Transcript 4.1.Port_Scanning

nmap
• Fyodor <[email protected]> (www.insecure.org)
• Network Mapper
• Port scanner
• OS fingerprinter
• Scans a particular target for all open ports
• Very invasive and very powerful
nmap Uses
• Network exploration tool and port scanner
– Security audits
– Network inventory
– Upgrade schedules
– Monitoring host/service uptime
Example nmap Scan
# nmap -A -T4 scanme.nmap.org playground
Starting nmap ( http://www.insecure.org/nmap/ )
Interesting ports on scanme.nmap.org (205.217.153.62):
(The 1663 ports scanned but not shown below are in state: filtered)
PORT
STATE SERVICE VERSION
22/tcp open
ssh
OpenSSH 3.9p1 (protocol 1.99)
53/tcp open
domain
70/tcp closed gopher
80/tcp open
http
Apache httpd 2.0.52 ((Fedora))
113/tcp closed auth
Device type: general purpose
Running: Linux 2.4.X|2.5.X|2.6.X
OS details: Linux 2.4.7 - 2.6.11, Linux 2.6.0 - 2.6.11
Uptime 33.908 days (since Thu Jul 21 03:38:03 2005)
Interesting ports on playground.nmap.org (192.168.0.40):
(The 1659 ports scanned but not shown below are in state: closed)
PORT
STATE SERVICE
VERSION
135/tcp open msrpc
Microsoft Windows RPC
139/tcp open netbios-ssn
389/tcp open ldap?
445/tcp open microsoft-ds Microsoft Windows XP microsoft-ds
1002/tcp open windows-icfw?
1025/tcp open msrpc
Microsoft Windows RPC
1720/tcp open H.323/Q.931
CompTek AquaGateKeeper
5800/tcp open vnc-http
RealVNC 4.0 (Resolution 400x250; VNC
TCP port: 5900)
5900/tcp open vnc
VNC (protocol 3.8)
MAC Address: 00:A0:CC:63:85:4B (Lite-on Communications)
Device type: general purpose
Running: Microsoft Windows NT/2K/XP
OS details: Microsoft Windows XP Pro RC1+ through final release
Service Info: OSs: Windows, Windows XP
Nmap finished: 2 IP addresses (2 hosts up) scanned in 88.392
seconds
nmap Options Summary and Syntax
# nmap
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
Can pass hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1254
-Nmap 3.95 ( http://www.insecure.org/nmap/ )
iL <inputfilename>: Input from list of hosts/networks
-iR <num hosts>: Choose random targets
--exclude <host1[,host2][,host3],...>: Exclude hosts/networks
--excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
-sL: List Scan - simply list targets to scan
-sP: Ping Scan - go no further than determining if host is online
-P0: Treat all hosts as online -- skip host discovery
-PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery
probes
-n/-R: Never do DNS resolution/Always resolve [default:
sometimes]
SCAN TECHNIQUES:
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
-sN/sF/sX: TCP Null, FIN, and Xmas scans
--scanflags <flags>: Customize TCP scan flags
-sI <zombie host[:probeport]>: Idlescan
-sO: IP protocol scan
-b <ftp relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
-p <port ranges>: Only scan specified ports
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080
-F: Fast - Scan only the ports listed in the nmap-services file)
-r: Scan ports consecutively - don't randomize
nmap Syntax (cont)
SERVICE/VERSION DETECTION:
-sV: Probe open ports to determine service/version info
--version_light: Limit to most likely probes for faster
identification
--version_all: Try every single probe for version detection
--version_trace: Show detailed version scan activity (for
debugging)
OS DETECTION:
-O: Enable OS detection
--osscan_limit: Limit OS detection to promising targets
--osscan_guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
-T[0-5]: Set timing template (higher is faster)
--min_hostgroup/max_hostgroup <msec>: Parallel host scan group
sizes
--min_parallelism/max_parallelism <msec>: Probe parallelization
--min_rtt_timeout/max_rtt_timeout/initial_rtt_timeout <msec>:
Specifies
probe round trip time.
--host_timeout <msec>: Give up on target after this long
--scan_delay/--max_scan_delay <msec>: Adjust delay between probes
FIREWALL/IDS EVASION AND SPOOFING:
-f; --mtu <val>: fragment packets (optionally w/given MTU)
-D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
-S <IP_Address>: Spoof source address
-e <iface>: Use specified interface
-g/--source_port <portnum>: Use given port number
--data_length <num>: Append random data to sent packets
--ttl <val>: Set IP time-to-live field
--spoof_mac <mac address/prefix/vendor name>: Spoof your MAC
address
nmap Syntax (cont)
OUTPUT:
-oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
and Grepable format, respectively, to the given filename.
-oA <basename>: Output in the three major formats at once
-v: Increase verbosity level (use twice for more effect)
-d[level]: Set or increase debugging level (Up to 9 is meaningful)
--packet_trace: Show all packets sent and received
--iflist: Print host interfaces and routes (for debugging)
--append_output: Append to rather than clobber specified output files
--resume <filename>: Resume an aborted scan
--stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
--webxml: Reference stylesheet from Insecure.Org for more portable XML
--no_stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
-6: Enable IPv6 scanning
-A: Enables OS detection and Version detection
--datadir <dirname>: Specify custom Nmap data file location
--send_eth/--send_ip: Send using raw ethernet frames or IP packets
--privileged: Assume that the user is fully privileged
-V: Print version number
-h: Print this help summary page.
EXAMPLES:
nmap -v -A scanme.nmap.org
nmap -v -sP 192.168.0.0/16 10.0.0.0/8
nmap -v -iR 10000 -P0 -p 80
SEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES
Target Specification
•
•
•
•
•
192.168.10.0/24 198.168.10.97/16
192.168.0-255.0/8 better 192.168.0-255.1-254
0-155.0-255.13.37
• Internet wide scan of all addresses ending in 13.37
scanme.nmap.org/8
Some available options:
–iL <input_file_name> (Addresses from list)
–iR <num hosts>
(Choose random targets)
–-excludefile <exclude_file>
Host Discovery
• Reduce the number of hosts on a network to be
scanned
• Specify how each host is to be identified as interesting
• Firewall considerations
• Default: Each requested IP address
• Attempt – TCP ACK to port 80
• Attempt – ICMP Echo Request
Host Discovery
•
Some available host discovery options:
– sL (List Scan)
– sP (Ping Scan)
– Use only pings to scan the IP addresses specified
– Prints all host responding to a ping
– P0 (No Ping)
– PS [port list] (TCP SYN Ping Scan)
– TCP SYN Packet sent to port 80 for every IP
– Else to every port in the list
– PA [port list] (TCP ACK Ping Scan)
– PU [port list] (UDP Ping Scan)
– PE; -PP; -PM
(ICMP Ping Scan)
– PR (ARP Ping Scan)
Port Scanning Basics
•
nmap scans more than 1660 ports
•
Most port scanners list ports as opened or closed
•
nmap recognizes 6 port states
– Open
• Accepting TCP connections or UDP packets
– Closed
• Host is up on the IP address
• Accessible but no app is listening
• Try later
Port Scanning Basics
•
nmap recognizes 6 port states (cont’d)
– Filtered
• No response from probe
» Firewall probably did a stealth drop
• Forces nmap to retry many times
– Unfiltered
• Port is accessible but not whether open or closed
• Used in mapping firewall rulesets
• Try Window scan, SYN scan, FIN scan
Port Scanning Basics
•
nmap recognizes 6 port states (cont’d)
– open|filtered
• When unable to determine whether port is open of filtered
– closed|filtered
• When unable to determine whether port is closed or filtered
Port Scanning Techniques
•
•
•
Only one scan technique can be used at a time
Usually must have root privilege
Some available scan techniques:
– sS (TCP SYN scan)
• Default
• Half-open scanning
– The open request is never completed
– sT (TCP connect() scan)
• A full TCP connection is attempted
• Firewalls tend to block incomplete TCP connect attempts
• The scan control is handed over to the OS.
Port Scanning Techniques
(cont’d)
•
Some additional available scan techniques:
– sU (UDP scan)
• Picks up services like DNS, SNMP, DHCP
• A UDP packet is sent with no data to all targeted ports
– ICMP: port unreachable --> port is closed
– ICMP: 3 code: 1,2,9,10 or 13 --> port is filtered
– Responds with a UDP packet --> port is open
– No response --> port is open|filtered
– sN (TCP null scan) no flags set
– sF (TCP FIN scan) only the FIN bit is set
– sX (Xmas scan) FIN, PSH, & URG bits are set
• RST packet received --> port is closed
• No response --> port is open|filtered
• ICMP unreachable (1,2,3,9,10,13) --> port is filtered
Port Scanning Techniques
(cont’d)
•
Some additional available scan techniques:
– sA (TCP ACK scan)
• No open ports are discovered
• Does determine if the firewall is statefull
• Unfiltered systems return a RST packet and labeled
unfiltered
• Noresponse of ICMP errors are labeled filtered
– sW (TCP window scan)
– sO (IP protocol scan)
• Cycles through all of the IP protocols
Service and Version Detection
•
Probes discovered ports
•
nmap-service-probes contains probes for querying options
–sV (Version detection)
OS Detection
•
Uses TCP and UDP scans
•
Compares to the nmap-os-fingerprints database
–o (Enable OS detection)
–A (Enable both OS and version detection)
Output
•
Piles of output
• Learn perl and grep
•
Many formats
–oN <filespec> (Normal optput)
–oX <filespec (XML output)
–v (Increase verbosity level)
Conclusion
• nmap
– Extremely powerful
– Extremely invasive
– Extremely obvious if you are not careful
– Extremely illegal if not done correctly