Your IP (Internet Protocol)
address is your unique ID on the internet. It's synonymous with your
home address. Anyone in the world can contact your computer through its
IP address, and send a retrieve information with it.
I'm sure at one time or another you've heard that hackers can hack your computer via your IP address. This is one of the reasons proxies and anonymity services exist, to protect people from learning your IP address. So how are hackers using just an address to get into your computer and make your life hell?
Open ports. Your computer runs services like media sharing on what are called ports. A port is just an opening that a service uses as a communications endpoint. There are 65,535 total allocated ports in TCP/UDP. To exploit a service on a port, a hacker would banner grab for the software and version. After they learn that information, they would search sites like Packet Storm for known exploits to run against the service.
Today's Null Byte is going to demonstrate a simple "port scan" on local computer using Nmap, and teach how a hacker would exploit these services, as well as how to guard ourselves against it. This will be done under Linux, but Nmap is available for all platforms. If you can't figure out how to install it in Windows with the GUI installer (yeah, right), follow along using Cygwin.
First, we must download Nmap, which is going to be our tool that we use for port scanning and information gathering:
wget http://nmap.org/dist/nmap-5.51.tar.bz2
Now, extract the archive:
tar -zxvf nmap-5.51.tar.bz2
Change to the newly made directory:
cd
This is the standard installation procedure:
./configure
make && sudo make install
Nmap should now be installed!
Start by mapping out your local network:
sudo nmap -sP 192.168.1.0/24
That should return a list of hosts that are up for a port scan!
sudo nmap -p 1-65535 -T4 -A -v
You should get something that looks like the following image:
As you can see, this target has MANY open ports. SSH piques my interest, so let's move on to banner grabbing to learn the software version or our choice of service.
telnet
From this, I would learn which software version the service is running, then see if I can find a way to exploit it.
Windows users, install Comodo firewall, it's incredible and uses a simple point and click installation, and will filter ports for you. It has great default settings and it is
I'm sure at one time or another you've heard that hackers can hack your computer via your IP address. This is one of the reasons proxies and anonymity services exist, to protect people from learning your IP address. So how are hackers using just an address to get into your computer and make your life hell?
Open ports. Your computer runs services like media sharing on what are called ports. A port is just an opening that a service uses as a communications endpoint. There are 65,535 total allocated ports in TCP/UDP. To exploit a service on a port, a hacker would banner grab for the software and version. After they learn that information, they would search sites like Packet Storm for known exploits to run against the service.
Today's Null Byte is going to demonstrate a simple "port scan" on local computer using Nmap, and teach how a hacker would exploit these services, as well as how to guard ourselves against it. This will be done under Linux, but Nmap is available for all platforms. If you can't figure out how to install it in Windows with the GUI installer (yeah, right), follow along using Cygwin.
Step 1 Download & Install Nmap
Bold words are commands that must be entered in a terminal emulator.First, we must download Nmap, which is going to be our tool that we use for port scanning and information gathering:
wget http://nmap.org/dist/nmap-5.51.tar.bz2
Now, extract the archive:
tar -zxvf nmap-5.51.tar.bz2
Change to the newly made directory:
cd
This is the standard installation procedure:
./configure
make && sudo make install
Nmap should now be installed!
Step 2 Scan for a Target
Let's scan a local computer. I'm going to use a website as an example, rather than a local computer. This is because my firewall is absolutely crazy, and filters out scans. Don't scan a remote computer with the intentions of doing bad deeds. This is for educational purposes only.Start by mapping out your local network:
sudo nmap -sP 192.168.1.0/24
That should return a list of hosts that are up for a port scan!
Step 3 Scan Your Individual Target
Out of the returned list of targets, pick one that you would like to scan for services. Let's do a full scan of all the TCP/UDP ports:sudo nmap -p 1-65535 -T4 -A -v
You should get something that looks like the following image:
As you can see, this target has MANY open ports. SSH piques my interest, so let's move on to banner grabbing to learn the software version or our choice of service.
Step 4 Banner Grabbing
For this, you can use the regular ol' telnet client. Telnet comes with Windows and most Linux distros:telnet
From this, I would learn which software version the service is running, then see if I can find a way to exploit it.
How Can I Protect Myself?
Luck for all of you lovely people, I recently made a tutorial on iptables, which will filter out unwanted connections. Also, disable any unnecessary programs that connect to the internet (remote administration, media sharing, etc).Windows users, install Comodo firewall, it's incredible and uses a simple point and click installation, and will filter ports for you. It has great default settings and it is
No comments:
Post a Comment