Hack Security Pro.pdf - Index of

To dialogue with C and to force it to reveal its id, two solutions can be imagined:
1) We try to initialize a connection on an active port of machine C by sending packets with the Syn flag
activated (this is very important, otherwise the machine will not answer). The machine will then
answer by sending packets with activated Syn and Ack flags.
2) We send packets to a closed port (there is no need to activate a flag). The machine will believe it is
an error and will send response packets with Ack and Reset flags activated.
Which is the best method? Both actually work very well, however the first one presents two major
disadvantages: if we want to follow the same logic we have had since the beginning, choosing a
machine C with even only one open port is ridiculous (in this case it is a server and the risks of
establishing a connection with anyone other than A are high). Also, sending a flood of connection
requests to C on a specific port could be unfavorably interpreted by a watchful administrator who
checks his logs (he could believe it is a syn flooding or a syn scanning).
We are therefore going to forge packets according to the second method, and to do this we will use
hping. Hping, just like Nemesis, is a tcp/ip packet forger. Why choose hping? Because hping has an
interesting function that allows it to log on console of answers to packets emitted via hping.
All that has to be done is to type in the following command:
hping -r
(for example: hping 192.168.1.1 -r)
Here, -r corresponds to the option showing the id increment as emissions are taking place (this option
will be used only for clarification purposes).
Here is a capture done with Ethereal of packets sent and received successively between machines A
and C.
1 st packet: In the capture, machine A has IP 192.168.1.2 and machine C has IP 192.168.1.1.
The Hackademy DMP -84/209- SYSDREAM