Ethical Hacking - Fingerprinting
The term OS fingerprinting in Ethical Hacking refers to any method used to determine what operating system is running on a remote computer. This could be –
● Active Fingerprinting − Active fingerprinting is accomplished by sending specially crafted packets to a target machine and then noting down its response and analyzing the gathered information to determine the target OS. In the following section, we have given an example to explain how you can use NMAP tool to detect the OS of a target domain.
● Passive Fingerprinting − Passive fingerprinting is based on sniffer traces from the remote system. Based on the sniffer traces (such as Wireshark) of the packets, you can determine the operating system of the remote host.
We have the following four important elements that we will look at to determine the operating system −
● TTL − What the operating system sets the Time-To-Live on the outbound packet.
● Window Size − What the operating system sets the Window Size at.
● DF − Does the operating system set the Don't Fragment bit.
● TOS − Does the operating system set the Type of Service, and if so, at what.
By analyzing these factors of a packet, you may be able to determine the remote operating system. This system is not 100% accurate, and works better for some operating systems than others.
Before attacking a system, it is required that you know what operating system is hosting a website. Once a target OS is known, then it becomes easy to determine which vulnerabilities might be present to exploit the target system.
You can hide your main system behind a secure proxy server or a VPN so that your complete identity is safe and ultimately your main system remains safe.
Once a hacker knows about open ports, then he can plan different attack techniques through the open ports.
It is always recommended to check and close all the unwanted ports to safeguard the system from malicious attacks.
A ping sweep is a network scanning technique that you can use to determine which IP address from a range of IP addresses map to live hosts. Ping Sweep is also known as ICMP sweep.
You can use fping command for ping sweep. This command is a ping-like program which uses the Internet Control Message Protocol (ICMP) echo request to determine if a host is up.
fping is different from ping in that you can specify any number of hosts on the command line, or specify a file containing the lists of hosts to ping. If a host does not respond within a certain time limit and/or retry limit, it will be considered unreachable.
To disable ping sweeps on a network, you can block ICMP ECHO requests from outside sources. This can be done using the following command which will create a firewall rule in iptable.
$iptables -A OUTPUT -p icmp --icmp-type echo-request -j DROP
Domain Name Server (DNS) is like a map or an address book. In fact, it is like a distributed database which is used to translate an IP address 192.155.1.120 to a name www.tgdctudthjgjjfvj.com and vice versa.
DNS enumeration is the process of locating all the DNS servers and their corresponding records for an organization. The idea is to gather as much interesting details as possible about your target before initiating an attack.
You can use nslookup command available on Linux to get DNS and host-related information. In addition, you can use the following DNSenum script to get detailed information about a domain −
https://code.google.com/archive/p/dnsenum/downloadsimportant operations −
● Get the host's addresses
● Get the nameservers
● Get the MX record
● Perform axfr queries on nameservers
● Get extra names and subdomains via Google scraping
● Brute force subdomains from file can also perform recursion on subdomain that has NS records
● Calculate C class domain network ranges and perform whois queries on them
● Perform reverse lookups on netranges
DNS Enumeration does not have a quick fix and it is really beyond the scope of this tutorial. Preventing DNS Enumeration is a big challenge.
If your DNS is not configured in a secure way, it is possible that lots of sensitive information about the network and organization can go outside and an untrusted Internet user can perform a DNS zone transfer.
0 Comments