Discovery & Probing can serve two distinct purposes in an assessment:

• OS Fingerprinting
• Remote applications being served.

OS fingerprinting or TCP/IP stack fingerprinting is the process of determining the operating system being utilised on a remote host. This is carried out by analyzing packets received from the host in question. There are two distinct ways to OS fingerprint, actively (i.e. nmap) or passively (i.e. scanrand). Passive OS fingerprinting determines the remote OS utilising the packets received only and does not require any packets to be sent. Active OS fingerprinting is very noisy and requires packets to be sent to the remote host and waits for a reply, (or lack thereof). Disparate OS's respond differently to certain types of packet, (the response is governed by an RFC and any proprietary responses the vendor (notably Microsoft) has enabled within the system) and so custom packets may be sent.

Remote applications being served on a host can be determined by an open port on that host. By port scanning it is then possible to build up a picture of what applications are running and tailor the test accordingly.

• Default Port Lists
  • Windows
  • *nix
• Enumeration tools and techniques - The vast majority can be used generically, however, certain bespoke application require there own specific toolsets to be used. Default passwords are platform and vendor specific
  • General Enumeration Tools
    • nmap
      • nmap -n -A -PN -p- -T Agressive -iL nmap.targetlist -oX nmap.syn.results.xml
      • nmap -sU -PN -v -O -p 1-30000 -T polite -iL nmap.targetlist > nmap.udp.results
      • nmap -sV -PN -v -p 21,22,23,25,53,80,443,161 -iL nmap.targets > nmap.version.results
      • nmap -A -sS -PN -n --script:all ip_address --reason
      • grep "appears to be up" nmap_saved_filename | awk -F\( '{print $2}' | awk -F\) '{print $1}' > ip_list
    • netcat
      • nc -v -n IP_Address port
      • nc -v -w 2 -z IP_Address port_range/port_number
    • amap
      • amap -bqv 192.168.1.1 80
      • amap [-A|-B|-P|-W] [-1buSRHUdqv] [[-m] -o <file>] [-D <file>] [-t/-T sec] [-c cons] [-C retries] [-p proto] [-i <file>] [target port [port] ...]
    • xprobe2
      • xprobe2 192.168.1.1
    • sinfp
      • ./sinfp.pl -i -p
    • nbtscan
      • nbtscan [-v] [-d] [-e] [-l] [-t timeout] [-b bandwidth] [-r] [-q] [-s separator] [-m retransmits] (-f filename) | (<scan_range>)
    • hping
      • hping ip_address
    • scanrand
      • scanrand ip_address:all
    • unicornscan
      • unicornscan [options `b:B:d:De:EFhi:L:m:M:pP:q:r:R:s:St:T:w:W:vVZ:' ] IP_ADDRESS/ CIDR_NET_MASK: S-E
    • netenum
      • netenum network/netmask timeout
    • fping
      • fping -a -d hostname/ (Network/Subnet_Mask)
  • Firewall Specific Tools
    • firewalk
      • firewalk -p [protocol] -d [destination_port] -s [source_port] [internal_IP] [gateway_IP]
    • ftester
      • host 1 ./ftestd -i eth0 -v host 2 ./ftest -f ftest.conf -v -d 0.01 then ./freport ftest.log ftestd.log
• Active Hosts
  • Open TCP Ports
  • Closed TCP Ports
  • Open UDP Ports
  • Closed UDP Ports
  • Service Probing
    • SMTP Mail Bouncing
    • Banner Grabbing
      • Other
      • HTTP
        • Commands
          • JUNK / HTTP/1.0
          • HEAD / HTTP/9.3
          • OPTIONS / HTTP/1.0
          • HEAD / HTTP/1.0
        • Extensions
          • WebDAV
          • ASP.NET
          • Frontpage
          • OWA
          • IIS ISAPI
          • PHP
          • OpenSSL
      • HTTPS
        • Use stunnel to encapsulate traffic.
      • SMTP
      • POP3
      • FTP
        • If banner altered, attempt anon logon and execute: 'quote help' and 'syst' commands.
  • ICMP Responses
    • Type 3 (Port Unreachable)
    • Type 8 (Echo Request)
    • Type 13 (Timestamp Request)
    • Type 15 (Information Request)
    • Type 17 (Subnet Address Mask Request)
    • Responses from broadcast address
  • Source Port Scans
    • TCP/UDP 53 (DNS)
    • TCP 20 (FTP Data)
    • TCP 80 (HTTP)
    • TCP/UDP 88 (Kerberos)
  • Firewall Assessment
    • Firewalk
    • TCP/UDP/ICMP responses
  • OS Fingerprint