNM
132.34.0.0 Cannon Air Force Base
132.35.0.0 Altus Air Force Base
132.37.0.0 75 ABW
132.38.0.0 Goodfellow AFB
132.39.0.0 K.l. Sawyer Air Force Base
IP ADDRESSES YOU SHOULD NOT SCAN.txt
|
|
| |
|
| #7 |
|
|
Banner Grabbing:
ID Serve
Source: www.grc.com
Netcraft
Source: http://toolbar.netcraft.com
Netcat
Source: http://netcat.sourceforge.net
Telnet
COUNTERMEASURES:
Display false banners to misguide the attackers
Turn off unnecessary services on the network host to limit the information disclosure
IIS users can use these tools to disable or change banner information
~ IIS Lockdown Tool (http://microsoft.com)
~ ServerMask (http://www.port80software.com)
Apache 2.x with mod_headers module - use a directive in httpd.conf file to change banner information Header set Server "New Server Name"
Alternatively, change the ServerSignature line to ServerSignature Off in httpd.conf file
|
|
| |
|
