Searching for vulnerability and Penetrating in system !

In my previous tutorial, i was explaining about port scanning, version

detection and which service is running on the target system.

Before we proceed let me clear one thing,  To protect yourself against

a hacker, you have to think like a hacker. So which is  i am going to share

with you, this is for educational purpose only!

Now once the hacker has the name of the software being used and its

version number, he would take that information and search a couple

vulnerability databases for an exploit.

If there’s an exploit available, he will run it against the server and

take complete control. If there isn’t any, he would move onto another

open port and try again on a different service.

But when there is no exploit available for specific port, then

Most hacker would move on to another port to try and find another

possible vulnerability, but this doesn’t mean every hacker will.

But Remember A skillful hacker is determined, he may try to locate a

vulnerability in the current software version and develop an exploit

for it.

Ohk now let me tell some helpful resources in finding vulnerabilities

and exploits :

1. Searching to SecurityFocus( for Vulnerabilities) :

SecurityFocus database has some handy tools for searching for

vulnerabilities. It will allow us to search by vendor, by title of the

software and by the version. Finally, it will allow us to search by CVE,

which is the Common Vulnerability and Exploit number.

2. Finding Exploits :

Once we've found a vulnerability that virtually every PC will have, the

next step is to find an exploit.

Developing an exploit requires some advanced coding skills, but is not

beyond the capability of a talented, aspiring hacker.

To find the exploit for any specific vulnerability, you can use

www.exploit-db.com

You can say it is the king of exploit database ;-)

Or you can use

http://1337day.com/

Now after finding the right exploit,  it's time to Penetrating.

The more exploits you run, the more you will notice that half of them

may not work.

That is main reason why programming knowledge is needed, so you

could edit the exploit script to work for you.

Once a skilled hacker gains root to a server he has the ability to do a

lot of damage.

Note : This is for educational purpose only!

Scanning : The first phases of hacking !

Scanning is the first phases of hacking and involve the hacker locating

target systems or networks.

During scanning, the hacker continues to gather information regarding

the network and its individual host systems. Data such as IP addresses,

operating system, services, and installed applications can help the

hacker decide which type of exploit to use in hacking a system.

Basically Scanning is the process of locating systems that are alive

and responding on the network. Ethical hackers use it to identify

target systems’ IP addresses.

If i say in simple words, There are basically three types of scanning :

Port scanning                   Determines open ports and services

Network scanning           IP addresses

Vulnerability scanning     Presence of known weaknesses

In this tutorial, we will discuss about port scanning!

Port scanning :

The aim of port scanning a server is to detect its open ports the

port’s listening services. Once a hacker knows all the services

running on target server, he could search for possible vulnerabilities

they may have and exploit them to take control of your website or system

Before we proceed, let me clear what is CEH Scanning Methodology.

CEH scanning methodology :

:=>   Check for Live Systems
:=>   Check for Open Ports
:=>   Service Identification
:=>   Banner Grabbing /OS Fingerprinting
:=>   Vulnerability Scanning
:=>   Draw Network Diagrams of
:=>   Vulnerable Hosts
:=>   Prepare Proxies
:=>   Attack

Nmap is a free open source tool that quickly and efficiently performs

ping sweeps, port scanning, service identification, IP address

detection, and operating system detection.

(You can download it from here.)

Nmap support several types of scans like :

* TCP connect
* XMAS tree scan
* SYN stealth scan
* Null scan
* Windows scan
* ACK scan

If you want to scan a single system, then you can use a simple command:

nmap 127.0.1.1

If you want to scan the entire subnet, then the command is

nmap 127.0.1.1/24

Now i will explain each scan type :

1. TCP connect or Simple scan :

# TCP connect() Scan [-sT]

This the default scanning technique used.

Keep in mind that this technique is only applicable to find out the

TCP ports, not the UDP ports.

nmap -sT 127.0.1.1

# SYN Stealth Scan [-sS]

It is a basic scan, and it is also called half-open scanning because

this technique allows Nmap to get information from the remote host

without the complete TCP handshake process.

nmap -sS 127.0.1.1

2. FIN, Null and Xmas Tree Scans [-sF, -sN, -sX] :

Sometimes a normal TCP SYN scan is not the best solution because of the

firewall. This is where FIN action comes in action !

The FIN scan sends a packet with only the FIN flag set, the Xmas Tree

scan sets the FIN, URG and PUSH flags and the Null scan sends a packet

with no flags switched on.

These scan types will work against any system where the TCP/IP

implementation follows RFC 793. Microsoft Windows does not follow the

RFC, and will ignore these packets even on closed ports. This

technicality allows you to detect an MS Windows system by running SYN

along with one of these scans. If the SYN scan shows open ports, and

the FIN/NUL/XMAS does not, chances are you’re looking at a Windows box

(though OS Fingerprinting is a much more reliable way of determining

the OS running on a target!)

nmap -sF 127.0.1.1

3. Ping Scan [-sP]

It allows you to detect which computers are online,

rather than which ports are open.

nmap -sP 127.0.1.1

4. UDP Scan [-sU]

5.  IP Protocol Scans [-sO]

6. Idle Scanning [-sI] :

it is an advance scan that provides complete anonymity while scanning.

7. Version Detection (-sV) :

Version detection is the technique that is used to find out what

software version is running on the target computer and on the

respective ports.

This information can be critical in determining an entry point for an

attack.

nmap -sV 127.0.1.1

8. OS Fingerprinting :

One of the most important feature that Nmap has is the ability to

detect remote operating systems and software. It is very helpful

during a penetration test to know about the operating system and the

software used by the remote computer because you can easily predict

the known vulnerabilities from this information.

nmap -O 127.0.1.1

Nmap OS fingerprinting technique discovers the:

    Device type (router, work station, and so on)
    Running (running operating system)
    OS details (the name and the version of OS)
    Network distance (the distance in hops between the target and 
    attacker)

9. Typical Scanning Session :

# We can scan our target using a SYN scan [-sS] and -A to enable OS

fingerprinting and version detection.

nmap -sS -A 127.0.1.1

Now we’ll move on to nmap  

-sS -P0 -A -v 127.0.1.1

we can deduce that target is a Linux system running a 2.4 to 2.6 kernel

with open ports 21/tcp, 22/tcp, 631/tcp and 6000/tcp(Assume).

Top 10 security tools for penetration testing -2!

In my previous tutorial, i was explaning about  Penetration Testing Tools.

So here we continue...

 6. Cain & Abel :

Cain and abel is one of best Tool that is commonly used to Poison the

network

If cracking encrypted passwords or network keys is what you need, then

Cain& Abel is the tool for you. It uses network sniffing, Dictionary,

Brute-Force and Cryptanalysis attacks, cache uncovering and routing

protocol analysis methods to achieve this.

Features :

    Brute Force Attack
    Dictionary attack
    Crypt Analysis attack
    recording VoIP conversations
    sniffing the network
    decoding scrambled passwords
    recovering wireless network keys
    revealing password boxes
    uncovering cached passwords
    analyzing routing protocols

Cain and abel is mainly developed in order to help for security

professionals,Network admins.  The new version of cain label supports

APR (Arp Poison Routing) attacks.

You can download it from here. 

7. Acunetix:

Acunetix is essentially a web vulnerability scanner targeted at web

applications. It provides SQL injection, cross site scripting testing,

PCI compliance reports etc. along with identifying a multitude of

vulnerabilities.

Hacking is on the rise and the number of victims is increasing every

day. See how firewalls, SSL and locked-down servers can't stop your

web applications and websites from being hacked but how Acunetix

protects them with:

    AcuSensor Technology
    Industry's most advanced and in-depth SQL injection and Cross site 
    scripting testing
    Full HTML5 Support with Acunetix DeepScan Technology
    Comprehensive scanning of Single Page Applications and JavaScript-
    based websites
    Mobile Website Support
    Detection of Blind XSS vulnerabilities with AcuMonitor service
    Automated detection of DOM-based XSS vulnerabilities
    Advanced penetration testing tools, such as the HTTP Editor and the
    HTTP Fuzzer
    Extensive reporting facilities including PCI compliance reports
    Multi-threaded and lightning fast scanner crawls hundreds of 
    thousands of pages with ease.

You can download it from here.

8. John The Ripper :

This is the most powerful  password cracker tool.

This tool works on most of the environments, although it’s primarily

for UNIX systems. It is considered one of the fastest tools in this

genre. Password hash code and strength-checking code are also made

available to be integrated to your own software/code.

Attack types:

One of the modes John can use is the dictionary attack. It takes text 
string samples (usually from a file, called a wordlist, containing 
words found in a dictionary or real passwords cracked before), 
encrypting it in the same format as the password being examined 
(including both the encryption algorithm and key), and comparing the 
output to the encrypted string. It can also perform a variety of 
alterations to the dictionary words and try these. Many of these 
alterations are also used in John's single attack mode, which modifies 
an associated plaintext (such as a username with an encrypted password)
and checks the variations against the hashes.

John also offers a brute force mode. In this type of attack, the 
program goes through all the possible plaintexts, hashing each one and 
then comparing it to the input hash. John uses character frequency 
tables to try plaintexts containing more frequently used characters 
first. This method is useful for cracking passwords which do not 
appear in dictionary wordlists, but it does take a long time to run.

you can download it from here.

9. W3AF :

w3af (short for web application attack and audit framework) is an

open-source web application security scanner. The project provides a

vulnerability scanner and exploitation tool for Web applications.

It provides information about security vulnerabilities and aids in

penetration testing efforts.

Some of the features are:

fast HTTP requests,

integration of web and proxy servers into the code,

injecting payloads into various kinds of HTTP requests etc.

You can download it from here!

10.Netsparker:

Netsparker comes with a robust web application scanner that will

identify vulnerabilities, suggest remedial action etc. This tool can

also help exploit SQL injection and LFI (local file induction). It has

a command-line and GUI interface. It works only on Microsoft Windows.

You can download it from here !

Top 10 security tools for penetration testing -1!

Penetration testing is a way for you to simulate the methods that an attacker might use to circumvent

security controls and gain access to an target's systems. you won’t become an expert penetration tester

overnight; it takes years of practice and real-world experience to become proficient.

There are some Phases of the Penetration testing like :

1. Pre-engagement Interactions

2. Intelligence Gathering

3. Threat Modeling

4. Vulnerability Analysis

5. Exploitation

6. Post Exploitation

7. Reporting

Penetration Testing tools are used as part of a penetration test to

automate certain tasks, improve testing efficiency, and discover

issues that might be difficult to find using manual analysis

techniques alone.

Top 10 Penetration Testing Tools :

1. Kali-linux :

Kali Linux is an advanced Penetration Testing and Security Auditing

Linux distribution.

Kali Linux Features :

* More than 300 penetration testing tools

* Free and always will be

* Open source Git tree
* FHS compliant
* Vast wireless device support
* Custom kernel patched for injection
* Secure development environment
* GPG signed packages and repos
* ARMEL and ARMHF support
* Completely customizable

Download it from here.

2. Metasploit.

This is the most advanced and popular Framework that can be used to

for pen-testing. It is based on the concept of ‘exploit’ which is a

code that can surpass the security measures and enter a certain system.

The typical life cycle of a vulnerability and its exploitation is as

follows:

1. Discovery : A security researcher or the vendor discovers a critical

security vulnerability in the software.

Analysis: The researcher or others across the world begin analyzing the

vulnerability to determine its exploit ability.

Exploit Development :

This has usually been considered a bit

of a black art, requiring an in-depth understanding of the processor’s

registers, assembly code, offsets, and payloads.

Testing: This is the phase where the coder now checks the exploit code

against various platforms, service pack, or patches, and possibly even

for different processors.

Release:

Once the exploit is tested, and the specific parameters required for

its successful execution have been determined, the coder releases the

exploit, either privately or on a public forum. Often, the exploit is

tweaked so that it does not work right out of the box.This is usually

done to dissuade script kiddies from simply downloading the exploit and

running it against a vulnerable system.

Metasploit takes the following structured approach while mounting an attack:

i) Pick which exploit to use.

ii) Configure the exploit with remote IP address and remote port number.

iii) Pick a payload.

iv) Configure the payload with local IP address and local port number.

v) Execute the exploit.

You can download it from here.

3. Namp

This is a very popular tool that predominantly aids in understanding

the characteristics of any target network. The characteristics can

include: host, services, OS, packet filters/firewalls etc.  It works

on most of the environments and is open sourced.

Nmap support several types of scans like :

* TCP connect
* XMAS tree scan
* SYN stealth scan
* Null scan
* Windows scan
* ACK scan

You can download it from here.

4. Wireshark :

Wire-shark is a network packet analyzer. A network packet analyzer will

try to capture network packets and tries to display that packet data

as detailed as possible.

Penetration test tools like Wireshark come in handy for understanding

and exploiting the data organization posted by forms or services to

applications. Application vulnerabilities such as parameter pollution,

SQL injection, lack of input validation, as well as buffer overflow can

be easily detected and exploited using Wireshark.

Features

The following are some of the many features Wireshark provides:

    Available for UNIX and Windows.

    Capture live packet data from a network interface.

    Open files containing packet data captured with tcpdump/WinDump, Wireshark, and a number of other packet capture programs.

    Import packets from text files containing hex dumps of packet data.

    Display packets with very detailed protocol information.

    Save packet data captured.

    Export some or all packets in a number of capture file formats.

    Filter packets on many criteria.

    Search for packets on many criteria.

    Colorize packet display based on filters.

    Create various statistics.

You can download it from here.

5. Nessus:

Nessus is a great tool designed to automate the testing and discovery

of known security problems. Typically someone, a hacker group,

a security company, or a researcher discovers a specific way to

violate the security of a software product.

It is one of the most robust vulnerability identifier tools available.

It specializes in compliance checks, Sensitive data searches, IPs scan,

website scanning etc.

You can download it from here.

In my next tutorial , i will continue !