Sybex CEH Certified Ethical Hacker Version 8 Study Guide

106 Chapter 5 ■ Scanning Networks
Vulnerability Scan A vulnerability scan is used to identify weaknesses or vulnerabilities
on a target system. This type of scan is quite commonly done as a proactive measure with
the goal of catching problems internally before an attacker is able to locate those same vulnerabilities
and act on them.
Checking for Live Systems
How do you check for live systems in a targeted environment? There are plenty of ways to
accomplish this. Some common ways to perform these types of scans are:
■ Wardialing
■ Wardriving
■ Pinging
■ Port scanning
Each of these techniques, along with others we will explore, offers something that the
others don’t, or at least don’t offer in the same way. Once you understand these differences,
you should have a much better idea of how to deploy these methods in a penetration test.
When looking at these methods, keep in mind that you should be paying
attention to the areas in which each is strong and those areas in which they
are weak. Deploying the wrong one could easily waste time as well as alert
the system owner to your presence, thus giving them time to react to your
attack.
Wardialing
The first type of scan is an old but useful one known as wardialing. Wardialing has existed
in an almost unchanged state since the mid-1980s and has stayed around so long because
it has proven to be a useful information-gathering tool. In practice, wardialing is extremely
simple compared to our other forms of scanning in that it simply dials a block of phone
numbers using a standard modem to locate systems that also have a modem attached
and accept connections. On the surface, this type of technique seems to be the digital
equivalent of the dinosaur, but don’t let that fool you—the technique is still very useful.
Understand that modems are still used for a number of reasons, including the low cost
of the technology, ease of use, and the availability of phone lines, which are pretty much
everywhere. Modems are still so commonly used that an attacker can easily dial a block of
phone numbers in just about any town and locate a good number of computers still using
dial-up to attach to the outside world.