Information gathering & reconnaissance

Passive (DNS? Social Media accounts),
Active

Vulnerabilities identification
advanced hackers use tools that produce less traffic

Exploitation 
-exploit: piece of software which takes advantage of vulnerabilities
–

Web archives: https://archive.org/
Whois
Search engines
Shodan
Metadata of documents
IP and port scanning

traceroute : 3 different packets send to the next IP. that idicates reachability

traceroute: request timed out in the middle of path: this host is unreacahble but other route exists, 

Port scanning:

An alternative approach is to send application-specific UDP packets, hoping to generate an application layer response. For example, sending a DNS query to port 53 will result in a response, if a DNS server is present. This method is much more reliable at identifying open ports. However, it is limited to scanning ports for which an application specific probe packet is available. Some tools (e.g., nmap) generally have probes for less than 20 UDP services, while some commercial tools (e.g., nessus) have as many as 70. In some cases, a service may be listening on the port, but configured not to respond to the particular probe packet.

UDP scanning is also possible, although there are technical challenges. UDP is a connectionless protocol so there is no equivalent to a TCP SYN packet. However, if a UDP packet is sent to a port that is not open, the system will respond with an ICMP port unreachable message. Most UDP port scanners use this scanning method, and use the absence of a response to infer that a port is open. However, if a port is blocked by a firewall, this method will falsely report that the port is open. If the port unreachable message is blocked, all ports will appear open. This method is also affected by ICMP rate limiting.^[4]

How can an intrusion detection system detect port scanning? Checking if the more ports from the same IP are being checked. Such as 5 different ports from 1 address within 1 minute. –> hacker will make this slower. such as 4 ports per minute and even slower if necessary. 

Vertical scanning: single IP for multiple ports
Horizontal: targeting specific services in a network, a group of ip for specific port

OS fingerprinteing: 

Large scale IP and port scans:
cover the full IP range
Avoid being blacklisted (honeypots)
-slow
-randomize the target IP

Vulnerability scanning
port scanner
network vulnerability scanners

Web app scanner
Database scanner
Types
remote with no privileges
remote with acces privileges
Agent

Nessus = random network scanner, possible to install an agent to target
portscan… 
NATIONNAL VULNERABILiTY DATABASE: nvd.nist.gov/home.cfm

Vulerability scanning / pentesting

Payload/exploit
payload misile, exploit = warhead
university network might block scanning
https://highon.coffee/blog/nmap-cheat-sheet/

VMWARE-suggestet connection to internale network only

nmap
Didn’t work at first, solution: https://networkengineering.stackexchange.com/questions/20265/nmap-failed-to-open-device-eth1
used –scan-delay 300ms for slowing down
–sU => UDP
-sS => TCP SYN

Nessus on KALI/PARROT
sudo /etc/init.d/nessusd start
Open localhost:8834

VirtualBox network with host
https://www.tecmint.com/network-between-guest-vm-and-host-virtualbox/

https://www.submarinecablemap.com