Passive (DNS? Social Media accounts),
Active<\/p>\n\n\n
Vulnerabilities identification
advanced hackers use tools that produce less traffic<\/p>\n\n\n
Exploitation
-exploit: piece of software which takes advantage of vulnerabilities
–<\/p>\n\n\n
Web archives: https:\/\/archive.org\/ traceroute : 3 different packets send to the next IP. that idicates reachability<\/p>\n\n\n traceroute: request timed out in the middle of An alternative approach is to send application-specific UDP packets, hoping to generate an application layer response. For example, sending a DNS query to port 53 will result in a response, if a DNS server is present. This method is much more reliable at identifying open ports. However, it is limited to scanning ports for which an application specific probe packet is available. Some tools (e.g., nmap<\/a>) generally have probes for less than 20 UDP services, while some commercial tools (e.g., nessus<\/a>) have as many as 70. In some cases, a service may be listening on the port, but configured not to respond to the particular probe packet.<\/p>\n\n\n UDP scanning is also possible, although there are technical challenges. UDP<\/a> is a connectionless<\/a> protocol so there is no equivalent to a TCP SYN packet. However, if a UDP packet is sent to a port that is not open, the system will respond with an ICMP<\/a> port unreachable message. Most UDP port scanners use this scanning method, and use the absence of a response to infer that a port is open. However, if a port is blocked by a firewall<\/a>, this method will falsely report that the port is open. If the port unreachable message is blocked, all ports will appear open. This method is also affected by ICMP rate limiting<\/a>.[4]<\/a><\/sup><\/p>\n\n\n How can an intrusion detection system detect port scanning?<\/strong> Checking if the more ports from the same IP are being checked. Such as 5 different ports from 1 address within 1 minute. – Vertical scanning: single IP for multiple ports OS fingerprinteing: <\/p>\n\n\n Vulnerability scanning Payload\/exploit VMWARE-suggestet connection to internale network only<\/p>\n\n\n nmap<\/strong><\/span> VirtualBox network with host<\/strong> <\/p>\n\n\n
Whois
Search engines
Shodan
Metadata of documents
IP and port
Port scanning:<\/strong><\/p>\n\n\n
Horizontal: targeting specific services in a network, a group of ip for specific port<\/p>\n\n\n
cover the full IP range
Avoid being blacklisted (honeypots)
-slow
-randomize the target IP<\/p>\n\n\n
<\/strong>port scanner
network vulnerability scanners<\/p>\n\n\n
Web app scanner
Database scanner
Types<\/span>
remote with no privileges
remote with acces privileges
Agent
Nessus = random network scanner, possible to install an agent to target
portscan…
NATIONNAL VULNERABILiTY DATABASE: nvd.nist.gov\/home.cfm<\/a>
<\/p>\n\n\n
<\/strong><\/p>\n\n\n
<\/strong>payload
university network might block scanning
https:\/\/highon.coffee\/blog\/nmap-cheat-sheet\/
<\/p>\n\n\n
Didn’t work at first, solution: https:\/\/networkengineering.stackexchange.com\/questions\/20265\/nmap-failed-to-open-device-eth1<\/a>
used –scan-delay 300ms for slowing down
–
-sS => TCP SYN<\/p>\n\n\n
Open localhost:8834<\/p>\n\n\n
https:\/\/www.tecmint.com\/network-between-guest-vm-and-host-virtualbox\/<\/a><\/span><\/p>\n\n\n