SecureState Powerpoint Tempate - ISSA: Pittsburgh...
-
Upload
nguyenthuan -
Category
Documents
-
view
217 -
download
4
Transcript of SecureState Powerpoint Tempate - ISSA: Pittsburgh...
NMAP BasicsMay 10, 2011
About Your Presenter
• Matt Neely
• Manager of the Profiling Team at SecureState
• Areas of Interest: convergence of physical and logical security, lock and lock picking, and all things wireless
• Co-host on the Security Justice podcast
• Co-founder of the Cleveland Chapter of TOOOL
2
About Your Presenter
• Gary McCully
• Consultant at SecureState
• CISSP, Security+, Network+, MCP
• Web Application Security Assessments, Penetration Tests, Physical Penetration Tests, War Dialing
• Formally worked for a Fortune 500 Company
3
Quick Intro
• Started as a port scanner
• Released 1997
• Gordon “Fyodor” Lyon
• Free
• Windows, Linux, Unix, Mac OS
What is NMAP
Features
• Port Scanner
• Version Detection
• OS Detection
• NMAP Scripting Engine
What is NMAP
IP
• Internet Protocol
• It is the address of a machine
• IPv4 is most common (10.0.0.1)
• IPv6 is on the horizon(1:1:1:1:1:1:1:1)
Network Basics
IP
Network Basics
10.0.0.1 10.0.0.2
FROM:10.0.0.1
TO:10.0.0.2
ICMP
• Internet Control Message Protocol
• Mostly used for troubleshooting
• Not Typically Used to Exchange Data
Network Basics
ICMP (Ping)
Network Basics
10.0.0.1 10.0.0.2
Are you home
ICMP (Ping)
Network Basics
10.0.0.1 10.0.0.2
Yes I am home
ICMP (Ping)
Network Basics
ICMP Type 8 (Echo Request)
ICMP Type 0 (Echo Reply)
TCP
• Transmission Control Protocol
• Connection Oriented
• Reliable
Network Basics
TCP
Network Basics
10.0.0.1 10.0.0.2
TCP
Network Basics
10.0.0.1 10.0.0.2
Please Sign For This Letter
Setting Up TCP Session
Network Basics
SYN
SYN, ACK
ACK
Tearing Down TCP Session
Network Basics
FIN/ACK
ACK
FIN/ACK
ACK
TCP
Network Basics
Source: http://learn-networking.com
UDP
• User Datagram Protocol
• Not Connection Oriented
• Not Reliable
Network Basics
UDP
Network Basics
10.0.0.1 10.0.0.2
UDP
Network Basics
10.0.0.1 10.0.0.2
Sending Data over UDP
Network Basics
Datagram
UDP
Network Basics
Source: http://learn-networking.com
Network Basics
Ports
• Ports are used to tell a server what service should read what incoming data
• Ports can either be TCP or UDP
• The standard mapping of port numbers with specific services is handled by IANA (Internet Assigned Numbers Authority)
Network Basics
Some Popular Ports
• TCP 21 (FTP) – Used for transferring files
• TCP 80 (HTTP) – Used to access Websites
• TCP 443 (HTTPS) – Used to access Websites using SSL
• TCP 3389 – Used for remote desktop
• UDP 123 – Used for time synchronization
Connecting to a Website
www.google.com (Web Browser forwards to port 80)
I understand your request here is the webpage
Network Basics
Web Server On Port 80
Basic Syntax
• nmap “Scan Type(s)” OPTIONS TARGETS
• Targets
– 10.0.0.1\16
– 10.0.1-255.1-255
– 10.0.0.1 10.0.0.2 10.0.0.3
– Can pull from a file
NMAP Basics
What is Host Discovery?
• Is Host Alive?
• By Default, First Step in Scanning
• Uses TCP, UDP and ICMP
Host Discovery
-PS Switch
• -PS (TCP SYN Ping)
• Just see if Host is Online
• Host online determined by response to SYN
• Syntax: nmap 192.168.17.130-135
• Syntax: nmap –PS8080 192.168.17.130-135
Host Discovery
TCP SYN to 80
Host Online
SYN to port 80
SYN ACK (Open Port)
RST
Host Discovery
TCP SYN to 80
Host Online
SYN to port 80
RST (Closed Port)
Host Discovery
TCP SYN to 80
SYN to port 80
Host Discovery
Host Discovery
-PS Switch
• Advantages:
– Looks just like normal TCP traffic
– Reliable for finding open ports
• Disadvantage
– Many Firewalls are configured to drop SYN packets destined for closed ports
Host Discovery
-PA Switch
• -PA (TCP ACK Ping)
• Just see if Host is Online
• Host online determined by response to ACK
• Syntax: nmap –PA8080 192.168.17.130-135
Host Discovery
-PA Switch (Important Note)
• A port will respond with RST
• RST is the response of a closed port
• RST is the response of a out of band ACK
• Basically tells which ports are not blocked
Host Discovery
-PA Switch
• Advantages:
– When firewalls are configured to drop SYN packets they may allow ACK packets
• Disadvantage
– If not responding to a SYN packet many firewalls will block this traffic because its viewed as invalid
Host Discovery
-sP Switch (NMAP Default)
• -sP (Ping Scan)
• Just see if Host is Online
• Default (ICMP and TCP to port 80)
• Syntax: nmap –sP 192.168.17.130-135
Host Discovery
-sP Switch
• Advantages:
–Quick
• Disadvantage
–May miss machines which are online
Host Discovery
-sL Switch
• -sL (List Scan)
• Simply Lists Targets to Scan
• No packets are sent to the hosts
• By default, DNS still resolves names
• Syntax: nmap -sL 192.168.17.130-135
Host Discovery
-sL Switch
• Advantage:
–Nice Sanity Check
• Disadvantage:
–Never checks to see if the host is online
Host Discovery
-PN Switch
• -PN (Skips Host Discovery Phase)
• Performs other scanning steps without determining if host is online
• Takes Longer
• Scans Hosts that may be otherwise missed
Host Discovery
-PN Switch
• Advantages:
–Port scans machines which host discovery would have missed
• Disadvantage
–Can take a very long time
Host Discovery
43
Host Discovery Lab
Connect to “Lab_Network”
192.168.10.2
Username: lab
Password: lab
Host Discovery Lab
nmap –PS25-30 192.168.10.10-20 (TCP SYN)
nmap –PA135,445 192.168.10.10-20 (TCP ACK)
nmap –sP 192.168.10.10-20 (Default Option)
nmap -sL 192.168.10.1/24(nmap list scan)
nmap –PN 192.168.10.13 (No Host Discovery)
Host Discovery Lab
What is Port Scanning?
• What ports are open
• The more ports the higher the attack
surface
• Quickly identify high risk services
Port Scanning
-sS Switch (NMAP Default)
• -sS (SYN Scan)
• Find what ports are open based on response to TCP SYN flag
• Ports are open, closed, or filtered
• Syntax: nmap –sS 192.168.17.130-135
• Syntax: nmap –sS –p21 192.168.17.130-135
Port Scanning
TCP SYN to 80
Port Open
SYN to port 80
SYN ACK
RST
Port Scanning
Port Scanning
TCP SYN to 80
Port Closed
SYN to port 80
RST
Port Scanning
Port Scanning
TCP SYN to 80
Port Filtered
SYN to port 80
Port Scanning
Port Scanning
-sS Switch
• Advantages:
– Looks just like normal TCP traffic
– Reliable for finding open ports
• Disadvantage:
– Many Firewalls are configured to drop SYN packets destined for closed ports
Port Scanning
-sA Switch
• -sA (TCP ACK Scan)
• Find what ports are not filtered based on response to TCP ACK flag
• Ports are unfiltered, or filtered
• Syntax: nmap –sA 192.168.17.130-135
• Syntax: nmap –sA –p21 192.168.17.130-135
Port Scanning
TCP ACK to 80
Port Unfiltered
ACK to port 80
RST
Port Scanning
Port Scanning
TCP ACK to 80
Port is Filtered
ACK to port 80
Host Discovery
Port Scanning
-sA Switch
• Advantages:
– When firewalls are configured to drop SYN packets they may allow ACK packets.
– Lets you know what ports are blocked by a firewall.
• Disadvantage:
– If not responding to a SYN packet, many firewalls will block this traffic because its viewed as invalid.
Port Scanning
61
TCP Port Scanning Lab
nmap –sS –p1-100 192.168.10.10-20 (SYN Scan 1-100)
nmap –sS –p135,445 192.168.10.10-20 (SYN Scan 135,445)
nmap –sS 192.168.10.10-20 (Default)
nmap -sA 192.168.10.1/24(ACK Scan)
nmap –sA –p1-100 192.168.10.10-20 (ACK SCAN 1-100)
Port Scanning Lab
-sU Switch
• -sU (UDP Scan)
• Slow compared to TCP Based Scans
• Find what ports are not open, open-filtered, closed or filtered
• Syntax: nmap –sU 192.168.17.130-135
• Syntax: nmap –sU –p161 192.168.17.130-135
Port Scanning
-sUV Switch
• -sUV (UDP Version Detection Scan)
• Higher Success rate of finding open ports
• Identifies versions of software through database of valid UDP probes
• In some cases, can take longer than -sU
Port Scanning
UDP to 161
Port Open
UDP port 161
Service Responds
Port Scanning
UDP to 161
Port Open|Filtered
UDP port 161
Port Scanning
No Response
UDP to 161
Port Closed
UDP port 161
ICMP port unreachable errorType 3, code 3
Port Scanning
UDP to 161
Port Filtered
UDP port 161
Other ICMP unreachable errorsType 3, code 1,2,9,10, or 13
Port Scanning
Port Scanning
Port Scanning
-sU Switch
• Advantage:
– Faster than -sUV
• Disadvantage:
–No Version Information
Port Scanning
-sUV Switch
• Advantages:
–Provides specific version information
– Identifies more open ports
• Disadvantage:
–Slower than –sU switch
Port Scanning
73
UDP Port Scanning Lab
nmap –sU –p53,123,161 192.168.10.10-20 (UDP Scan)
nmap –sUV –p53,123,161 192.168.10.10-20 (UDP Service Detection Scan)
nmap –sU –p50-55 192.168.10.10-20 (UDP Scan 120-130)
nmap –sUV –p50-55 192.168.10.10-20 (UDP Service Detection Scan 50-55)
Port Scanning Lab
What is Operating System Detection?
• Identifies what operating system is
running
• Does this by sending up to 15 TCP, UDP,
and ICMP probes
Operating System Detection
What is Operating System Detection?
• Matches packet attributes with a database
of packet attributes it has already
identified.
• Syntax: nmap –O 192.168.17.135
Operating System Detection
15 TCP, UDP, ICMP
Misc Responses
Operating System Detection
Attributes of response data compared to database of attributes
Operating System Detection
Example: Integrity of returned UDP data300 „C‟ Returned G otherwise I (Invalid)
Operating System Detection
What Service Version is Behind a Port?
• Uses response from a particular port to
find the version of the service.
• Syntax: nmap –sV 192.168.130.130-135
Service Detection
Service Detection
Service Detection
83
OS Identification and Service Detection Lab
nmap –O 192.168.10.16 (OS Identification)
nmap –O 192.168.10.13 (OS Identification)
nmap –sV 192.168.10.16 (Service Identification)
nmap –sV 192.168.10.13 (Service Identification)
nmap –sV –p1-100 192.168.10.13 (Service Identification Ports 1-100)
OS Identification and Service Detection Lab
-sC Switch
• Write and Share Scripts to automate networking tasks
• -sC (Runs NSE Default Scripts)
• Syntax: nmap –sC 192.168.17.130-135
• Syntax: nmap --scrpt ftp-anon.nse 192.168.17.130-135
NMAP Scripting Engine
NMAP Scripting Engine
NMAP Scripting Engine
NMAP Scripting Engine
Other NSE Scripts
• smb-check-vulns.nse
• smbv2-enabled.nse
• sslv2.nse
• ssl-enum-ciphers.nse
• ftp-anon.nse
• snmp-brute.nse
NMAP Scripting Engine
90
NMAP Scripting Engine Lab
nmap -sC 192.168.10.16 (Default Scripts)
nmap --script ftp-anon.nse 192.168.10.10-20 (Anonymous FTP)
nmap --script smb-check-vulns.nse 192.168.10.10-20 (SMB Vulns)
nmap -sU –p53,123,161 -sC 192.168.10.10-20 (UDP Default Scripts)
nmap -sU –p53,123,161 --script snmp-brute.nse 192.168.10.10-20 (SNMP Community Strings)
NMAP Scripting Engine
Thank you for your time!
Q U E S T I O N SA N S W E R S
92
Matt Neely Gary McCully