Hack Security Pro.pdf - Index of

G) Applicative Fingerprinting
Even if it is possible to de-activate some services' banners, each service implementation has its own
characteristics (error codes ...). By comparing the answers received to a database of standard service
digital signatures, it is possible to determine the version. This technique can be used with the -A option
of nmap (only on Linux):
Laptop:/home/xdream# nmap -A 192.168.124.20
Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2004-05-19 00:14 CEST
Interesting ports on Dantes (192.168.124.20):
(The 1648 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE VERSION
21/tcp open ftp vsFTPd 1.2.1
22/tcp open ssh OpenSSH 3.4p1 (protocol 2.0)
80/tcp open http Apache httpd 1.3.29 ((Debian GNU/Linux))
111/tcp open rpcbind 2 (rpc #100000)
139/tcp open netbios-ssn Samba smbd (workgroup: DgSWORKGROUP)
443/tcp open ssl/http Apache httpd 1.3.29 (Ben-SSL/1.53 (Debian GNU/Linux)
PHP/4.3.4)
864/tcp open ypserv 1-2 (rpc #100004)
875/tcp open ypbind 1-2 (rpc #100007)
899/tcp open mountd 1-2 (rpc #100005)
1024/tcp open status 1 (rpc #100024)
2049/tcp open nfs 2 (rpc #100003)
H) Listing of firewalling rules
Errors in implemented filtering rules can result in an intruder establishing contact in a trivial way with
Internet systems.
Filtering by trust relation:
The majority of filtering rules are implemented according to authorisations given to certain specific
machines. You can try to determine the trusted IP addresses, if these do exist, by using idle host
scanning techniques we will study later on in this training course.
Filtering by protocol:
Some protocols are not forbidden, such as ICMP, UDP ... They can represent a danger because they
can encapsulate communications with backdoors installed by the hacker. These techniques are
designated by the term covert channel. You can determine which protocols are authorised thanks to
nmap's -sO option:
The Hackademy DMP -38/209- SYSDREAM