Network scanning:

Initial Network Scanning: (nMap)

This is ICMP probing to determine hosts up. No response => there is a firewall

Scanning without ICMP and port 80 (nMap –sS –P0 -p21,25,53,80,110 –oG output.txt 192.168.10.0/24)
Identify UDP services (nMap –sU –P0 –p6,53,69,123,137,161 –oG output.txt 192.168.10.0/24)

Full Network Scanning: (nMap) to identify available network services.

TCP scanning with fingerprinting (nMap –sS –p0 –p1-65535 –v –A –o output.txt 192.168.10.0/24)
Slowed down: (nMap –sS –p0 –p1-65535 –v –A –t Sneaky –o output.txt 192.168.10.0/24)
UDP scanning: (nMap –sU –p0 –p1-65535 –o output.txt 192.168.10.0/24)

Low-Level Network Testing (nMap):

TCP ISN sequence generation: (nMap –sS –p0 –p1-65535 –v –A –o output.txt 192.168.10.0/24)
IP ID sequence generation: bounced from 10.10 to 10.1 (nMap –p0 –sI 192.168.10.10 192.168.10.1)
Source route testing to test the accessible services for source routing (lsrscan –d 23 192.168.10.1)
See Cap.4 for more

Accessible Network Service Identification:

Initial Telnet Service Assessment (telnet 192.168.10.1)
Initial SSH Service Assessment (telnet 192.168.10.10 22)
Initial SMTP Service Assessment (telnet 192.168.10.10 25)
Initial Web Service Assessment to identify enabled components (./dnascan.pl http://192.168.10.25)
Automated scanning for Front Page and OWA components (N-Stealth)

Investigation of Known Vulnerabilities:

CISCO IOS Accessible Service Vulnerabilities => Packet Storm => Password Grinding
SOLARIS Accessible Service Vulnerabilities=. Packet Storm
Windows Accessible Service Vulnerabilities =>MITRE, Security Focus, Packet Storm and Microsoft

Network services testing:

CISCO IOS Router password grinding (hydra –P pass,txt –e ns 192.168.10.1 cisco) (./ADMsnmp 192.168.10.1)
SOLARIS Mail Server => look for public exploits => Enumeration of user accounts => Brute Force
Windows 2000 Web Server (N-Stealth)
Network mapping (Linux): www.marko.net/cheops
Vulnerability scanning: www.nessus.org and www.cisco.com/warp/public/cc/pd/sqsw/nesn/
Password crackers: www.packetstormsecurity.com/Crackers/ and www.l0pht.com

Password file at: c:/windows/repair/sam._ or by using Linux c:\windows\system32\config

• Session Hijacking: Achilles and dynamic sniffing: www.monkey.org/~dugsong/dsniff

Web attacks and security bulletins: www.attrition.org/mirror/attrition

WinZapper for altering logs: ntsecurity.nu/toolbox/winzapper . Separate SysLog for Windows: www.kiwi-enterprises.com

Reverse WWW shell: http://www.thc.org/papers/fw-backd.htm

R E C O M E N D A T I O N S:

Quick Win Recommendations:

Long-Term Recommendations:

Use TCPView, File Monitor, TDImon and Process Explorer from http://www.sysinternals.com to identify open ports.

Use www.ntsecurity.nu/toolbox/promiscdetect/ to detect promiscuous mode interfaces.