An old but still useful technique is wardialing. Wardialing is a technique that has existed for more than 25 years as a footprinting tool, which explains why the process involves the use of modems. Wardialing is very simple: it uses a modem to dial up phone numbers to locate modems. Upon first look, the technique looks sorely out of place in a world of broadband and wireless connection technology, but modems are still widely used due to the low cost of the technology. An attacker who picked a town at random and dialed up a range of phone numbers in that town would likely turn up several computers with modems attached. Wardialing can still be effective even in a world of high-speed connection technologies.

Dialing a range of phone numbers and getting several modems to respond doesn't initially sound significant until what is connected to those modems is considered. While modems are not nearly as popular as they were several years ago, their presence is still felt, as modems can be found connected to devices such as public branch exchanges (PBX), firewalls, routers, fax machines, and a handful of other systems not including actual computers. When you include more sensitive devices such as routers and firewalls, someone dialing up a modem and attaching to a firewall or router remotely takes on new significance. A modem can and should be looked at as a viable backdoor into a network, one that should factor in when planning defensive measures. While there is a long list of wardialing programs that have been created over the years, three well-known wardialing tools include:

Why is wardialing still successful? One of the biggest reasons is the relative lack of attention paid to modems by corporations. Modems tend to be thought of as old, low-tech devices unworthy of serious attention by defenders of a network or attackers. As such, it is not uncommon to find modems attached to networks that are still active, but forgotten and unmonitored. In some cases, modems have been discovered active and attached to a company network only after a phone bill was submitted to closer scrutiny, generating questions about what certain phone numbers are used for.

Wardriving is another valuable technique for uncovering access points into a network. Wardriving is the process of locating wireless access points and gaining information about the configuration of each. This "sniffing" can be performed with a notebook, a car, and software designed to record the access points detected. Additionally, a global positioning system (GPS) can be included to go to the next step of mapping the physical location of the access points. Don't get caught up in names, however; wardriving or variations can be performed with the same equipment while walking, biking, or even flying. If an attacker is able to locate even a single unsecured access point, the dangers can be enormous, as it can give that same attacker quick and easy access to the internal network of a company. An attacker connecting to an unsecured access point is more than likely bypassing protective measures such as the corporate firewall, for example.

While there are a multitude of tools used to perform wardriving, other tools, including the following, are useful in defending against these attacks:

So why is wardriving successful? One of the most common reasons is that employees install their own access points on the company network without company permission (known as a rogue access points). An individual who installs an access point in such a way will more than likely have no knowledge of, or possibly not care about, good security practices and by extension leave the access point completely unsecured. Another reason is that sometimes when an access point has been installed, those performing the installation have actively decided not to configure any security features. Wardriving generally preys upon situations in which security is not considered or is poorly planned. Steps should be taken to ensure that neither happens.

A technique that is useful at determining whether a system is present and active is a ping sweep of an IP address range. By default, a computer will respond to a ping request with a ping reply or echo. A ping is actually an Internet Control Message Protocol (ICMP) message. With the use of a ping, it is possible to identify active machines and measure the speed at which packets are moved from one host to another as well as obtain details such as the Time to Live (TTL).

A key advantage of ICMP scanning is that it can be performed rapidly because it runs scanning and analysis processes in parallel. In other words, it means more than one system can be scanned simultaneously; thus it is possible to scan an entire network rapidly. There are several tools available that can perform ping scans, but three of the better known ones include Pinger, Friendly Pinger, and WS Ping Pro.

Of course, for every pro there is a con, and pinging in this manner is not without issue. First, it is not uncommon for network administrators to specifically block ping at the firewall or even turn off ping completely on host devices. Second, it is a safe bet that any intrusion detection system (IDS) or intrusion prevention system (IPS) that is in place will detect and alert network managers in the event a ping sweep occurs. Finally, ping sweeps have no capability to detect systems that are plugged into the network but powered down.

The next step to take after discovering active systems is to find out what is available on the systems; in this case, a technique known as port scanning is used. Port scanning is designed to probe each port on a system in an effort to determine which ports are open. It is effective for gaining information about a host because the probes sent toward a system have the ability to reveal more information than a ping sweep can. A successful port scan will return results that will give a clear picture of what is running on a system. This is because ports are bound to applications.

A discussion of port scanning can't proceed without a clear understanding of some of the fundamentals of ports. In all, there are 65,535 TCP and 65,535 UDP ports on any given system. Each of these port numbers identifies a specific process that is either sending or receiving information at any time. At first glance, it might seem that a security professional would have to memorize all 65,000 plus ports in order to be adequately prepared, but this is not the case. In reality, only a few ports should ever be committed to memory, and if a port scan returns any ports that are not immediately recognizable, those port numbers should be further scrutinized. Some common port numbers are shown in Table 6-1.

Contained in the list of common port numbers in Table 6-1 is an important detail located in the last column. In this column, the protocol in use is listed as either TCP or UDP (the same protocols discussed earlier when reviewing the TCP/IP suite of protocols). In practice, applications that access the network can do so using either TCP or UDP, based on how the service is designed. An effective port scan will be designed to take into account both TCP and UDP as part of the scanning process; these protocols work in different ways. TCP acknowledges each connection attempt; UDP does not, so it tends to produce less reliable results.

netstat -n -p TCP

Nmap is one of the most widely used security tools and a firm understanding of Nmap is considered a requirement for security professionals. At its core, Nmap is a port scanner that has the ability to perform a number of different scan types. The scanner is freely available for several operating systems, including Windows, Linux, MacOS, and others. By design, the software runs as a command line application, but to make usage easier, a graphical user interface (GUI) is available through which the scan can be configured. The strength of Nmap is that it has numerous command line switches to tailor the scan to return the desired information. The most common command switches are listed in Table 6-3.

To perform an Nmap scan, at the Windows command prompt, type Nmap IP address, followed by the switches that are needed to perform the scan desired. For example, to scan the host with the IP address 192.168.123.254 using a full TCP connecting scan type, enter the following at the command line:

Nmap -sT 92.168.123.254

The response will be similar to this:

Starting Nmap 4.62 (http://nmap.org) at 2010-03-21 10:37 Central
Daylight Time
Interesting ports on 192.168.123.254:
Not shown: 1711 filtered ports
PORT STATE SERVICE
21/tcp open ftp
80/tcp open http
2601/tcp open zebra
2602/tcp open ripd
MAC Address: 00:16:01:D1:3D:5C (Linksys)
Nmap done: 1 IP address (1 host up) scanned in 113.750 seconds

These results are providing information about the victim system, specifically the ports that are open and ready to accept connections. Additionally, since the scan was performed against a system on the local network, it also displays the media access control (MAC) address of the system being scanned. The port information can be used later to obtain more information as will be explored later.

Nmap's results can display the status of the port in one of three states:

Figure 6-1. Superscan.

Superscan is a Windows-based port scanner developed by Foundstone. This port scanner is designed to scan TCP and UDP ports, perform ping scans, run Whois queries, and use tracert. Superscan is a GUI-based tool that has a preconfigured list of ports to scan or can be customized to scan a specific range. It's shown in Figure 6-1.

Scanrand is a scanning tool that is designed to scan a single host up to large-scale networks quickly and then return results about the network. Scanrand is unique among network scanners because although most scan a port at a time, Scanrand scans ports in parallel using what is known as stateless scanning. By using stateless scanning, Scanrand can perform scans much faster than other network scanners.

Stateless scanning is an approach to scanning that splits scanning into two distinct processes. The two processes work together to complete the scanning process with one process transmitted and the other listening for results. Specifically, the first process transmits connection requests at a high rate, and the second process is responsible for sorting out the results. The power of this program is a process known as inverse SYN cookies.

Scanrand builds a hashed sequence number that is placed in the outgoing packet that can be identified upon return. This value contains information that identifies source IP, source port, destination IP, and destination port. Scanrand is useful to a security professional when a large number of IP addresses need to be scanned quickly.

THC-Amap (Another Mapper) is a scanner that offers a different approach to scanning. When using traditional scanning programs, problems arise when services that use encryption are scanned, because these services might not return a banner, due to the fact that certain services such as the Secure Sockets Layer (SSL) expect a handshake. Amap handles this by storing a collection of normal responses that can be provided to ports to elicit a response. The tool also excels at allowing the security professional to find services that have been redirected from standard ports.

The process of active OS fingerprinting is accomplished by sending specially crafted packets to the targeted system. In practice, several probes or triggers are sent from the scanning system to the target. When the responses are received from a targeted system, based on the responses an educated guess can be made as to the OS that is present. Though it may appear otherwise, OS identification is an accurate method of determining the system in place because the tools have become much more accurate than in the past.

75% Windows 7
20% Windows XP
5% Windows 98

Nmap -O 192.168.123.254
Starting Nmap 4.62 (http://nmap.org) at 2010-03-21 12:09 Central
Daylight Time
Interesting ports on 192.168.123.22:
Not shown: 1712 closed ports
PORT STATE SERVICE
80/tcp open http
2601/tcp open zebra
2602/tcp open ripd
MAC Address: 00:16:01:D1:3D:5C (Netgear)
Device type: general purpose
Running: Linux 2.4.X
OS details: Linux 2.4.18-2.4.32 (likely RedHat)
Uptime: 77.422 days (since Sun Jan 03 01:01:46 2010)
Network Distance: 1 hop

The alternative to active fingerprinting is passive fingerprinting, which approaches the process differently. Passive fingerprinting, by design, does not interact with the target system itself. It is a passive tool that monitors or captures network traffic. The traffic monitored is analyzed for patterns that would suggest which operating systems are in use. Passive OS fingerprinting tools simply sniff network traffic and then match that traffic to specific OS signatures. The database of known patterns can be updated from time to time as new operating systems are released and updated. As an example, a tool may have a fingerprint for Windows Vista but will need to be updated to include Windows 7.

A passive identification requires larger amounts of traffic, but offers a level of stealth, as it is much harder to detect these tools, since they do not perform any action that would reveal their presence. These tools are similar in that they examine specific types of information found in IP and TCP headers. While you do not need to understand the inner workings of TCP/IP to use these tools, you should have a basic understanding as to what areas of these headers these tools examine. These include:

C:>p0f -i2
p0f-passive os fingerprinting utility, version 3.0.4
(C) M. Zalewski <[email protected]>, W. Stearns <wstearns@pobox
.com>
WIN32 port (C) M. Davis <[email protected]>, K. Kuehl <[email protected]>
p0f: listening (SYN) on 'DeviceNPF_{AA134627-43B7-4FE5-AF9B
-18CD840ADW7E}', 11
2 sigs (12 generic), rule: 'all'.
192.168.123.254:1045-Linux RedHat

Cheops is an open source network management tool that can assist in viewing the network layout and the devices therein. Cheops can assist an attacker in the same way it would assist a network admin—it performs tasks such as identifying hosts on a network and the services each offers. Even more useful is the ability to display the whole network in a graphic format showing the paths of data between systems on the target network.

Solarwinds is another network management tool that can be used to render a diagram of a network and the services within. Solarwinds has the ability to detect, diagram, and reflect changes in the network architecture with a few button clicks. It is even possible for Solarwinds to generate network maps that can be viewed in products such as Microsoft's diagramming product Visio.