2KKUU7ita

Chapter 8: Network Infrastructure
✓ Getif (www.wtcs.org/snmp4tpc/getif.htm) for SNMP enumeration
✓ Nmap (http://nmap.org) — or NMapWin (http://sourceforge.
net/projects/nmapwin), the happy-clicky-GUI front end to Nmap —
for host-port probing and operating system fingerprinting
✓ WildPackets’ OmniPeek (www.wildpackets.com/products/
omnipeek_network_analyzer) for network analysis
✓ Wireshark (www.wireshark.org) for network analysis
Vulnerability assessment
These vulnerability assessment tools allow you to test your network hosts
for various known vulnerabilities as well as potential configuration issues
that could lead to security exploits:
✓ GFI LANguard (www.gfi.com/lannetscan) for port scanning and vulnerability
testing
✓ Nexpose (www.rapid7.com/vulnerability-scanner.jsp), an allin-one
tool for in-depth vulnerability testing
✓ QualysGuard (www.qualys.com), a great all-in-one tool for in-depth
vulnerability testing
Scanning, Poking, and
Prodding the Network
Performing the ethical hacks described in the following sections on your network
infrastructure involves following basic hacking steps:
1. Gather information and map your network.
2. Scan your systems to see which ones are available.
3. Determine what’s running on the systems discovered.
4. Attempt to penetrate the systems discovered if you choose to.
Every network card driver and implementation of TCP/IP in most operating
systems, including Windows and Linux, and even in your firewalls and routers,
has quirks that result in different behaviors when scanning, poking, and prodding
your systems. This can result in different responses from your various
systems, including everything from false-positive findings to denial of service
(DoS) conditions. Refer to your administrator guides or vendor websites for
127