Flashcards
Scanning and Enumeration Concepts
Cards in this deck (34)
- 1ScanningThe process of discovering systems on the network and taking a look at what open ports and applications may be running. It is a passive information gathering process.
- 2Check for Live SystemsFirst phase of the scanning process. It can be something as simple as a ping. It gives you a list of what’s actually alive on your network subnet.
- 3Check for Open PortsSecond phase of the scanning process. Once you know which IP addresses are active, find what ports they’re listening on.
- 4Scan beyond IDSThird phase of the scanning process. Sometimes your scanning efforts need to be altered to avoid Intrusion Detection Systems (IDS).
- 5Perform Banner GrabbingFourth phase of the scanning process. Banner grabbing and OS fingerprinting will tell you what operating system is on the machines and which services they are running.
- 6Scan for VulnerabilitiesFifth phase of the scanning process. Perform a more focused look at the vulnerabilities these machines haven’t been patched for yet.
- 7Draw Network DiagramsSixth phase of the scanning process. A good network diagram will display all the logical and physical pathways to targets you might like.
- 8Prepare ProxiesSeventh phase of the scanning process. This obscures your efforts to keep you hidden.
- 9Internet Protocol (IP)A connectionless, “fire-and-forget” protocol. It creates a packet by taking data and appending a header, which holds bunches of information, including a “From” and “To” address, and allows the sender to fire packets away without regard, as quickly as the stack on the machine will allow. This is done by relying on other layer protocols for transport, error correction, and so on.
- 10Internet Control Message Protocol (ICMP)Since IP itself has no error messaging function, this protocol was created to provide for it. It allows for error messaging at the Network layer and presents the information to the sender in one of several types. It is built into each TCP/IP device.
- 11PingIt operates by sending ICMP echo request packets to the target host and waiting for an ICMP echo reply. It is used to test the reachability of a host on an IP network.
- 12Ping SweepIt is the easiest method available to identify active machines on the network, since it combines pings to every address within a range.
- It is a very noisy method, easily identifiable by an IDS. - 13Connectionless CommunicationThe sender doesn’t care whether the recipient has the bandwidth (at the moment) to accept the message, nor does the sender really seem to care whether the recipient gets the message at all. It uses UDP.
- No error correction.
- No re-transmission. - 14Connection-Oriented CommunicationSenders will reach out to recipients, before data is ever even sent, to find out whether they’re available and whether they’d be willing to set up a data channel. Once data exchange begins, the two systems continue to communicate, making sure flow control is accomplished, so the recipient isn’t overwhelmed and can ask for re-transmissions in case something gets lost along the way. It uses header flags and the three-way handshake from TCP.
+ More orderly and trustworthy
- Slower - 15SYN (Synchronize)A TCP flag set during initial communication establishment. It indicates negotiation of parameters and sequence numbers.
- 16ACK (Acknowledgement)A TCP flag set as an acknowledgment to SYN flags. It is set on all segments after the initial SYN flag.
- 17RST (Reset)A TCP flag that forces a termination of communications (in both directions).
- 18FIN (Finish)A TCP flag that signifies an ordered close to communications.
- 19PSH (Push)A TCP flag that forces the delivery of data without concern for any buffering.
- 20URG (Urgent)When this TCP flag is set, it indicates the data inside is being sent out of band.
- 21Three-Way HandshakeThe way a TCP connection is established.
1. To start, the sender forwards a segment with the SYN flag set, indicating a desire to synchronize a communications session. This segment also contains a sequence number—a pseudorandom number that helps maintain the legitimacy and uniqueness of this session.
2. When the recipient gets this segment, it responds with the SYN and ACK flags set and acknowledges the sequence number by incrementing it by one. Additionally, the return segment contains a sequence number generated by the recipient.
3. In the final segment, the ACK flag is set, and the recipient’s own sequence number is acknowledged. A communications channel is then opened, sequence numbers are established on both ends, and data transfer can begin. - 22Port ScanningThe act of manipulating Transport layer protocol flags in order to identify active hosts and scan their ports.
- 23ProxyA system you set up to act as an intermediary between you and your targets. In many instances, they are used by network administrators to control traffic and provide additional security for internal users. Hackers, though, can send them commands and requests, which will be relayed to the targets.
- 24IP Address SpoofingThe hacker uses a packet-crafting tool of some sort to obscure the source IP address of packets sent from their machine.
- 25Source RoutingDesigned to allow applications to specify the route a packet takes to a destination, regardless of what the route tables between the two systems say. The attacker can use an IP address of another machine on the subnet and have all the return traffic sent back, regardless of which routers are in transit.
- 26Packet FragmentationThe process of cracking apart the packets before they’re sent so the IDS can’t recognize them. This is done by splitting the TCP header into several packets, so all the IDS sees is useless chatter.
- 27AnonymizerServices on the Internet that make use of a web proxy to hide your identity.
- 28TunnelingA method for transporting data across a network using protocols that are not supported by that network. Tunneling works by encapsulating packets: wrapping packets inside of other packets. Attackers usually used them to bypass firewalls.
- 29EnumerationThe listing of items we find within a specific target. We create connections to a device, perform specific actions to ask specific questions, and then use the results to identify potential attack vectors. It is an active information gathering process.
- 30Banner Grabbing EnumerationAn enumeration tactic that involves sending an unsolicited request to an open port to see what, if any, default message (banner) is returned. Depending on what version of the application is running on the port, the returned banner (which could be an error message, HTTP header, or login message) can indicate a potential vulnerability for the hacker to exploit.
- 31Network Basic Input/Output System (NetBIOS)A service, part of Microsoft Windows OS, designed to host information about all the machines within the domain or TCP/IP network segment. A “master browser” coordinates list information and allows systems and users to easily find each other.
- 32NetBIOS EnumerationThe act of listing available resources within NetBIOS, like users, groups and others.
- 33Simple Network Management Protocol (SNMP)Service designed to manage IP-enabled devices across a network.
- 34SNMP EnumerationThe act of listing available resources within SNMP, like network configurations. An attacker can also use this method to create backdoors.
Information
- Description
- Mestrado Segurança Informática Flashcards on Scanning and Enumeration Concepts, created by Inês Macedo on 22/04/2021.
- Created by
- Inês Macedo
- Views
- 0
- Rating