UNIX Security Document Index

Agenda - http://status.lsu.edu/nmap/

This page is a working document and will be updated as time and events require and permit.

The agenda for today's talk is:

Return to the Top of Page




Cyber Casing

Just as a thief must case a business before attempting to rob it, a cracker must case the net and prospective machines. This process can be very discreet or it can make a "bull in a china shop" look skillful. It all depends on the quality if the investigator and his tools. We will use the term cracker to refer to the cyber stalker.

Return to the Top of Page




Crackers

For the purposes of this talk, the term cracker will refer to an individual attempting to break-in to a machine (just like a safe cracker). We will use the original definition of hacker, on the other hand, to refer to an individual who is excellent at coding or using the system.

Crackers come in a range of expertise:

Often there is not a clear definition between these categories. Successful Script Kiddies with enough initiative learn to be Amateurs. The Amateurs who don't get scared of being caught (and prosecuted) have the ability to become an Expert. It's the fear of getting caught that stops most potential crackers.

Return to the Top of Page




Overview of TCP/IP

In the same way that streets and alleys are the pathways of burgulars, TCP/IP (Transmission Control Protocol / Internet Protocol) has become the avenue of the cracker. TCP/IP is a suite of protocols used by computers to communicate with each other over a network. While many other protocols exist, the TCP/IP suite has become the dominant one and is the method of machine-to-machine communication on the Internet.

TCP/IP is a set of rules that govern how to send information between computers (hosts). Every computer on the Internet must have an address. TCP/IP address are 32 bits (4 bytes) in size and are usually written in the form nnn.nnn.nnn.nnn where nnn is a number between 0 and 255. The four sets of digits (octets) form all the possible Internet addresses. DNS (Domain Name Service) was created so that Internet names can be translated into these numeric Internet addresses (and vice versa). The nslookup command is a tool for querying the DNS servers. For example:

Regardless of the form (numeric or name), each address refers to a specific computer (such as the street address of a house or someone's phone number).

To process communications easier, TCP/IP developed the concept of a port. A TCP/IP port can be thought of as a sub-address (in the way that a room number specifies part of a building, or an extension specifies a specific phone in a large company). TCP/IP ports are split into "well-known" ports and "high-number" ports. The ports with numbers below 1024 are considered the "well-known" ports and are reserved for use by "well-known" applications (like e-mail and the web). The "high-number" ports are free to be used by any application (and are often used for Denial of Service attacks or BackOrifice). A socket is the combination of an Internet address as well as a specific port. This socket will uniquely identify a communications channel between two computers.

Here is a list of some of the common "well-known" ports:

PortNameDescription
7echoEchoes back any characters sent to it.
9discardAbsorbs all characters sent and ignores them.
13daytimeReturns the hosts date/time stamp
19chargenGenerates the character set.
21ftpFile Transfer Protocol - FTP Server
22sshSecure form of telent
23telnetConsole style connecton to a host
25smtpSimple Mail Transfer Protocol - send and deliver e-mail
37timeOlder time syncing format
42nameserverDNS requests
43whoisInternet domain requests
53domainDNS requests
67bootpsBoot Protocol - server assigns IP address to client
68bootpcBoot Protocol - client receives IP address from server
69tftpTrivial File Transfer Protocol - no authentification
70gopherText based precursor to the web
79fingerUser information on a host
80wwwHyperText Transfer Protocol - Web Server
110pop-3Post Office Protocol - read e-mail remotely
111sunrpcPart of NFS
113authPasses host and user information to querying servers
119nntpNetwork News Transfer Protocol - Usenet news messages
123ntpNetwork Time Protocol - new time syncing format
137netbios-nsNETBIOS Name Service for Windows machines
138netbios-dgmNETBIOS Datagram for Windows machines
139netbios-ssnNETBIOS Session Service for Windows machines
143imap2Internet Mail Access Protocol - read e-mail remotely
161snmpSimple Network Monitoring Protocol - capture statistics about machines
162snmp-trapSimple Network Monitoring Protocol - (see above)
194ircInternet Relay Chat - chatting
201at-rtmpAppleTalk Routing for Macintoshes
202at-nbpAppleTalk Name binding for Macintoshes
204at-echoAppleTalk echo for Macintoshes
206at-zisAppleTalk Zone Transfer for Macintoshes
220imap3Internet Mail Access Protocol - new version
443httpsHyperText Transfer Protocol Secure - secure web
525timedOlder time format
540uucpUnix-Unix Copy Protocol - older file transfer

Here is a list of some of the common "high-number" ports:

PortNameDescription
1812radiusTerminal server communications
3306mysqlThe MySQL Database
5432postgresThe Postgres Database
6667ircdInternet Relay Chat
8080webcacheNon-priveleged Web Server
12345NetBusWindows remote control
12346NetBusWindows remote control
20034NetBusWindows remote control
27374aspRamen Toolkit remote control
31337Back OrificeWindows remote control

Return to the Top of Page




Manual Exploration

Even without arming yourself with all the tools crackers write, there's a lot of information you can gather about a host or network by yourself, with default utilities. We'll explore some of these utilities here.

Return to the Top of Page




NMAP

We've demonstrated a small, manual portscan with the tools mentioned above. Most people won't have the patience (or the skill) to scan all ports of all machines on a network. The by-hand tools can be used to determine some pieces of information about a machine, but there is obviously some guess-work, previous knowledge, and time involved. Full automation would also be a plus.

Luckily, there is another tool available called nmap, which is perhaps the best network scanner, that allows you to gather detailed information about not only a single machine, but possibly an entire network with just one command.

nmap, available from http://www.nmap.org, provides "network-wide ping sweep, portscan and OS detection" and encourages you to "audit your network security before the bad guys do." The tool can be used to determine which machines are really on your network (and possibly detect unauthorized machines), which services are being made available from machines on your network (and possibly detect unauthorized services), as well as identify what OS is running on the machines (the new beta version may even be able to tell you how long each machine has been on!).

We will look at nmap here in it's various forms.

Return to the Top of Page




Tools & Links

Return to the Top of Page







The statements and opinions included in these pages are those of Isaac W. Traxler, Brian D. Ropers-Huilman, Allen B. Gordon only. Any statements and opinions included in these pages are NOT those of Louisiana State University or the LSU Board of Supervisors.
© 1999-2001 Isaac W. Traxler, Brian D. Ropers-Huilman, Allen B. Gordon

This page last updated 2001/05/17 10:40:54.