Password Cracking Attacks -Common Known Methods

Password cracking is considered as the most common attack in the internet.Have you thought why...?

The answer is simple "Man needs security everywhere but he hates complexity".. Hey its my observation.. So, I say the best method to be secure online for a layman is to use passwords rather going for signing in using Biometrics and similar stuffs.The sense of security one gets by password protecting his accounts is enormous.And evidently the methods for storing and processing of password protected security is relatively simple. Hey but here you will realize that its not that simple to break a password as you read more.

So now its time to discuss different common methods used by a hacker or a cracker to bypass password securities.

Password Guessing:

This is mostly anyone's first attempt to crack a password.The attacker conducts a background check on the victim.This in most cases allows him to come up intelligent guesses and allow the breach.But not all passwords can be broken using this method.It needs a lot of hard work and patience to do this and in many cases its a failure.

Dictionary Based Attacks:

Attackers use automatic tools that tries out all words found in the dictionary as the password.Here we may include any dictionaries,even the local language dictionaries.But everything depends on how powerful is your selected tool.This method can only be used efficiently in case when the victim uses a word from dictionary as the password.Yeah !! I know that you are thinking  that even your password is not a dictionary based one.So now you are saved !!!

This is the main problem with this method.Not many people uses passwords from dictionary.So we can conclude that this method of password cracking is slow and inefficient .

Default Passwords :

Many softwares and networks have default passwords.These are configured by the developers for facilitating easier development.These passwords may even give us access to critical functionality of the software or the network.Lazy programming habits is the main cause of these type of vulnerabilities.Many admins are lazy to check for the default password secured accounts.

NB:

• You may be surprised to know that a big known military hacking revealed many accounts which gave the hacker full access to critical missions where saved with default passwords.

• If you are an Admin do check your user accounts for default passwords regularly and delete those immediately

Brute Force Password Cracking :
This is the most successful method of password cracking.You are assured with 100% success rate in this type of attacks.But the time taken by this method is the main drawback.It may take several days for breaking a good password.
The attacker uses an automatic tool that tries out all permutations and combination of the provided character set .For 100% success rate we must provide a character set which will contain all the keys found on the keyboard.But this efficiency is provided with a trade off with the time taken for the process.In most of the cases the correct password gets displayed after a long time.
The speed of password cracking is very much dependent on the speed of the machine,speed of the network,character set provided etc.So in my personal opinion this method is very slow and inefficient.

NB:

• I know that I started this topic by depicting this as the most successful method but now you know whyI had to say that it is very slow and inefficient.

DO's And DON'T's

DO NOT

• use relatives names as passwords
• use words from dictionary
• use any important dates in your life as your password.
• use short passwords
• disclose passwords even to spouse 
• login to your password protected accounts from public systems if possible
• fall for social engineering
• use same password for both critical and non critical accounts
• write your passwords anywhere.Memory is the best place to store critical data.
  

DO

• Try to use a combination of letters form alphabet digits and special characters.
• Try to use both upper and lower case characters in password
• Use different passwords for different accounts.
• Be aware that you are the only person who can stop one from hacking your passwords.
• A regular security check for the presence of default passwords

NB:
All these are some countermeasures or guidelines on how to prevent password theft.But still it can be stolen !!!

Tools

Cain and abel
John the Ripper

DDOS-Distributed DOS Attacks

DDOS attacks are very effective as well as dangerous when compared to the simple DOS attacks.

Now You might have a question.. A Big WHY...?

So let me come to the point....

DDOS attacks are multiple leveled attacks.We will discuss more on this in later parts.This makes them very dangerous.Due to the same reason these type of attacks are very difficult to counter.

Know what is different in DDOS Attacks...

In DDOS attacks an attacker breaches in to a lesser secure network say consisting of some 150 systems.He takes control of all systems in that network.Then in the later steps he'll install tools in those systems which can do a DOS attack or even Worse a DDOS attack.Then he will initialize the systems to attack.This makes it difficult to counter or prevent .

One common method of attack is to saturate the target by initializing many external connection requests and there by ceasing even the legitimate connection requests from reaching the target.This may prove to be very hazardous to the companies and firms which rely the internet or their network for income generation.For Eg: A DDOS attack on Yahoo or Google servers may lose them Billions of dollars in income even in several minutes. 

Courtesy: Wikepedia

Countermeasures :

• Separate or compartmentalize critical services.Do not use the same server to give many services.
• Buy more Bandwidth than normally required to counter the sudden attacks
• Filter out usless or malicious traffic as early as possible
• Disable publicly accessible services
• Portscan the system regularly and make sure that no DDOS attacking tool is installed in the system
• Balance traffic load on a set of servers
• Regular  monitoring and working closely with the ISP will always help.
• Patch the systems regularly
• IPSec provides proper verification and authentication in the IP protocol
  

TOOLS:

• Tribal Flood Network (TFN)
• Trin00
• Stacheldraht
• shaft
• Mstream
• WinTrin00

DoS- Denial Of Service Attacks

This a common form of attack any admin should protect his networks from.DoS attacks are used to compromise or bring down systems and networks.Each System connected to internet has a limited bandwidth and memory available for it.In the DoS attacks an attacker tries to choke or clog up all the available bandwidth on the target.As a result even the legitimate customers or clients are no longer be able to connect to the target.Some kind of data traffic is used by the attacker as the weapon for this attack.

Main Steps in DoS attacks:

1. Attacker sends technically infinite amount of malicious data to the network.
2. Target network gets choked or clogged up and cannot handle the inflow of the malicious data.This results in the crashing of the network as well as the target system.
3. Even real people or clients cannot connect to the target network.
4. This  results in loss of revenue,disrupt services,inconvenience,customer dissatisfaction and many other problems.

  In most of the cases a server may have a T1 or T3 connections that serves all the clients.A simple DoS attack can easily generate a traffic up to 20 to 30 Mbps clogging up the entire network bandwidth.Now this may be fatal for the services offered.A DoS attack is usually an attack of last resort. It’s considered an unsophisticated attack because it doesn’t gain the hacker access to any information but rather annoys the target and interrupts their service.

Different types of Dos attacks :

Some type of main DoS attacks are briefed in this section.

Ping of Death :

TCP/IP protocol is working based on many rules and limitations.One of such limitations is that the maximum size of a data packet that can be sent through a network is 65536 bytes.In the Ping of Death attack a packet having the size greater than the maximum allowable size is send to the target system.As soon as the target receives such packet it crashes or hangs or reboots.This is because the protocol can handle only legitimate data packets.The main problem with this attack is that any one can do such an attack with the help of a slightly advanced ping tool or command in Linux .

 command in Linux to perform this attack :

ping -l

Eg: ping -l 65545

NB:This attack only affects  the systems up to Win 95/98.All the upper versions are patched to this type of attack.

Tear Drop Attacks:

These kind of attack can affect many systems on the internet.Now let me explain the concept behind this attack.Normally the data sent from the source to destination is broken down in to smaller chunks and later combined together in to a larger file at the destination.

For Eg:

Say,a  5000 part ( just a quantity) data which is in single chunk has to be sent in a network.So we can assume that the data is to be broken in to 3 smaller parts for the process.

Chunk A contains data from the 1 to   1500 parts

Chunk B contains data from the 1501 to   3500 parts

Chunk C contains data from the 3501 to   5000 parts

It is important to note that the different chunks does not have any  overlapping ranges.

In the Tear Drop attack the data chunks of overlapping ranges is sent to the target.As the target does not know how to manage or process or combine the data, it will get confused and the system may crash or hang or even reboot.

The data send for attack will be of this way :

(This is not the real data or methodology.I am giving this Eg: to enhance your understanding only)

Chunk A contains data from the 1 to   1500 parts

Chunk B contains data from the 1499 to   3500 parts

Chunk C contains data from the 3499 to   5000 parts

Here you can see the data ranges of the data packets overlap.

Fragmentation Attacks:

This is a variation of the Tear Drop Attacks.Here the attacker sends streams of data packets with identical fragments to the target system.Since the target does not know how to put back the data together it crashes or hangs or reboots.

Chunk A contains data from the 1 to  1500 parts

Chunk A contains data from the 1 to  1500 parts

Chunk C contains data from the 3501 to 5000 parts

Here we are not sending chunk B,instead we are sending only the chunk A twice.

Smurf Attacks :

This is another type of DoS attack.Here in this attack attacker sends infinite number of ping requests to the broadcast address of the target.

A few words on the Broadcast address : This is a IP address which are used by the network admins to sent a data to the entire network.Every node connected to the network will receive the message directed towards the broadcast address.

 So what happens in this attack..?

Each system receiving the ping must reply to it using ICMP replies.Due to the infinite loops thus generated and due to the large number of pings, the target network will crash or restart or hang up.

NB: IRC servers are considered as the primary victim of smurf attacks on the Internet.

Countermeasures against Smurf attacks:

1. Block all data packets with source address same as any internal system,having the source address as the broadcast address.
2. Disable the broadcast address.
3. Always remember that there is no reason why an external system needs to send some data to the broadcast address.

Land Attacks :

In a Land attack, attacker sends a packet to a system where the source IP is set to match the target system’s

IP address. As a result, the system attempts to reply to itself, causing the system to create a loop

which will tie up system resources and eventually may crash the OS.Here the source and the destination IPs are same in the packet sent When the attacker sends infinite malicious packets to the victim the case becomes even worse.

Countermeasures for Land attack :

Filter all data packets having the same source and destination IP's.

NB: Make sure that we do not block the packets having the same source and destination ports by mistake .

SYN Flooding :

The main principle behind this kind of attack lies in the  way each TCP/IP connection is established.Each connection is established in a 3 way handshake process.This is  explained in other posts.

Let us discuss how SYN Flooding exploits this classic 3 way handshake process.

   In the attack , the attacker sends infinite number of connection requests in such a way that the packet orginates from a spoofed IP address.This creates infinite threads in the half open states.

Spoofed IP => SYN packet => Host

Host => SYN/ACK Packet => spoofed address

During this process the host will allocate certain amount of memory for each connection.Here the attacker sends infinite packets.When the whole memory of the target is used up the target may hang or crash or reboot.

3 important scenarios in SYN Flooding.

1. The spoofed IP address does not Exist :

The data reply packet will travel in the internet until the TTL value reduces to 0 or dropped at the router.But until this time target waits for the ACK from the source IP and space allocated for the connection remains used up.

     2.The spoofed IP address Exists :

When the SYN/ACK reaches the IP it sends an error message and the target on receiving this message will free the allocated memory.

     3.The spoofed IP is inside the target network :

This makes the job very easy for the attacker.This allows the attacker to increase the strain on the network and uses up  all the available network resources.

Loop Back Flooding:

This is one of the oldest examples of the DoS attacks.

The attacker exploits two services in the OS to carry out this attack.He sends infinite data to the "Chargen" service of a victim UNIX system such that the packets are originated from the "echo" service of the same system.

A small Overview about the Chargen and Echo daemons :

These are designed in a way that , what data  received is sent back to the source. They loop it back or reply or send same data to the source.

The echo service sends data to chargen , and chargen in turn sends it back and so on.Thus an infinite loop is created in the target and is eventually DoS attacked.

NB:This type of attack does not affect modern syatems.Almost all systems are patched to this type of attacks.

Tools:

• WinNuke
• Jolt2
• Bubonic
• Targa
• CPU Hog

TIPS:

If the the spoofed IP address exists , make sure you DoS attack it before SYN Flooding any network.

Session hijacking:

This is a hacking method that creates a temporary DoS for an end user and the attacker takes over the current session.This is done after the user has established an authenticated session. Session hijacking can also be used to perform a man-in-the-middle attack when the hacker steps between the server and client and sniffs all traffic.

DOWNLOAD ALL THE IMPORTANT TOOLS

Some ready to use tools are available in the internet.I'll be naming them and the providing the links for the downloading it.I know that the best practice is to create your own tools for the hacking.But for the beginners this thread will give a kick start in hacking.

NB: Some links may not work . So you may report it and post the new links in the comments.I'm not listing all the best tools here.You can help this blog with your contributions too.

• Fport
• Wireshark
• Ethreal
• Windump
• Winshark
• Etherchange
• cping
• fping
• Superscan
• Nmap
• VisualRoute
• NeoTrace
• 3D trace route
• Netcat
• Ipeye
• Scanlogd
• Nuke Nabber
• Snort
• Queso
• ZenMap
• RemOS
• P0F
• MingSweeper
• THC AMap
• Angry IP scanner
• Unicorn scan
• Httprint
• CoalaSoft Packet Builder
• Tribal Flood Network (TFN)
• Trin00
• Stacheldraht
• Mstream
• WinTrin00
• Advanced Zip Recovery
• Advanced Instant messenger password recovery
• Advanced mailbox password recovery
• Advanced PDF password recovery
• Office Key
• Advanced Windows Password recovery
• Internet Explorer password recovery
• Advanced mailbox password recovery
• Web brute
• Brutus
• SnadBoys Revolution
• L0Phtcrack
• NTFSDOS
• Tcp dump
• Ethreal
• Dsniff
• snort
• sniffit
• Ether cap
• Check Promiscous mode( CPM)
• Antisniff
• Sentinel
• Sklog_V1.14
• Netbus 1.07 by cf
• Turkojan
• Back Orrifice
• Girlfriend Trojan
• SubSeven Trojan
• Inpect V1.1 by sas
• Achilles
• Paros Proxy
• Websleuth
• WebProxy
• Spike
• TrueCrypt
• Knoppix
• Tripwire
• SYSInternals
• Restoration( deleted file recovery)
• TaskKill
• WinHex
• FTK Explorer
• EnCase- God father of forensic world
• ProDiscover DTF
• Backofficer Friendly
• Specter
• Honeyd
• Mantarp
• Nessus
• GFI LanGuard
• Retina
• Core Impact
• ISS Internet Scanner
• SAINT
• SARA
• Eeye
• ParosProxy
• Web Inspect
• Wikito
• Whisker
• tctrace
• BACKTRACK LINUX CD
• packet Factory
• Air Crack
• WEP Crack
• Virtual Box
• Vmware
• Hview

OS Fingerprinting -Finding Remote Host's OS

 It is very important for an attacker to know about the OS of the target.Different OS's have different stacks and kernels.The response to same message is different in different OS's so by analyzing these messages we can know about the OS in the host.Attacker sends packets made using the packet generation softwares and the target is forced to respond to it.Thus OS finger printing is done.

The techniques used for this purpose can be classified in to 2 types namely :

1) Active finger printing
2) Passive finger printing

Active fingerprinting :
steps:
A customized data packet is send to the target host.
The response generated is recorded using  the packet sniffer.
The recorded response is studied and compared to known responses and OS is identified.

Fators helping us to identify the OS :

TCP initial window size of the packets.
ACK values of the packets.
Initial Sequence Number(ISN)  values
Heading of overlapped fragments.
ICMP Message quoting method
ICMP Error Message quenching method
ICMP Error Message Echoing integrity

Problem:
The attacker will have to send the packets actively to the target and record its responses.
This method is not anonymous.So it may have tha attacker caught in the act.

That is why we go for Passive Fingerprinting.

TOOLS for active finger printing :

Nmap
Quso
Aping


Passive Fingerprinting :
This method is  anonymous. It is very difficult to identify passive fingerprinting.

The main steps in this method are as  follows :
The attacker uses a sniffer to record the data packets sent by the target.
The various parts of the response is analyzed for particular values which are specific for a particular OS.
Thus the OS of host is found out.The attacker may install the sniffer in a cafe and analyze the packets recieved while someone connects to the same computer.

The main fields studied in the passive method are:
TTL value
The window size
Don't fragment bit
Type of source (TOS)

 Consider the example :
When we recieve a
windows size =9000
TOS =0
DFB =yes
then the host must be running a Win9X or Win NT

Countermeasures:

Change the default values of the parameters studied.
Mislead the attacker by giving values of another OS.
Use ACL for filtering.

Detecting Firewalls Using Port Scanning

We can detect or even guess the firewalls used in the target because of the unique ports they use.
for Eg:
CheckPoint listens on the TCP ports 256,257,258,259
Microsoft proxy Server listens to TCP ports 1080 to 1745

Easiest solution to firewall enumeration is to use an ACL (Access Control List)

access-list 101 deny tcp any any eq  256 log ( here 256 is the port number on which the firewall is running)

What is the meaning of above code..?
This code prevents all port scanning techniques on the port 256 and also logs and records it which can be viewed later by the admin.

TOOLS:

scanlogd- An IDS that detects TCP scan
BlackICE Defender -Firewall detecting port scans
Abacus Port Sentry -This is a very good tool.It detects port scans and responds to it.
NukeNabber
snort -IDS and Packet sniffer
Etherpeek

Online Tools- AFCEH IMPORTANT

Port Scanning
 link1

Traceroute
link 1



File Size Converter

link 1


DNS Lookup
link 1

subnet calculator
link 1



Base64 conversion
 link 1

WHOIS
 link 1


Hash Calculator

link 1


IP Convertor
link 1



MISC TOOLS IN ONE PAGE

Scanline Tool- Nice Port Scanner

Scanline is a very good tool used by the hackers for port scanning.We can also use this for daemon banner grabbing and ICMP scanning.The main highlight of this tool is that it is very quick and accurate.This is a windows based command line tool
Usage:
-? - Shows this help text
-b - Get port banners
-c - Timeout for TCP and UDP attempts (ms). Default is 4000
-d - Delay between scans (ms). Default is 0
-f - Read IPs from file. Use "stdin" for stdin
-g - Bind to given local port
-h - Hide results for systems with no open ports
-i - For pinging use ICMP Timestamp Requests in addition to Echo Requests
-j - Don't output "-----..." separator between IPs
-l - Read TCP ports from file
-L - Read UDP ports from file
-m - Bind to given local interface IP
-n - No port scanning - only pinging (unless you use -p)
-o - Output file (overwrite)
-O - Output file (append)
-p - Do not ping hosts before scanning
-q - Timeout for pings (ms). Default is 2000
-r - Resolve IP addresses to hostnames
-s - Output in comma separated format (csv)
-t - TCP port(s) to scan (a comma separated list of ports/ranges)
-T - Use internal list of TCP ports
-u - UDP port(s) to scan (a comma separated list of ports/ranges)
-U - Use internal list of UDP ports
-v - Verbose mode
-z - Randomize IP and port scan order
Example: sl -bht 80,100-200,443 10.0.0.1-200
This example would scan TCP ports 80, 100, 101...200 and 443 on all IP
addresses from 10.0.0.1 to 10.0.1.200 inclusive, grabbing banners
from those ports and hiding hosts that had no open ports.
------------------------------------------------------------------------------
Detailed option descriptions
----------------------------
-?
Shows the usage of the program as in the above text.
-b
Attempts to read the responses from the scanned ports and displays the
results. If any part of the read text contains non-printable characters these
will be replaced with spaces and multiple spaces reduced to single spaces. A
maximum of 2 lines are displayed.
-c
This is the connection timeout value for TCP ports and also the timeout value
to wait for responses from UDP ports. For TCP scans, if no connection to the
current port has been made to the remote host after this amount of time then
it is assumed that there is no open port. For UDP scans, if no data response
has been received from the remote host in the given time period or, with the
case of the "extended" UDP scanning modes no ICMP port unreachable messages
have been received after this time has elapsed it is assumed that the port is
active.
-d
Specifies a delay (in milliseconds) between each port scanned. This applies to
all sections of the scan - ICMP, TCP and UDP. Use this option to perform a
"drip" scan so as to help avoid detection by an IDS or if you have a slow
network connection such as with a modem.
-f
Reads IP addresses from the given file. You can successfully use the output
file from a previous ScanLine session as input for this switch. However, any
text file that contains valid IP addresses or address ranges can be used.
Duplicates are removed before scanning.
-g
Binds the local IP endpoint to a given port number. This is used for "source
port" scanning and can sometimes successfully bypass firewall rules that
allow packets through with low numbered source ports (53 and 88 for example).
-h
Hides output from systems that have no open ports. Without this option all
discovered live hosts will be displayed regardless of whether they had any
open ports that were scanned for. Use this option to trim excess unwanted
output.
-i
When looking for "live" hosts, ScanLine will normally use a standard ICMP Echo
Request packet. Providing this option will cause ScanLine to use an additional
host discovery pass using ICMP Timestamp Requests instead of Echo Requests.
Some systems will block Echo Requests but will respond to Timestamp Requests.
-j
The output from ScanLine is normally made clearer by separating the information
obtained from each IP address with a line of dashes. Use this option if you
don't want the line separators to appear in the output.
-l
Specifies a TCP port list text file to read ports from. Ports in the file
are in lines in the same format as specified on the command line i.e. 79,80-88.
-L
Specifies a UDP port list text file to read ports from. Ports in the file
are in lines in the same format as specified on the command line i.e. 137,80-88.
-m
Binds the local IP endpoint to a given IP interface. If your system has
multiple network cards or interfaces you can tell ScanLine to use a
preferred IP address to bind to. Note that you can only specify the IP
address of an active interface on your own system - you can't "spoof"
packets by using an arbitrary IP address here.
-n
Specifies that no port scanning will take place. If all you want to do is
discover live systems (ones that respond to ICMP) use this option. You can
also specify -p (no pinging) in conjunction with -n if for example you simply
wanted to resolve a list of IP addresses into hostnames.
-o
Specifies a file that the output from the program is sent to. Note that output
will also appear on the screen at the same time. If the file already exists
it will be overwritten. If you want to append output to the file without
overwriting it then use the "-O" option.
-O
Same as -o but appends the program output to the text file instead of
overwriting it.
-p
Don't "ping" each host before scanning. ScanLine will make no attempt to discover
live hosts for scanning if this is used - it will simply go ahead and port
scan all hosts regardless if they exist on the network or not. You could use
this option to scan for systems that had certain ports open but were blocking
ICMP packets.
-q
Specifies the maximum time that the program waits for a response from a ping.
If no ping reply is received after this amount of the time the remote host
will be regarded as "dead" and won't be scanned.
-r
Resolve IP addresses to hostnames. An attempt will be made to resolve each
live IP address into a hostname. Even though the scan process in ScanLine is
single threaded, up to 8 threads will be used for resolving hostnames if
this option is specified
-s
Output in csv format. CSV format is usually used when you want to import a
file into a spreadsheet program for further analysis. The format of the
line that ScanLine outputs when this option is used is
,,,,
,,.
No port banners are included in this output and if -b is specified
on the command line it will be ignored when used in conjunction with -s.
-t
TCP port numbers to scan. The port numbers can be single numbers separated by
commas and/or port ranges separated by the "-" character. For example
sl -t 60,70,80-100 10.1.2.3
would scan TCP ports 60, 70, and 80 through 100 inclusive. No spaces are
allowed between any of the numbers or ranges.
-T
Use the built-in TCP port list. If you don't explicitly specify any ports
to scan on the command line, ScanLine will go ahead and use its built in list
of ports. If you DO specify ports and you want to also include ScanLine's
internal list of TCP ports use -T. For example, if you wanted to scan for UDP
port 137 together will all built-in TCP ports you'd specify
sl 10.1.2.3 -u 137 -T
-u
UDP port numbers to scan. The port numbers can be single numbers separated by
commas and/or port ranges separated by the "-" character. For example
sl -u 60,70,80-100 10.1.2.3

would scan UDP ports 60, 70, and 80 through 100 inclusive. No spaces are
allowed between any of the numbers or ranges. This UDP scanning option uses
known data probes for many common UDP services and are designed to produce
a response from the scanned system. This ensures total accuracy of the UDP
scanning; for the remote system to respond with a UDP packet the port that
was scanned must by definition be open.

Under normal circumstances sending a UDP packet to a closed port will cause
an ICMP Destination Port Unreachable message to be sent back. I say "under
normal circumstances" because often a system will be filtered in some way
such that it never responds in this fashion. This would lead to lots of false
positive open ports. So what ScanLine does with it's UDP scanning is to first
send a UDP probe to a "known closed port" on the target to see if it actually
responds with an ICMP message. For this purpose ScanLine uses UDP port 1. If
we do get an ICMP response the program will then assume that all further ports
scanned that do NOT generate an ICMP message are open.

***** Windows 95/98/ME systems do not register ICMP destination port
***** unreachable messages via Winsock due to subtle differences in the way
***** Winsock is implemented when compared to Windows 2000 and XP. Thus
***** you will never see any open UDP ports detected using this technique
***** on these operating systems.
-U
Use the built-in UDP port list. If you don't explicitly specify any ports
to scan on the command line, ScanLine will go ahead and use its built in list
of ports. If you DO specify ports and you want to also include ScanLine's
internal list of UDP ports use -U. For example, if you wanted to scan for TCP
port 80 together will all built-in UDP ports you'd specify
sl 10.1.2.3 -t 80 -U

-v
Verbose mode. Additional information will be shown if you set the program to
verbose mode.

-z
Use this to randomize the order that IP addresses and ports will be scanned
in. Normally ScanLine will scan the provided IPs and ports in numerical order.
By using the "-r" option the IPs and port numbers will be "shuffled" into a
random ordering. This can help to some extent in avoiding detection by
intrusion detection systems.

Default Port Lists
------------------
The internal port lists used in ScanLine are as follows:
UDP ports
7 9 11 53 67-69 111 123 135 137 138 161 191 192 256 260 407 445 500 514 520
1009 1024 1025 1027 1028 1030 1033 1034 1035 1037 1041 1058 1060 1091 1352
1434 1645 1646 1812 1813 1900 1978 2002 2049 2140 2161 2301 2365 2493 2631
2967 3179 3327 3456 4045 4156 4296 4469 4802 5631 5632 11487 31337
32768-32790 43981
TCP ports
7 9 11 13 15 19 21 22 23 25 43 49 53 66-68 70 79 80 81 88 89 98 109 110 111
113 118 119 135 139 143 150 156 179 256-259 264 389 396 427 443 445 457 465
512-515 524 540 563 587 593 636 691 799 900-901 1024-1031 1080 1100 1214
1243 1313 1352 1433 1494 1498 1521 1524-1525 1529 1541 1542 1720 1723 1745
1755 1813 1944 2000 2001 2003 2049 2080 2140 2301 2447 2766 2779 2869 2998
3128 3268 3300 3306 3372 3389 4000 4001 4002 4045 4321 4444 4665 4899 5000
5222 5556 5631 5632 5678 5800 5801 5802 5900 5901 6000 6112 6346 6347 6588
6666-6667 7000 7001 7002 7070 7100 7777 7947 8000 8001 8010 8080-8081 8100
8383 8888 9090 10000 12345 20034 27374 30821 32768-32790
IP address and hostnames
------------------------
Any item on the command line that is not associated with a "-" character is
assumed to be an IP address or hostname. The addresses can be single numbers
separated by commas and/or IP ranges separated by the "-" character. For
example
sl -t 80 10.1.2.3,10.1.2.4,10.1.2.5-10.1.2.20
would scan TCP port 80 on the machines 10.1.2.3, 10.1.2.4 and 10.1.2.5 through
10.1.2.20 inclusive. No spaces are allowed between any of the numbers or
ranges.

To make life easier you can also specify ranges in a number of ways :-
10.1.2.2-254
would add all IPs from 10.1.2.2 to 10.1.2.254 inclusive.
10.1.2.2-3.254
would add all IPs from 10.1.2.2 to 10.1.3.254 inclusive.
Hostnames can be used in place of IP address, although obviously they do not
make sense as part of an address range e.g.
sl -p 2-200 www.microsoft.com
------------------------------------------------------------------------------
To best illustrate the use of ScanLine here are a series of examples.
Example #1:
Scan machine at 10.0.2.2 for all TCP ports from 1 to 200.

sl -t 1-200 10.0.2.2
-------------------
Example #2:
Scan machines from 10.0.2.2 to 10.0.2.254 for all TCP ports in the range 1 to
65535 sending the output to the file "out.txt"
sl -t 1-65535 10.0.2.2-254 -o out.txt
-------------------
Example #3:
Scan machines from 10.0.2.2 to 10.0.2.20 for TCP ports 80, 81, 88, 8000 and
8080 and UDP ports 31337 without pinging and append the output to the file
"out.txt"
sl -pt 80,81,88,8000,8080 -u 31337 10.0.2.2-20 -O out.txt
Notice the use of the combined options "pt". This is perfectly legitimate.
-------------------
Example #4:
Scan machines 10.0.2.2 to 10.0.2.254 for TCP ports 21 and 25 and show the
banner responses. Include extra output information.
sl -vbt 21,25 10.0.2.2-254
-------------------
Example #5:
Scan machines 10.0.2.1 to 10.0.2.254 for TCP ports 1 to 65535, showing the
banner responses and with a delay of 5 seconds between each port scan.
Include extra output information.
sl -vbt 1-65535 10.0.2.1-254 -d 5000
-------------------
Example #6:
Scan machines 10.0.2.1 to 10.0.2.254 with no port scanning, only pinging.
Resolve the IPs into hostnames.
sl -nr 10.0.2.1-254
-------------------
Example #7:
Scan machines 10.0.2.1 to 10.0.2.254 with no port scanning or pinging.
Resolve the IPs into hostnames.
sl -npr 10.0.2.1-254
-------------------
Example #8:
Scan machines 10.0.2.1 to 10.0.2.254 for open UDP ports.
sl -U 10.0.2.1-254
-------------------
Example #9:
Scan for systems that have open TCP ports 80 or 443, not caring if they
respond to pings, then having found those perform a full port scan on
only those systems.

sl -hpt 80,443 10.0.2.1-254 | sl -f "stdin"


Get your copy  of Scanline
ref: foundstone

Daemon Banner Grabbing

When an open port is known,we can try to connect to the port.Then we may get some banner which will reveal many information regarding the server or the target.This process is called banner grabbing. Many e-mail, FTP, and web servers will respond to a telnet connection with the name and version of the software. The aids a hacker in fingerprinting the OS and application software.
For example, a Microsoft Exchange e-mail server would only be installed on Windows OS.
 What is it used for.?
Mainly to gather information regarding the daemon name, version and the OS information.
We can also use this for security measures detection.
This also helps in identifying the possible points of entry.But this method is very risky.

Countermeasures :
Edit the default welcome message and ensure taht important info is not shown.
Misguide the attacker by displaying false banners.
Use a long false daemon banner and in the background record the info to trace the attacker.

TOOLS:
Netcat (Unix)
Superscan
SamSpade crawler
Nmap Tool

Port Scanning

This is the art of finding out the entire list of open ports on the target system.

A computer has mainly 2 types of ports
1) Hardware ports
2) Virtual Ports
Hardware ports :
These are the physical doors through which the devices are connected.

Virtual Ports :
These are the virtual doors behind which different softwares are running.Every application opens a port to run.The security of that application determines the vulnerability of that port.

port scanning can be done to gather information regarding the
List of open ports
Names and Versions of services
OS information

So how can we port scan a target.?
Method 1:
Manually connect to the target using telnet and find the open ports.This method is very tedious.We need to connect to each and every port manually to find out the open ports.This may take much time.

Method 2:
To avoid the unnecessary time lag due to the first method we can use automated tools to port scan a target system.some good tools are posted in the end of this post.Do check it.

 The information gathering using the port scanning is mainly done using the daemon banner grabbing.Daemon banner grabbing is nothing but study of the banner shown by the application when we try to connect to an open port.

If we get a banner then the port is open.If we get some error messages the port is most likely to be closed.

Nmap
strobe
Netcat
superscan
ipeye
TCP_scan
UDP_scan

Traceroute

 When 2 data packets travel form source to destination both of them may take different paths.Trace route is a tool that allows us to trace the path between the 2 systems.Initially Trace route was used for troubleshooting, by finding where the error occurred in the path, but nowadays it is being used for information gathering by hackers. Information gathering is the initial and perhaps the most important part in hacking or penetration testing.

Working of traceroute :

Traceroute will create an UDP packet and send it to an higher port of the target.Typically on most occasions the higher port number will be closed .So the target will generate an ICMP unreachable error message to the attacker.This error message confirms the message is reached and gathers information about the target host and make it possible to trace the path to the target system.

By this method attacker can get answers of many critical questions like :
How is the target network?
Where does it get the bandwidth from?
Who is the ISP ?
What is the path followed ?

Now trace route is used for a  vareity of applications like :

1)OS detection ( by analyzing the TTL value)
2)Firewall detection
3)Gather the network topography information
4)Find out the exact geographical location of the target system

How to trace route using windows OS..?

In the cmd  type :  tracert and press enter

for help in tracert command in cmd type:   tracert/?

the main problem with this method is that it is not very efficient. So we may also try out some other tools available in the internet to do the traceroute.

Some good tools are :
Visualroute
Neo trace
3D Trace route

Ping Sweeping

Ping sweeping is a method used in network reconnaissance.The ping tool is commonly used for host detection purposes.In other words we can use a ping tool to find whwther a remote host is alive or not.This makes use of the ICMP(Internet Control Message Protocol).

So lets see how a ping works :

Attacker => ICMP Echo request => Host

Host => ICMP Echo Reply => Atatcker ( If host is alive)

                              OR

Host => No Response => Attacker (If host is not alive)

How to do Pinging...?

start > run > type ping  ( avoid the < > while typing )

or

You can type in the command prompt  ping

Using ping command we can find out the status of only 1 host. But for an attacker it is important to know about the entire network.So for that Pinging each and every IP manually is not practical.The ping tool in the OS is very slow.So there arise the need for a faster technique. Thus we introduce a new method called ping sweeping.Using this method the attacker can probe and check a wide range of hosts simultaneously to find its status. So in other words for pinging an entire IP range we can use Ping Sweeping.

In the end of this post I will list out some tool s which may help you to start with.You can search the internet to find more good tools.

Ok.. Now its time that I should tell you what are the other uses rather MISUSES of ping sweeping.

1)We can execute Denial of Services attacks.In security arena people usually call these as DOS attacks.

2)For OS detection purposes.OS detection is very important for a hacker.Different OS's have different vulnerabilities, a hacker makes use of this knowledge to break in to the system.

3)To know about the number of live hosts in a network.

4)To know about the up time and the down time of a server.

 I am listing some tools with which you can try out ping sweeping.

cping

fping

superscan

Nmap

Using Proxies -Start Anonymous Browsing

Whenever you visit a website the site will log your IP and even can asses which operating system is running on your  system.This can be dangerous when a Cracker( the Black Hat) has attacked that site and injected some exploits in it.Revealing your personal details to strangers can be hazardous especially to a Black hat...

So how can we cease ourselves from logged by the websites and hide our actual identity on WWW...?

One simple solution is using PROXIES .. Ok now, lets discuss about the proxies...

Proxies can be used to mask your identity while surfing in the WWW. Surfing from behind a proxy will hide your IP and will send  the decoy IP to the website you visits. so the site admin will have no idea about the visitor and no sensitive information is passed to the sites.Thus you can hide your identity.

Many sites allow us to use their proxy service. I will some good proxies which you can try on your own

Samair

Anonymizer

Sockschain is a program that allows to work with any Internet service through a chain of SOCKS or HTTP proxies to hide the real IP-address. SocksChain can function as a usual SOCKS-server that transmits queries through a chain of proxies. SocksChain can be used with client programs that do not support the SOCKS protocol, but work with one TCP-connection, such as TELNET, HTTP, IRC... (FTP uses 2 connections). And your IP-address will not be seen in the server's logs or mail headers

For setting up sockschain refer this

You can also try other similar softwares like:

Wingate (windows)
Winproxy( windows)
Squid (Linux)
multiproxy (firefox addon)

TIPS :

These proxy sites can be used to unblock many sites that has been blocked in your school, college or workplace

These proxies will aid a hacker to break in to a system by hiding his identity.

A Chain of Proxies is a "created" group of proxies that change at intervals or at will. The proxies are used by some of the biggest hackers becuase have 1 - 10 proxies is more secure than have 1.

Fport Tool - port scanning own system

Fport is a command line based tool which allows you to display all open ports and also maps them to their respective running processes and paths.Thus we can know which port is used by which process.This will aid us in combing out the Trojans running in our system.This is the same information you would see using the 'netstat -an' command in windows, but the data we get is descriptive.

Usage:

C:\>fport

/? usage help
/p sort by port
/a sort by application
/i sort by pid
/ap sort by application path

To find out MAC address of any system remotely

Install Windump on your computer. Windump is a data sniffer.We will discuss more on data sniffers on other posts.

Start recording all the data packets sent and received by the computer.

Ping to remote computer or connect to the website or telnet to it.

Carefully analyze the captured datapackets and it shall contain MAC address of the remote system.

TIPS:

To avoid confusion try not to connect to other hosts or websites at the time of sniffing.
 There are other good data sniffing tools worth trying

Windump
Wiershark
Ethreal

etc are a few to name

MAC Address Spoofing

This is the art of changing the MAC address of the network adapter of a host. This is very helpful in misguiding the investigators in the event of a cyber crime.

There are two methods to spoof  the physical address of the host

Method 1:
start > run >  cmd > ipconfig/all

 Now you can analyze the data displayed on the screen to find out with which network adapter you are connecting to the WWW.Please take a note of it.

The next step is to download a tool named Etherchange.This is more of a command line application.
 Run this tool from the command prompt.( I do not believe in spoon feeding even that procedure to you so find it out  yourself )

Now read all the instructions shown in the screen and change the MAC address of your network adapter.


Method 2:

This method is a little complex when compared to Method 1.Here no softwares are there to assist us in spoofing.Also we are doing some simple registry edits.So be careful while dealing with registry of your PC.

Hey nothing to worry here... I was just kidding... so lets see Method 2

start > run > regedit

Now a screen will pop up... Now you are in the registry editor.

Browse the registry for HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}

We can see many subkeys under the selection. All are 4 digit subkeys

Now manually determine which key belongs to the Ethernet adapter used to access data.For this  you can search for the term "DriverDesc" key till you find the needed one.
On the right hand pane create or edit the string key named "NetworkAddress". Be sure to make the data type to REG_SZ. The value of the string must be the new MAC address.

Now disable and enable the network adapter and run the ipconfig/all ... you will notice that the MAC address of your system has been spoofed.

This concludes the MAC spoofing