2KKUU7ita

136
Part III: Hacking Network Hosts
Figure 8-6:
Information
gathered
about
Exchange
2003 via
telnet.
telnet
You can telnet to hosts on the default telnet port (TCP port 23) to see
whether you’re presented with a login prompt or any other information. Just
enter the following line at the command prompt in Windows or UNIX:
telnet ip_address
You can telnet to other commonly used ports with these commands:
✓ SMTP: telnet ip_address 25
✓ HTTP: telnet ip_address 80
✓ POP3: telnet ip_address 110
Figure 8-6 shows specific version information about an Exchange 2003 server
when telnetting to it on port 25. For help with telnet, simply enter telnet /?
or telnet help for specific guidance on using the program.
Countermeasures against banner-grabbing attacks
The following steps can reduce the chance of banner-grabbing attacks:
✓ If there isn’t a business need for services that offer banner information,
disable those unused services on the network host.
✓ If there isn’t a business need for the default banners, or if you can customize
the banners, configure the network host’s application or operating
system to either disable the banners or remove information from the
banners that could give an attacker a leg up. Check with your specific
vendor for information on how to do this.
If you can customize your banners, check with your lawyer about adding a
warning banner. It won’t stop banner grabbing but will show would-be intruders
that the system is private and monitored (assuming it truly is). A warning
banner may also help reduce your business liability in the event of a security
breach. Here’s an example: