2KKUU7ita

Chapter 12: Linux
A tool such as QualysGuard can perform the majority of the security
testing needed to find flaws in Linux. Another popular commercial alternative
is Rapid7’s Nexpose (www.rapid7.com/vulnerabilityscanner.jsp).
✓ Nessus (www.nessus.org) for OS fingerprinting, port scanning, and vulnerability
testing
✓ THC-Amap (www.thc.org/thc-amap) for application version mapping
Hundreds if not thousands of other Linux hacking and testing tools are available
on such sites as SourceForge.net (http://sourceforge.net) and
freecode.com (http://freecode.com). The key is to find a set of tools —
preferably as few as possible — that can do the job that you need to do and
that you feel comfortable working with.
Gathering Information about
Your Linux Vulnerabilities
You can scan your Linux-based systems and gather information from both
outside (if the system is a publicly-accessible host) and inside your network.
That way, you can see what the bad guys see from both directions.
System scanning
Linux services — called daemons — are the programs that run on a system
and serve up various services and applications for users.
✓ Internet services, such as the Apache web server (httpd), telnet (telnetd),
and FTP (ftpd), often give away too much information about the system,
including software versions, internal IP addresses, and usernames.
This information can allow hackers to exploit a known weakness in the
system.
✓ TCP and UDP small services, such as echo, daytime, and chargen, are
often enabled by default and don’t need to be.
The vulnerabilities inherent in your Linux systems depend on what services
are running. You can perform basic port scans to glean information about
what’s running.
The NetScanTools Pro results in Figure 12-1 show many potentially vulnerable
services on this Linux system, including the confirmed services of SSH, HTTP,
and HTTPS.
229