In this lesson,
we're going to explore the process of enumerating hosts,
which is a key step in penetration testing.
Before starting any active attacks,
we need to map the network to understand
the hosts and services running in the target environment.
By identifying these elements,
testers can tailor their attacks
and uncover potential vulnerabilities.
Now, detecting interesting hosts on the network
involve several methods that provide insights
into the devices, their operating systems,
and the services in use.
Let's start by discussing some of the primary methods used
in the host discovery phase.
First, let's discuss ping scans.
Ping scans involve sending ICMP echo requests
to a range of IP addresses
to determine which machines are responsive.
Essentially, we're trying to see if the system is online.
For instance, using a tool like Nmap
we can use the command nmap -sn 192.
168.1.0/24
This can show active hosts within a specified subnet
by identifying those that respond to the ping request.
Sometimes, we will not get a response
even though the host is up
due to security configurations on the target host
which blocks ping responses
because they know this is often used by attackers
who are scoping out their network.
Next, we have TCP scans.
These scans check for open
and listening TCP ports on the target host,
helping testers identify what services are running.
For example, executing nmap
sS 192.168.1.10
will initiate a TCP SYN scan on a specific IP address,
revealing open ports and the services associated with them.
Now, this helps us figure out
which services are up and running on that target host
from ranges 1-1000 open ports.
OS footprinting is another useful technique
that we should discuss.
It involves identifying the operating systems
running on the network's host.
Nmap can detect the OS and version
by analyzing various characteristics of the network stack.
Using the command nmap -O scanme.nmap.org
allows testers to gather this information
by tailoring subsequent attacks
to specific vulnerabilities of those operating systems.
For example, if a host responds to a TCP probe
within 10-20 milliseconds,
it might indicate that it's a Linux system,
whereas response times of 50-100 milliseconds
could suggest a Windows system.
These differences in response times
help in identifying the underlying operating system.
When running into firewalls or other network defenses,
testers can adjust their scanning techniques.
For example, if we use the address from scanme.nmap.org
to test if ICMP pings are blocked,
we might use a TCP ACK Ping
with the command nmap
PA80 45
.33.32.0/24
to set the acknowledgement flag on the TCP header,
or a UDP Ping with the command nmap
PU53 45.33
.32.0/24
to use the User Datagram Protocol for host discovery.
Another method includes the TCP SYN Ping,
which sends a TCP SYN to specified ports
and can be executed with a command like
nmap -PS22
25,80,110
45.33.32.0/24.
Another useful scan is the SCTP Initiation Ping.
Using the Stream Control Transmission Protocol
as an alternative to TCP or UDP.
For example, the command nmap -sY 45
.33.32.0/24
can help determine if a host is alive
by checking for responses to SCTP packets.
During the scanning process,
Nmap will arrange ports into one of four states:
open, closed, filtered, or unfiltered.
Open ports are responsive and indicate active services,
while closed ports do not respond to probes.
Filtered ports are blocked by a firewall,
and unfiltered ports are accessible,
but Nmap cannot determine if they're open or closed.
In some cases, pentesters might skip
the discovery phase altogether
and treat all hosts online
using a switch option -Pn in Nmap,
Also, they might perform a network discovery
without a port scan
using -sn, or running a script
without either a ping or port scan
by combining dash capital -Pn and -sn.
Credentialed scans often provide more detailed information.
For example, using a tool like Nessus
with valid credentials can reveal extensive details
about hosts, such as configuration settings
and software vulnerabilities
because of the trusted nature of the scan
which allows the scanner to tell you more about the system.
Windows host enumeration can involve commands like
net view, arp -a, and
ipconfig /displaydns
to gather information
on network shares, ARP caches, and DNS caches.
For example, running the net view command
in a Windows environment might return a list
of visible hosts on the local network.
An example might look like this.
This output shows the results of the net command,
which lists the shared resources on the Windows network.
You can see the server names and their descriptions.
As mentioned before, this information
can identify potential targets
and allow us to tailor our strategy.
For example, the DC01 server
could be the first target we investigate
since domain controllers are critical
as they manage the security, authentication,
and access controls for the entire network.
Compromising a Domain Controller can provide
administrative access to the entire domain.
Active Directory (AD) enumeration is also critical.
Tools like PowerShell with cmdlets such as Get-ADDomain,
Get-ADComputer,
and Get-ADGroupMember
can provide detailed information
on computers and organizational units.
For example, the PowerShell cmdlet
Get-ADComputer -Filter *
can list all the computers in the domain,
which is important for identifying high-value targets.
So remember, enumerating hosts
is a foundational task in penetration testing
that involves various techniques
to map the network and identify the devices,
operating systems, and the services in use
by utilizing ping scans, TCP scans, OS footprinting,
and adjusting scan methods as needed,
testers can gather details about the target environment.
This information is an important part
of our active reconnaissance phase
to get us ready for attacks and exploits later on.