Basic Identification Port Scanning OS fingerprinting & Application scanning Advanced Identification Stealth operations Inline systems detection Security policy bypassing Fragmentation tricks ISN prediction & Spoofing Evading detection Bouncing | Security Training II – Network Hacking Renaud BIDOU Security Consultant EMEA Basic Identification Port Scanning OS fingerprinting & Application scanning Advanced Identification Stealth operations Inline systems detection Agenda – Part I : Identification Security policy bypassing Fragmentation tricks ISN prediction & Spoofing Evading detection Bouncing Agenda – Part II : Bypassing Denial of Service Floods Protocol anomalies Leveraging the DoS Reflection DDoS & Worms Agenda – Part III : DoS Redirection Playing with ARP Routing table scrambling DHCP slavery Wireless access SSID and beacon frames WEP weaknesses Agenda – Part IV : Interception Basic Identification Port Scanning About port scanning What scan sports for ? Identify running applications HTTP : 80, SMTP : 25 etc. Identify OS TCP 135+139+445 = Windows 2k/XP/2003 Identify Applications TCP 264+18264 = CHKP VPN Quick and dirty scan 100s of ports in a short time Easily detected Targeted PORTS 3-Way handshake based (SYN / SYN-ACK / ACK) Connect method Full TCP connection : established ok open received RST closed no answer to first SYN filtered Half-scan Send SYN only : received SYN-ACK open received RST closed no answer to first SYN filtered Scanning TCP Ports PORTS Anomaly based FIN Scan : FIN out of established session RFC : RST on open AND closed ports BSD based stacks : RST only on closed ports 90% of actual IP stacks FIN Scan variants X-mas tree : all TCP flags set Rely on TCP window size (0 closed, !0 open) Drawbacks Not very reliable : packet may be lost, filtered port as open Takes a lot of time as based on attacker stack timeout Scanning TCP Ports PORTS Only one method Packet sent on UDP ports ICMP Port unreachable closed no response open Drawbacks Same as FIN scan Not very reliable packet may be lost filtered port as open Takes a lot of time as based on attacker stack timeout Scanning UDP Ports PORTS Tools Unix / windows : nmap # nmap -sS . | Security Training II – Network Hacking Renaud BIDOU Security Consultant EMEA Basic Identification Port Scanning OS fingerprinting & Application scanning Advanced Identification Stealth operations Inline systems detection Agenda – Part I : Identification Security policy bypassing Fragmentation tricks ISN prediction & Spoofing Evading detection Bouncing Agenda – Part II : Bypassing Denial of Service Floods Protocol anomalies Leveraging the DoS Reflection DDoS & Worms Agenda – Part III : DoS Redirection Playing with ARP Routing table scrambling DHCP slavery Wireless access SSID and beacon frames WEP weaknesses Agenda – Part IV : Interception Basic Identification Port Scanning About port scanning What scan sports for ? Identify running applications HTTP : 80, SMTP : 25 etc. Identify OS TCP 135+139+445 = Windows 2k/XP/2003 Identify Applications TCP 264+18264 = CHKP VPN Quick and dirty scan 100s of ports in a short time Easily detected Targeted PORTS 3-Way .
