2KKUU7ita

Figure 12-7:
Using Nmap
to check
application
versions.
Chapter 12: Linux
of accountability! So, don’t forget to look for the simple stuff. When hacking
Linux, you can dig down deep into the kernel and do this and that to exploit
the system, but it’s usually the little things that get you.
Anonymous FTP is one of the most common vulnerabilities I find in Linux. If you
must run an anonymous FTP server, make sure it’s not sharing out sensitive
information to all of your internal network users, or worse, the entire world.
Tools
The following tools can perform more in-depth information gathering beyond
port scanning to enumerate your Linux systems and see what hackers see:
✓ Nmap can check for specific versions of the services loaded, as shown in
Figure 12-7. Simply run Nmap with the -sV command-line switch.
✓ Amap is similar to Nmap, but it has a couple of advantages:
• Amap is much faster for these types of scans.
• Amap can detect applications that are configured to run on nonstandard
ports, such as Apache running on port 6789 instead of its
default 80.
The output of an Amap scan of the local host (hence, the 127.0.0.1
address) is shown in Figure 12-8. Amap was run with the following
options to enumerate some commonly hacked ports:
• -1 makes the scan run faster.
• -b prints the responses in ASCII characters.
• -q skips reporting of closed ports.
• 21 probes the FTP control port.
• 22 probes the SSH port.
• 23 probes the telnet port.
• 80 probes the HTTP port.
235