Ethical Hacking Module 6: Enumeration and Network Discovery
Enumeration plays a crucial role in ethical hacking by establishing connections to target hosts to uncover vulnerabilities for potential attacks. This process involves identifying usernames, group names, hostnames, network shares and services, IP and routing tables, audit configurations, application details, SNMP and DNS information. Various methods like NetBios, SNMP, LDAP, NTP, SMTP, DNS, Windows, and UNIX/Linux enumeration are utilized to gather vital data for penetration testing and security assessments.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
ETHICAL HACKING MODULE 6
ENUMERATION Enumeration is establishing a connection to the target hosts to discover how best to attack them
ENUMERATION VS MAPPING Network Enumeration Network Mapping Username Groups Shares Services Specific servers Operating systems
NETWORK ENUMERATION What we re looking for: Usernames, Group names Hostnames Network shares and services IP tables and routing tables Service settings and Audit configurations Application and banners SNMP and DNS Details
THERE ARE LOTS OF THINGS TO ENUMERATE NetBios Enumeration SNMP Enumeration LDAP Enumeration NTP Enumeration SMTP Enumeration DNS Enumeration Windows Enumeration UNIX /Linux Enumeration
NETBIOS Network Basic Input Output System Developed by IBM as an API layer to facilitate LAN communications Used by Windows for file and printer sharing Runs on port 139
NETBIOS An attacker can: Choose to read or write to a remote machine depending on the availability of shares Launch a Denial of Service attack on the remote machine Enumerate password policies on the remote machine
SNMP Simple Network Management Protocol Used for managing network devices running on the IP layer Routers, access points, et. Al. SNMP has two passwords One to enable reading the device configuration Another to enable changing the device configuration SNMP uses a hierarchical database called Management Information Base (MIB) MIB contains a tree like structure
SNMP From the SNMP configuration you can get: Information about network resources such as routers, shares, devices, etc. ARP and routing tables Device specific information Traffic statistics etc.
LDAP Light Weight Directory Access Protocol Internet Protocol for accessing distributed directory services Active Directory OpenLDAP
LDAP LDAP supports anonymous remote query on the Server The query will disclose sensitive information such as usernames, address, contact details, Department details, etc.
NTP Network Time Protocol Designed to synchronize clocks of networked computers Works on UDP and port 123.
NTP List of hosts connected to the NTP server Internal Client IP addresses, Hostnames and Operating system used.
SMTP Simple Mail Transfer Protocol E-Mail protocol TCP port 25 SMTP uses Mail Exchange servers to send the mail via the Domain Name Service
SMTP SMTP provides three built-in commands VRFY validate users on the SMTP servers EXPN Delivery addresses of aliases and mailing lists RCPT TO Defines the recipients of the message
DNS Domain Name Service Hierarchical decentralized distributed naming systems for computers, services, or any resource connected to the network DNS resolves hostnames to its respective IP addresses and vice versa Common record types in DNS Start of Authority (SOA), IP addresses (A and AAAA), SMTP mail exchangers (MX), Nameservers (NS), Pointers for reverse DNS lookups (PTR), and Domain name aliases (CNAME)
DNS DNS enumeration is possible by sending zone transfer request Reveals sensitive domain records in response to the request Zone transfer is how DNS replicates/synchronizes its database across multiple servers.
OS LEVEL Windows RDP Remote-Powershell FTP/SFTP Linux/Unix SSH TELNET
WINDOWS- RDP Remote Desktop Protocol Every version of Microsoft Windows from Windows XP onwardsincludes an installed Remote Desktop Connection Even the server versions Does Requires configuration
WINDOWS- RDP Issues: In March 2012, patched a vulnerability allowing a Windows computer to be compromised by unauthenticated clients In March 2018, patched a remote code execution vulnerability in a Security Support Provider for Microsoft Remote Desktop and Windows Remote Management May 2019 patched a vulnerability which allows for the possibility of remote code execution Unusually, patches were also made available for several versions of Windows that had reached their end-of-life, such as Windows XP
WINDOWS REMOTE-POWERSHELL Windows PowerShell supports remote computing work on all Windows operating systems without any special configuration: Restart-Computer Test-Connection Clear-EventLog Get-EventLog Get-HotFix Get-Process Get-Service Set-Service Get-WinEvent Get-WmiObject
WINDOWS FTP/SFTP FTP is a well known File Transfer Protocol Windows has no built in FTP client/server This requires windows users to rely on third-part applications of various quality
FTP VS SFTP Just a quick note: FTP File Transfer Protocol SFTP Secure File Transfer Protocol FTP- Everything is transmitted in plain text And I mean EVERYTHING Usernames Password Data SFTP Encrypts everything with an algorithm But which one?
UNIX/LINUX -SSH SSH: Secure Shell Encrypts all traffic Requires configuration Requires ssh server on receiving end Uses OS user accounts for authentication So if Admins leave a guest account open
UNIX/LINUX -SSH Uses For login to a shell on a remote host For executing a single command on a remote host For setting up automatic (passwordless) login to a remote server In combination with rsync to back up, copy and mirror files efficiently and securely For forwarding or tunneling For using as a full-fledged encrypted VPN For browsing the web through an encrypted proxy connection For securely mounting a directory on a remote server For automated remote monitoring and management of servers For development on a mobile or embedded device For securing file transfer protocols
UNIX/LINUX -TELNET Telnet was created and launched in 1969 Used for hosting remote shell sessions Servers Routers Firewalls
UNIX/LINUX -TELNET Telnet, by default, does not encrypt any data sent over the connection (including passwords) Telnet has no authentication that would ensure communication is carried out between the two desired hosts and not intercepted in the middle
