In this lesson, we will explore the technique
of banner grabbing, a useful component
of the reconnaissance phase in pentesting.
Banner grabbing involves extracting information
about a target system's network services
running on open ports.
This method helps identify service details
such as the type of server software, versions,
and sometimes even the operating systems,
which can be very useful in tailoring future attacks.
Banner grabbing is essentially initiating communication
with the service and tricking it
into revealing details about itself.
This can be done with various tools that make connections
to the target's port and sends requests
that prompt the service to respond with banner information.
Banner information typically includes detail
about the service configuration
and then can be researched to discover vulnerabilities.
Now, let's discuss a few of those tools that we can use
to perform banner grabbing.
First, there's Wget.
This simple yet powerful command line utility
can fetch content from web servers.
Using the command: wget -S,
testers can receive server headers
which include HTTP banners.
For example: if you were to type in
wget www.diontraining.com -S,
you will see the following.
This command prints the HTTP headers sent by the server,
revealing the web server type and version
among other headers.
Initially, the request is redirected from HTTP to HTTPS
via a 301 Moved Permanently response,
indicating the website enforces secure connections.
After that, you see the final HTTPS request
successfully retrieves the page content,
displaying HTTP headers that include server
and cache details.
Next, there is Netcat. Often referred to
as the Swiss Army knife for TCP/IP,
Netcat is a versatile tool
in network debugging and investigation.
For instance, you can use Netcat
to send a custom HTTP GET request
to a web server to elicit a banner.
Let's look at the following command:
echo -en "GET /HTTP/
1.0\n\n" | nc
www.diontraining.com 80 |
grep Server.
This command outputs the 'Server' header,
by piping in the grep command,
which typically contains the type
and version of the web server.
Now, when I say pipe, that's just a Linux term
meaning that I will feed the results from one command
into the next one.
Then our next tool is Nmap.
Known for its versatility in network scanning,
Nmap can also be used to perform service version detection
using the -sV flag.
This can be combined with the Nmap Scripting Engine or NSE,
for more advanced banner grabbing.
The format is as follows: nmap -sV
-script=banner
and then you input the target IP address or DNS name.
This will scan the specific target
and attempt to grab banners from each service it discovers.
The last tool we will discuss is Curl.
Curl is another tool that can be used to retrieve banners,
especially from web servers.
Using the command curl -I
and then whatever URL you want,
you can fetch the HTTP headers of that server.
For example:
curl -I www.diontraining.com
you will receive the following results.
This will display headers that are often include
the server type and version, which are useful
for identifying potential security vulnerabilities.
Imagine you grab a banner and then find that the server
is running an outdated version of Apache.
Let's look at the following example output.
Here, we see the server is running
Apache version 2.2.34
which is susceptible to a serious vulnerability
known as "Optionsbleed" which is found
with the CVE-2017-9798.
This vulnerability arises from improper handling
of the HTTP OPTIONS method,
which can reveal memory contents
or lead to information disclosure
when the limit directive is used in .htaccess file
with certain misconfigurations.
This issue affects all patches in the Apache HTTP Server
through 2.2.34 and some versions of
2.4.whatever.
Now, we don't need to understand all
of what's going on here,
we just need to know that this vulnerability
is associated with this version
and that this vulnerability poses a risk
of leaking server memory,
which might contain sensitive information,
thereby making it a critical target for exploitation.
So remember, banner grabbing is a potent reconnaissance tool
that provides essential details about the services running
on a network's open ports.
By understanding how to use tools like Wget, Netcat, Nmap,
and Curl for banner grabbing,
pentesters can gain a significant advantage
in assessing a target's security posture.
This knowledge not only guides the direction
of further pentesting activities,
but also aids in crafting specific exploits
based on the discovered vulnerabilities.