Detecting Firewalls Using Port Scanning

We can detect or even guess the firewalls used in the target because of the unique ports they use.
for Eg:
CheckPoint listens on the TCP ports 256,257,258,259
Microsoft proxy Server listens to TCP ports 1080 to 1745

Easiest solution to firewall enumeration is to use an ACL (Access Control List)

access-list 101 deny tcp any any eq  256 log ( here 256 is the port number on which the firewall is running)

What is the meaning of above code..?
This code prevents all port scanning techniques on the port 256 and also logs and records it which can be viewed later by the admin.

TOOLS:

scanlogd- An IDS that detects TCP scan
BlackICE Defender -Firewall detecting port scans
Abacus Port Sentry -This is a very good tool.It detects port scans and responds to it.
NukeNabber
snort -IDS and Packet sniffer
Etherpeek

Online Tools- AFCEH IMPORTANT

Port Scanning
 link1

Traceroute
link 1



File Size Converter

link 1


DNS Lookup
link 1

subnet calculator
link 1



Base64 conversion
 link 1

WHOIS
 link 1


Hash Calculator

link 1


IP Convertor
link 1



MISC TOOLS IN ONE PAGE

Scanline Tool- Nice Port Scanner

Scanline is a very good tool used by the hackers for port scanning.We can also use this for daemon banner grabbing and ICMP scanning.The main highlight of this tool is that it is very quick and accurate.This is a windows based command line tool
Usage:
-? - Shows this help text
-b - Get port banners
-c - Timeout for TCP and UDP attempts (ms). Default is 4000
-d - Delay between scans (ms). Default is 0
-f - Read IPs from file. Use "stdin" for stdin
-g - Bind to given local port
-h - Hide results for systems with no open ports
-i - For pinging use ICMP Timestamp Requests in addition to Echo Requests
-j - Don't output "-----..." separator between IPs
-l - Read TCP ports from file
-L - Read UDP ports from file
-m - Bind to given local interface IP
-n - No port scanning - only pinging (unless you use -p)
-o - Output file (overwrite)
-O - Output file (append)
-p - Do not ping hosts before scanning
-q - Timeout for pings (ms). Default is 2000
-r - Resolve IP addresses to hostnames
-s - Output in comma separated format (csv)
-t - TCP port(s) to scan (a comma separated list of ports/ranges)
-T - Use internal list of TCP ports
-u - UDP port(s) to scan (a comma separated list of ports/ranges)
-U - Use internal list of UDP ports
-v - Verbose mode
-z - Randomize IP and port scan order
Example: sl -bht 80,100-200,443 10.0.0.1-200
This example would scan TCP ports 80, 100, 101...200 and 443 on all IP
addresses from 10.0.0.1 to 10.0.1.200 inclusive, grabbing banners
from those ports and hiding hosts that had no open ports.
------------------------------------------------------------------------------
Detailed option descriptions
----------------------------
-?
Shows the usage of the program as in the above text.
-b
Attempts to read the responses from the scanned ports and displays the
results. If any part of the read text contains non-printable characters these
will be replaced with spaces and multiple spaces reduced to single spaces. A
maximum of 2 lines are displayed.
-c
This is the connection timeout value for TCP ports and also the timeout value
to wait for responses from UDP ports. For TCP scans, if no connection to the
current port has been made to the remote host after this amount of time then
it is assumed that there is no open port. For UDP scans, if no data response
has been received from the remote host in the given time period or, with the
case of the "extended" UDP scanning modes no ICMP port unreachable messages
have been received after this time has elapsed it is assumed that the port is
active.
-d
Specifies a delay (in milliseconds) between each port scanned. This applies to
all sections of the scan - ICMP, TCP and UDP. Use this option to perform a
"drip" scan so as to help avoid detection by an IDS or if you have a slow
network connection such as with a modem.
-f
Reads IP addresses from the given file. You can successfully use the output
file from a previous ScanLine session as input for this switch. However, any
text file that contains valid IP addresses or address ranges can be used.
Duplicates are removed before scanning.
-g
Binds the local IP endpoint to a given port number. This is used for "source
port" scanning and can sometimes successfully bypass firewall rules that
allow packets through with low numbered source ports (53 and 88 for example).
-h
Hides output from systems that have no open ports. Without this option all
discovered live hosts will be displayed regardless of whether they had any
open ports that were scanned for. Use this option to trim excess unwanted
output.
-i
When looking for "live" hosts, ScanLine will normally use a standard ICMP Echo
Request packet. Providing this option will cause ScanLine to use an additional
host discovery pass using ICMP Timestamp Requests instead of Echo Requests.
Some systems will block Echo Requests but will respond to Timestamp Requests.
-j
The output from ScanLine is normally made clearer by separating the information
obtained from each IP address with a line of dashes. Use this option if you
don't want the line separators to appear in the output.
-l
Specifies a TCP port list text file to read ports from. Ports in the file
are in lines in the same format as specified on the command line i.e. 79,80-88.
-L
Specifies a UDP port list text file to read ports from. Ports in the file
are in lines in the same format as specified on the command line i.e. 137,80-88.
-m
Binds the local IP endpoint to a given IP interface. If your system has
multiple network cards or interfaces you can tell ScanLine to use a
preferred IP address to bind to. Note that you can only specify the IP
address of an active interface on your own system - you can't "spoof"
packets by using an arbitrary IP address here.
-n
Specifies that no port scanning will take place. If all you want to do is
discover live systems (ones that respond to ICMP) use this option. You can
also specify -p (no pinging) in conjunction with -n if for example you simply
wanted to resolve a list of IP addresses into hostnames.
-o
Specifies a file that the output from the program is sent to. Note that output
will also appear on the screen at the same time. If the file already exists
it will be overwritten. If you want to append output to the file without
overwriting it then use the "-O" option.
-O
Same as -o but appends the program output to the text file instead of
overwriting it.
-p
Don't "ping" each host before scanning. ScanLine will make no attempt to discover
live hosts for scanning if this is used - it will simply go ahead and port
scan all hosts regardless if they exist on the network or not. You could use
this option to scan for systems that had certain ports open but were blocking
ICMP packets.
-q
Specifies the maximum time that the program waits for a response from a ping.
If no ping reply is received after this amount of the time the remote host
will be regarded as "dead" and won't be scanned.
-r
Resolve IP addresses to hostnames. An attempt will be made to resolve each
live IP address into a hostname. Even though the scan process in ScanLine is
single threaded, up to 8 threads will be used for resolving hostnames if
this option is specified
-s
Output in csv format. CSV format is usually used when you want to import a
file into a spreadsheet program for further analysis. The format of the
line that ScanLine outputs when this option is used is
,,,,
,,.
No port banners are included in this output and if -b is specified
on the command line it will be ignored when used in conjunction with -s.
-t
TCP port numbers to scan. The port numbers can be single numbers separated by
commas and/or port ranges separated by the "-" character. For example
sl -t 60,70,80-100 10.1.2.3
would scan TCP ports 60, 70, and 80 through 100 inclusive. No spaces are
allowed between any of the numbers or ranges.
-T
Use the built-in TCP port list. If you don't explicitly specify any ports
to scan on the command line, ScanLine will go ahead and use its built in list
of ports. If you DO specify ports and you want to also include ScanLine's
internal list of TCP ports use -T. For example, if you wanted to scan for UDP
port 137 together will all built-in TCP ports you'd specify
sl 10.1.2.3 -u 137 -T
-u
UDP port numbers to scan. The port numbers can be single numbers separated by
commas and/or port ranges separated by the "-" character. For example
sl -u 60,70,80-100 10.1.2.3

would scan UDP ports 60, 70, and 80 through 100 inclusive. No spaces are
allowed between any of the numbers or ranges. This UDP scanning option uses
known data probes for many common UDP services and are designed to produce
a response from the scanned system. This ensures total accuracy of the UDP
scanning; for the remote system to respond with a UDP packet the port that
was scanned must by definition be open.

Under normal circumstances sending a UDP packet to a closed port will cause
an ICMP Destination Port Unreachable message to be sent back. I say "under
normal circumstances" because often a system will be filtered in some way
such that it never responds in this fashion. This would lead to lots of false
positive open ports. So what ScanLine does with it's UDP scanning is to first
send a UDP probe to a "known closed port" on the target to see if it actually
responds with an ICMP message. For this purpose ScanLine uses UDP port 1. If
we do get an ICMP response the program will then assume that all further ports
scanned that do NOT generate an ICMP message are open.

***** Windows 95/98/ME systems do not register ICMP destination port
***** unreachable messages via Winsock due to subtle differences in the way
***** Winsock is implemented when compared to Windows 2000 and XP. Thus
***** you will never see any open UDP ports detected using this technique
***** on these operating systems.
-U
Use the built-in UDP port list. If you don't explicitly specify any ports
to scan on the command line, ScanLine will go ahead and use its built in list
of ports. If you DO specify ports and you want to also include ScanLine's
internal list of UDP ports use -U. For example, if you wanted to scan for TCP
port 80 together will all built-in UDP ports you'd specify
sl 10.1.2.3 -t 80 -U

-v
Verbose mode. Additional information will be shown if you set the program to
verbose mode.

-z
Use this to randomize the order that IP addresses and ports will be scanned
in. Normally ScanLine will scan the provided IPs and ports in numerical order.
By using the "-r" option the IPs and port numbers will be "shuffled" into a
random ordering. This can help to some extent in avoiding detection by
intrusion detection systems.

Default Port Lists
------------------
The internal port lists used in ScanLine are as follows:
UDP ports
7 9 11 53 67-69 111 123 135 137 138 161 191 192 256 260 407 445 500 514 520
1009 1024 1025 1027 1028 1030 1033 1034 1035 1037 1041 1058 1060 1091 1352
1434 1645 1646 1812 1813 1900 1978 2002 2049 2140 2161 2301 2365 2493 2631
2967 3179 3327 3456 4045 4156 4296 4469 4802 5631 5632 11487 31337
32768-32790 43981
TCP ports
7 9 11 13 15 19 21 22 23 25 43 49 53 66-68 70 79 80 81 88 89 98 109 110 111
113 118 119 135 139 143 150 156 179 256-259 264 389 396 427 443 445 457 465
512-515 524 540 563 587 593 636 691 799 900-901 1024-1031 1080 1100 1214
1243 1313 1352 1433 1494 1498 1521 1524-1525 1529 1541 1542 1720 1723 1745
1755 1813 1944 2000 2001 2003 2049 2080 2140 2301 2447 2766 2779 2869 2998
3128 3268 3300 3306 3372 3389 4000 4001 4002 4045 4321 4444 4665 4899 5000
5222 5556 5631 5632 5678 5800 5801 5802 5900 5901 6000 6112 6346 6347 6588
6666-6667 7000 7001 7002 7070 7100 7777 7947 8000 8001 8010 8080-8081 8100
8383 8888 9090 10000 12345 20034 27374 30821 32768-32790
IP address and hostnames
------------------------
Any item on the command line that is not associated with a "-" character is
assumed to be an IP address or hostname. The addresses can be single numbers
separated by commas and/or IP ranges separated by the "-" character. For
example
sl -t 80 10.1.2.3,10.1.2.4,10.1.2.5-10.1.2.20
would scan TCP port 80 on the machines 10.1.2.3, 10.1.2.4 and 10.1.2.5 through
10.1.2.20 inclusive. No spaces are allowed between any of the numbers or
ranges.

To make life easier you can also specify ranges in a number of ways :-
10.1.2.2-254
would add all IPs from 10.1.2.2 to 10.1.2.254 inclusive.
10.1.2.2-3.254
would add all IPs from 10.1.2.2 to 10.1.3.254 inclusive.
Hostnames can be used in place of IP address, although obviously they do not
make sense as part of an address range e.g.
sl -p 2-200 www.microsoft.com
------------------------------------------------------------------------------
To best illustrate the use of ScanLine here are a series of examples.
Example #1:
Scan machine at 10.0.2.2 for all TCP ports from 1 to 200.

sl -t 1-200 10.0.2.2
-------------------
Example #2:
Scan machines from 10.0.2.2 to 10.0.2.254 for all TCP ports in the range 1 to
65535 sending the output to the file "out.txt"
sl -t 1-65535 10.0.2.2-254 -o out.txt
-------------------
Example #3:
Scan machines from 10.0.2.2 to 10.0.2.20 for TCP ports 80, 81, 88, 8000 and
8080 and UDP ports 31337 without pinging and append the output to the file
"out.txt"
sl -pt 80,81,88,8000,8080 -u 31337 10.0.2.2-20 -O out.txt
Notice the use of the combined options "pt". This is perfectly legitimate.
-------------------
Example #4:
Scan machines 10.0.2.2 to 10.0.2.254 for TCP ports 21 and 25 and show the
banner responses. Include extra output information.
sl -vbt 21,25 10.0.2.2-254
-------------------
Example #5:
Scan machines 10.0.2.1 to 10.0.2.254 for TCP ports 1 to 65535, showing the
banner responses and with a delay of 5 seconds between each port scan.
Include extra output information.
sl -vbt 1-65535 10.0.2.1-254 -d 5000
-------------------
Example #6:
Scan machines 10.0.2.1 to 10.0.2.254 with no port scanning, only pinging.
Resolve the IPs into hostnames.
sl -nr 10.0.2.1-254
-------------------
Example #7:
Scan machines 10.0.2.1 to 10.0.2.254 with no port scanning or pinging.
Resolve the IPs into hostnames.
sl -npr 10.0.2.1-254
-------------------
Example #8:
Scan machines 10.0.2.1 to 10.0.2.254 for open UDP ports.
sl -U 10.0.2.1-254
-------------------
Example #9:
Scan for systems that have open TCP ports 80 or 443, not caring if they
respond to pings, then having found those perform a full port scan on
only those systems.

sl -hpt 80,443 10.0.2.1-254 | sl -f "stdin"


Get your copy  of Scanline
ref: foundstone

UDP Port Scan

UDP is User Datagram Protocol. It is a connection less protocol.We cannot be sure that all data sent reaches the destination. No acknowledgment is provided.

Attacker => UDP => Target
case1: open port
No Error message
case2: closed port
Port unreachable error message

pros and cons :
IDP is a connectionless protocol.So no guarantee on data reaching port.
UDP is not very accurate
Admin can actively monitor all UDP data traffic. This will lose the stealth feature of the Scanning process.

ACK Port Scan

An ACK scan operates by sending a TCP ACK frame to a remote port.

Attacker => ACK => Target
case 1: Port open
Error message or RST message
case 2: port closed
No response

ACK scan will never locate an open port. The ACK scan only provides a "filtered" or "unfiltered" disposition because it never connects to an application to confirm an "open" state. At face value this appears to be rather limiting, but in reality the ACK scan can characterize the ability of a packet to traverse firewalls or packet filtered links.

Advantages :
Since the ACK scan doesn't open any application sessions.The conversation between attacker and the target simple. This scan of a single port is unobtrusive and almost invisible when combined with the other network traffic.So some stealth is provided.


Disadvantages :
The ACK scan's simplicity is also its largest disadvantage. Because it never tries to connect to a remote device, it can never definitively identify an open port.


When to use the ACK Scan
Although the ACK scan doesn't identify open ports, it does a masterful job of identifying ports that are filtered through a firewall. This list of filtered and unfiltered port numbers is useful as reconnaissance for a more detailed scan that focuses on specific port numbers.

XMAS Tree Port Scan

XMAS Packet has all the flags checked or on.This is opposite to a NULL packet.his is called a XMAS tree scan because of the alternating bits turned on and off in the flags byte (00101001), much like the lights of a Christmas tree.

Attacker => XMAS => Target

case1 : port open
  Target => RST =>Attacker
case2: port closed
 No Response or Error

XMAS Scan using Nmap :

nmap -sX -v www.target.com

NULL Port Scan

NULL packet is a basic data packet which has none of its flags turned on.

Atatcker => NULL => Target

case 1: port open
Target => RST => Attacker
case 2: port closed
No response or error message

What happens in case 1 ie, when the port is open?
Whenthe port receives the NULL packet it does not know what to do with it. So it will send a RST packet to reset the connection.When we receive the RST packet from the target we can be sure that the port is open.

pros and cons :
Stealth : No connection so good stealth
Not accurate in all OS
Can be blocked using a good firewall

Null scan using Nmap :
nmap -SN -P -1-200 www.target.com

FIN port scan

FIN is the finish data packet.

Attacker => FIN => Target

case 1: port open
Error message by deamon
case 2: port closed
No response

The output is similar to the TCP and SYN scan.

Pros and cons :
Stealth : good stealth as no connection is established with the target host
Not accurate :The scan is not reliable with non Inix systems

Countermeasures :
This type of scan can be blocked using simple firewall or route rule that blocks all FIN packets from systems which have no connection

FIN scan using Nmap

nmap -SF -P 1-200 www.target.com

SYN/ACK Port Scan

Attacker => SYN/ACK => Target
case1  (open)
Target =>RST =>Attacker

case2 (close)
 No Response

what happens in case1...?
The attacker does not have connection with target.So there is no need to sent SYN/ACK packet.That is why target sends back a RST packet of port is open.

Advantages:
Very difficult to detect.Requires a manual watch with the help of sniffer and intrusion detection system (IDS).

Disadvantages :
This method is unreliable.This scan can be easily countered by a firewall or route that blocks all incoming SYN/ACK packets from systems with whom no connection has been established.

TCP Connect Port Scan

In this kind of port scan the port scanner establishes a full 3 way TCP/IP handshake connection with all ports on the remote system.
Attacker =>SYN => Target

case 1:
 Target  => SYN/ACK => Attacker

case 2:
 Target => RST/ACK => Attacker

Attacker => ACK => Target

TCP port scan is very difficult to determine.This is because these type of scanning never establishes a connection with the target.

Countermeasures:

Create a router or firewall rule that creates a buffer and limits the number of connections that can be established from the same IP

Port Scanning

This is the art of finding out the entire list of open ports on the target system.

A computer has mainly 2 types of ports
1) Hardware ports
2) Virtual Ports
Hardware ports :
These are the physical doors through which the devices are connected.

Virtual Ports :
These are the virtual doors behind which different softwares are running.Every application opens a port to run.The security of that application determines the vulnerability of that port.

port scanning can be done to gather information regarding the
List of open ports
Names and Versions of services
OS information

So how can we port scan a target.?
Method 1:
Manually connect to the target using telnet and find the open ports.This method is very tedious.We need to connect to each and every port manually to find out the open ports.This may take much time.

Method 2:
To avoid the unnecessary time lag due to the first method we can use automated tools to port scan a target system.some good tools are posted in the end of this post.Do check it.

 The information gathering using the port scanning is mainly done using the daemon banner grabbing.Daemon banner grabbing is nothing but study of the banner shown by the application when we try to connect to an open port.

If we get a banner then the port is open.If we get some error messages the port is most likely to be closed.

Nmap
strobe
Netcat
superscan
ipeye
TCP_scan
UDP_scan