Hping3 Tutorial With firewall

Hello, Today I will show you how to use hping3 for network mapping.

Hping3 :-->
Hping3 is a network tool able to send custom TCP/IP packets and to display target replies like ping do with ICMP replies. hping3 can handle fragmentation, and almost arbitrary packet size and content, using the command line interface.

1. Testing ICMP :
   
   hping3 will behave like a normal ping utility, sending ICMP-echo und receiving ICMP-reply
   
   hping3 -1 [Ip_Address]
   
2.  Traceroute using ICMP :
   
   In this example tracert (windows) or traceroute (linux) who uses ICMP packets increasing every time in 1 its TTL value.
   
   hping3 --traceroute -V -1 [Ip_Address]
    
3. Checking port :
   
   Hping3 will send a Syn packet to a specified port (80 in our example). We can control also from which local port will start the scan (5050).
   
   hping3 -V -S -p 80 -s 5050 [Ip_Address]
   
4. Traceroute to a determined port :
   
   Hping3 is that you can do a traceroute to a specified port watching where your packet is blocked.
   
   hping3 --traceroute -V -S -p 80 -s 5050 [Ip_Address]
   
5. Other types of ICMP :
   
   This example sends a ICMP address mask request ( Type 17 ).
   
   hping3 -c 1 -V -1 -C 17 [Ip_Address]
   
6. Other types of Port Scanning :
   
   First type we will try is the FIN scan. In a TCP connection the FIN flag is used to start the connection closing routine. If we do not receive a reply, that means the port is open. Normally firewalls send a RST+ACK packet back to signal that the port is closed..
   
   hping3 -c 1 -V -p 80 -s 5050 -F [Ip_Address]
7. Ack Scan :
   
   This scan can be used to see if a host is alive (when Ping is blocked for example). This should send a RST response back if the port is open.
   
   hping3 -c 1 -V -p 80 -s 5050 -A [Ip_Address]
   
8. Xmas Scan :
   
   This scan sets the sequence number to zero and set the URG + PSH + FIN flags in the packet. If the target device's TCP port is closed, the target device sends a TCP RST packet in reply. If the target device's TCP port is open, the target discards the TCP Xmas scan, sending no reply.
   
   hping3 -c 1 -V -p 80 -s 5050 -M 0 -UPF [Ip_Address]
   
9. Null Scan :
   
   This scan sets the sequence number to zero and have no flags set in the packet. If the target device's TCP port is closed, the target device sends a TCP RST packet in reply. If the target device's TCP port is open, the target discards the TCP NULL scan, sending no reply.
   
   hping3 -c 1 -V -p 80 -s 5050 -Y [Ip_Address]
   
10. Smurf Attack :
    
    This is a type of denial-of-service attack that floods a target system via spoofed broadcast ping messages.
    
    hping3 -1 --flood -a VICTIM_IP BROADCAST_ADDRESS
     
11. DOS Land Attack :
    hping3 -V -c 1000000 -d 120 -S -w 64 -p 445 -s 445 --flood --rand-source VICTIM_IP

Thank you (zer0w0rm)

READMORE

Dnsenum using information gathering tutorial

Hello Guys 

Today I will show you DNSENUM information gathering tool.

DNSenum is a pentesting tool created to enumerate DNS info about domains.

The purpose of Dnsenum is to gather as much information as possible about a domain

DNSenum is a very important tool to perform a quick enumeration step on penetration testing.
    Host address
    Name server
    MX record
    Sub domains
    Whois performance
    Reverse lookup for netblocks
    Use google to do the job done

use:
------------------------------------------------------------------
1)Simple scan
     dnsenum google.com

2)Powerful scan use
     dnsenum --enum google.com

3)More power scan with sub domains
     dnsenum --enum -f -r google.com

Note:
if you get error like this

Warning: can't load Net::Whois::IP module, whois queries disabled.

--> apt-get install cparminus
--> cpanm -n Net::Whois::IP

Thank you (zer0w0rm)

READMORE

Nmap Cheat Sheet

Nmap Cheat Sheet

Basic Scanning Techniques
Scan a single target —> nmap [target]
Scan multiple targets —> nmap [target1,target2,etc]
Scan a list of targets —-> nmap -iL [list.txt]
Scan a range of hosts —-> nmap [range of IP addresses]
Scan an entire subnet —-> nmap [IP address/cdir]
Scan random hosts —-> nmap -iR [number]
Excluding targets from a scan —> nmap [targets] –exclude [targets]
Excluding targets using a list —> nmap [targets] –excludefile [list.txt]
Perform an aggressive scan —> nmap -A [target]
Scan an IPv6 target —> nmap -6 [target]

Discovery Options
Perform a ping scan only —> nmap -sP [target]
Don’t ping —> nmap -PN [target]
TCP SYN Ping —> nmap -PS [target]
TCP ACK ping —-> nmap -PA [target]
UDP ping —-> nmap -PU [target]
SCTP Init Ping —> nmap -PY [target]
ICMP echo ping —-> nmap -PE [target]
ICMP Timestamp ping —> nmap -PP [target]
ICMP address mask ping —> nmap -PM [target]
IP protocol ping —-> nmap -PO [target]
ARP ping —> nmap -PR [target]
Traceroute —> nmap –traceroute [target]
Force reverse DNS resolution —> nmap -R [target]
Disable reverse DNS resolution —> nmap -n [target]
Alternative DNS lookup —> nmap –system-dns [target]
Manually specify DNS servers —> nmap –dns-servers [servers] [target]
Create a host list —-> nmap -sL [targets]

Advanced Scanning Options
TCP SYN Scan —> nmap -sS [target]
TCP connect scan —-> nmap -sT [target]
UDP scan —-> nmap -sU [target]
TCP Null scan —-> nmap -sN [target]
TCP Fin scan —> nmap -sF [target]
Xmas scan —-> nmap -sX [target]
TCP ACK scan —> nmap -sA [target]
Custom TCP scan —-> nmap –scanflags [flags] [target]
IP protocol scan —-> nmap -sO [target]
Send Raw Ethernet packets —-> nmap –send-eth [target]
Send IP packets —-> nmap –send-ip [target]

Port Scanning Options
Perform a fast scan —> nmap -F [target]
Scan specific ports —-> nmap -p [ports] [target]
Scan ports by name —-> nmap -p [port name] [target]
Scan ports by protocol —-> nmap -sU -sT -p U:[ports],T:[ports] [target]
Scan all ports —-> nmap -p “*” [target]
Scan top ports —–> nmap –top-ports [number] [target]
Perform a sequential port scan —-> nmap -r [target]

Version Detection
Operating system detection —-> nmap -O [target]
Submit TCP/IP Fingerprints —-> http://www.nmap.org/submit/
Attempt to guess an unknown —-> nmap -O –osscan-guess [target]
Service version detection —-> nmap -sV [target]
Troubleshooting version scans —-> nmap -sV –version-trace [target]
Perform a RPC scan —-> nmap -sR [target]

Timing Options
Timing Templates —-> nmap -T [0-5] [target]
Set the packet TTL —-> nmap –ttl [time] [target]
Minimum of parallel connections —-> nmap –min-parallelism [number] [target]
Maximum of parallel connection —-> nmap –max-parallelism [number] [target]
Minimum host group size —–> nmap –min-hostgroup [number] [targets]
Maximum host group size —-> nmap –max-hostgroup [number] [targets]
Maximum RTT timeout —–> nmap –initial-rtt-timeout [time] [target]
Initial RTT timeout —-> nmap –max-rtt-timeout [TTL] [target]
Maximum retries —-> nmap –max-retries [number] [target]
Host timeout —-> nmap –host-timeout [time] [target]
Minimum Scan delay —-> nmap –scan-delay [time] [target]
Maximum scan delay —-> nmap –max-scan-delay [time] [target]
Minimum packet rate —-> nmap –min-rate [number] [target]
Maximum packet rate —-> nmap –max-rate [number] [target]
Defeat reset rate limits —-> nmap –defeat-rst-ratelimit [target]

Firewall Evasion Techniques
Fragment packets —-> nmap -f [target]
Specify a specific MTU —-> nmap –mtu [MTU] [target]
Use a decoy —-> nmap -D RND: [number] [target]
Idle zombie scan —> nmap -sI [zombie] [target]
Manually specify a source port —-> nmap –source-port [port] [target]
Append random data —-> nmap –data-length [size] [target]
Randomize target scan order —-> nmap –randomize-hosts [target]
Spoof MAC Address —-> nmap –spoof-mac [MAC|0|vendor] [target]
Send bad checksums —-> nmap –badsum [target]

Output Options
Save output to a text file —-> nmap -oN [scan.txt] [target]
Save output to a xml file —> nmap -oX [scan.xml] [target]
Grepable output —-> nmap -oG [scan.txt] [target]
Output all supported file types —-> nmap -oA [path/filename] [target]
Periodically display statistics —-> nmap –stats-every [time] [target]
133t output —-> nmap -oS [scan.txt] [target]

Troubleshooting and debugging
Help —> nmap -h
Display Nmap version —-> nmap -V
Verbose output —-> nmap -v [target]
Debugging —-> nmap -d [target]
Display port state reason —-> nmap –reason [target]
Only display open ports —-> nmap –open [target]
Trace packets —> nmap –packet-trace [target]
Display host networking —> nmap –iflist
Specify a network interface —> nmap -e [interface] [target]

Nmap Scripting Engine
Execute individual scripts —> nmap –script [script.nse] [target]
Execute multiple scripts —-> nmap –script [expression] [target]
Script categories —-> all, auth, default, discovery, external, intrusive, malware, safe, vuln
Execute scripts by category —-> nmap –script [category] [target]
Execute multiple scripts categories —-> nmap –script [category1,category2, etc]
Troubleshoot scripts —-> nmap –script [script] –script-trace [target]
Update the script database —-> nmap –script-updatedb

Ndiff
Comparison using Ndiff —-> ndiff [scan1.xml] [scan2.xml]
Ndiff verbose mode —-> ndiff -v [scan1.xml] [scan2.xml]
XML output mode —-> ndiff –xml [scan1.xm] [scan2.xml]


Thank you (zer0w0rm)

READMORE

Top 5 Packet Crafting Tools

The top 5 packet crafting tools on the recommendation list:



No 1:

Hping2 : A network probing utility like ping on steroids

This handy little utility assembles and sends custom ICMP, UDP, or TCP packets and then displays any replies. It was inspired by the ping command, but offers far more control over the probes sent. It also has a handy traceroute mode and supports IP fragmentation. This tool is particularly useful when trying to traceroute/ping/probe hosts behind a firewall that blocks attempts using the standard utilities. This often allows you to map out firewall rulesets. It is also great for learning more about TCP/IP and experimenting with IP protocols.

No2:

Scapy : Interactive packet manipulation tool

Scapy is a powerful interactive packet manipulation tool, packet generator, network scanner, network discovery tool, and packet sniffer. It provides classes to interactively create packets or sets of packets, manipulate them, send them over the wire, sniff other packets from the wire, match answers and replies, and more. Interaction is provided by the Python interpreter, so Python programming structures can be used (such as variables, loops, and functions). Report modules are possible and easy to make.

No3:

Nemesis : Packet injection simplified

The Nemesis Project is designed to be a commandline-based, portable human IP stack for UNIX/Linux (and now Windows!). The suite is broken down by protocol, and should allow for useful scripting of injected packet streams from simple shell scripts. If you enjoy Nemesis, you might also want to look at Hping2 as they complement each other well.

No4:

Yersinia : A multi-protocol low-level attack tool

Yersinia is a low-level protocol attack tool useful for penetration testing. It is capable of many diverse attacks over multiple protocols, such as becoming the root role in the Spanning Tree (Spanning Tree Protocol), creating virtual CDP (Cisco Discovery Protocol) neighbors, becoming the active router in a HSRP (Hot Standby Router Protocol) scenario, faking DHCP replies, and other low-level attacks.

No5:

Colasoft Packet Builder enables creating custom network packets; users can use this tool to check their network protection against attacks and intruders.Colasoft Packet Builder includes a very powerful editing feature. Besides common HEX editing raw data, it features a Decoding Editor allowing users to edit specific protocol field values much easier.

Thank you (zer0w0rm)

READMORE

Installing ettercap on Linux

Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.

 sudo apt-get install ettercap

You will be prompted to choose between ettercap text-only and ettercap-graphical packages. Choose accordingly.


 For installing ettercap-graphical, use the command :

sudo apt-get install ettercap-graphical



For installing ettercap-text only, use the command :

sudo apt-get install ettercap-text-only


After the installation is done, you can open ettercap in different modes. For opening ettercap in graphic mode, use :


sudo ettercap -G


For text mode, use

sudo ettercap -T


To read about ettercap and its different modes, you can use :


man ettercap


Note : 'man' is short for manual. It can be used to read about all commands (description, syntax etc.)




Thankyou (zer0w0rm)

READMORE

Installing Nmap tools

Executing these simple commands will get you up and running quickly with Nmap 5.00 on Unix and Linux systems:

$ wget http://nmap.org/dist/nmap-5.00.tgz

$ tar -xf nmap-5.00.tgz

$ cd nmap-5.00

$ ./configure && make

$ sudo make install

You should see the message NMAP SUCCESSFULLY INSTALLED when the process is complete. Once Nmap has been successfully installed, you can verify it is working correctly by executing nmap localhost on the command line.

$ nmap localhost
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-07 00:42 CDT
Warning: Hostname localhost resolves to 2 IPs. Using 127.0.0.1.
Interesting ports on e6400 (127.0.0.1):
Not shown: 993 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
111/tcp  open  rpcbind
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
631/tcp  open  ipp
2049/tcp open  nfs
Nmap done: 1 IP address (1 host up) scanned in 0.20 seconds

If the results of your scan are similar to the results above, then you have successfully installed Nmap from source.


Thank you (zer0w0rm)

READMORE

If you are working in the field of computer networks or an enthusiast in the field of network security, you are sure to have come across the term “Denial of Service attack” which is simply referred to as “DoS attack”. Today, this is one of the most common types of network attacks carried out on the Internet. In this post, I will try to explain DoS attack, its variants and methods involved to carry out the same in an easily understandable manner.

What is a DOS Attack?

Denial of Service or DoS attack is a type of network attack designed to flood the target network or machine with a large amount of useless traffic so as to overload it and eventually bring it down to its knees. The main intention behind DoS attack is to make the services running on the target machine (such as a website) temporarily unavailable to its intended users. DoS attacks are usually carried out on web servers that host vital services such as banking, e-commerce or credit card processing.

A common variant of DOS attack known as DDoS (Distributed Denial of Service) attack has become quite popular in the recent days as it is more powerful and hard to detect. A typical DoS attack has a single place of origin while a DDoS attack originates from multiple IP addresses distributed across two or more different network. The working of a DDoS attack is shown in the following diagram:

Unlike a DoS attack where the attacker uses one single computer or a network to attack the target, a DDoS the attack originates from different pre-compromised computers belonging to different networks. As the attacker uses a number of computer systems from different networks each residing in different geographical locations, the incoming traffic looks natural and therefore becomes hard to detect.

Protection Against DoS/DDoS Attacks:

DoS attacks can easily be handled by blacklisting the target IP (or range of IPs) that are found to be making too many requests/connections (in an unnatural way) to the server. However, DDoS attacks are complicated as the incoming requests seem more natural and distributed. In this case it is hard to find the difference between the genuine and malicious traffic. Taking an action at the firewall level to blacklist suspected IPs may result in false positives and therefore may affect the genuine traffic as well.

Methods Involved in DoS Attack:

The following are some of the commonly employed methods in carrying out a DoS attack:

SYN Flood Attack
Ping Flood Attack (Ping of Death)
Teardrop Attack
Peer-to-Peer Attacks

Thank You (zer0w0rm)

READMORE