Footprinting & Scanning
Last updated
Was this helpful?
Last updated
Was this helpful?
⚡ Prerequisites
Basic familiarity with Linux
Basic networks concepts
📕 Learning Objectives
Purpose of network mapping and port scanning in relation to an engagement
Perform network host discovery and port scanning
Think and act like an adversary
🔬 Training list - PentesterAcademy/INE Labs
subscription required
❗Never run these techniques on un-authorized addresses❗A proper authorization is required to conduct the footprinting and scanning activity.
Before any type engangement the purpose of a pentest must be defined and negociated with the client, in order to mitigate risk and harden the client's system.
The pentester must determine both the type of access to the client's network to begin the discovery and the scope of what will be valuable to the client, while not interfering with its business.
Physical Access
physical security - access controls, camera, guards
OSINT (Open Source Intelligence) - DNS records, websites, public IP addresses
Social Engineering - psychological manipulation of people into performing security mistakes or giving away sensitive information
sniffing - (once connected) sniff network traffic through passive reconnaissance and packet capturing
collect IP address and MAC addresses for further enumeration
ICMP (Internet Control Message Protocol) - traceroute, ping
Launch wireshark and start monitoring the internet network interface (eth0 in this case).
Run an arp-scan on the same interface and check the traffic inside wireshark.
ip- show/manipulate routing, network devices, interfaces and tunnels
arp-scan- send ARP requests to target hosts and display responses
ping- send ICMP ECHO_REQUEST to network hosts
fping- send ICMP ECHO_REQUEST packets to multiple network hosts
Launch fping without "Host Unreachable" errors
nmap- Network exploration tool and security/port scanner
zenmap- the officialnmapGUI
The purpose of port scanning is to identify services and operating systems, in order to understand what type of devices are discovered (servers, desktops, network devices, etc).
An O.S. is revealed by its signatures or its services.
The response from the machine (software version, services name) is compared to a signature database, with a percentage of confidence.
Find services by connecting to ports and analyzing the response.
Open Port
SYNsent ➡️SYN+ACKreceived ➡️ACKsentPort is identified/open
Close the connection with ➡️
RST+ACKsent
Closed Port
SYNsent ➡️RST+ACKreceivedPort is closed
"Stealthy" Scan
SYNsent ➡️SYN+ACKreceived ➡️RSTsentDrops the connection after the received
SYN+ACK
Service Version Scan
SYNsent ➡️SYN+ACKreceived ➡️ACKsent ➡️BANNERreceived ➡️RST+ACKsentIf
BANNERreceived, the application will send back some information."noisy" scan!
Connect to UDP
slower, can be sped up
port is open
port is filtered (unknown status)
(Address Resolution Protocol) - take advantage of the ARP table and broadcast communications
Connect to TCP - a is used to identify open ports.
📌 Check
