Tag: scanning

  • Basic Port Scanning With Nmap

    Basic Port Scanning With Nmap

     

     

    What is Nmap all about?

    Taken from the Nmap website… (I bolded the best bits)

     

    Quote:
    Nmap (“Network Mapper”) is a free and open source (license) utility for network exploration or security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are avalable for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), and a utility for comparing scan results (Ndiff).

    What will this guide show me?

    I aim to give you a basic insight into how you can use Nmap through it’s command line interface to scan networks and individual hosts. I will also show you some different scan techniques, and provide a list of some ports and the services which run on them.

    Installing Nmap

    1. Visit the Nmap website – http://nmap.org/download.html
    2. Choose your OS, and follow the instructions.
    3. Keep in mind that I am writing this guide using Linux and a command line to run Nmap. If you’re on Windows, you’ll probably have the GUI version. While this looks different, you can use the same commands and it does the same thing.

    Obtaining a list of hosts through a ping scan

    If you’re on your own network, you should already know which devices are connected. To find the IP addresses of these, I usually run the following scan…

    nmap -sP 192.168.0.0-255

    This will pingscan the network between hosts 192.168.0.0 all the way up to 192.168.0.255. Once the scan is complete, you should see a result like this…

    Nmap Ping Scan

    Port Scanning a Host

    Once you have found the host you wish to scan, you can go ahead and scan it. Before scanning, you may wish to take a look at the list of scanning techniques on the Nmap website. These can be used to add extra functionality to your scans giving them more detailed results.

    The simplest port scan you could run would be as follows…

    • nmap 192.168.0.1 (replace IP address with your host of choice).

    In my case, this would be my router being scanned although I could have scanned any device on the network. It displays this output once I have scanned it…

    Nmap Port Scan Ubuntu

    From this screen, we can tell which ports are open or closed. In this case, my HTTP port (80) is open because I am running a webserver. However, this open port could be seen as a vulnerable hole in the firewall – something which could be used as a way into a system and a way of gaining a shell/complete access to a computer system.

    List of common TCP ports

    When port scanning (either from an attacking or defensive point of view), you’re looking for open ports and services which could be exploited in some way. Below is a list of the most commonly found TCP ports, and the services which run on them.

    20 FTP data (File Transfer Protocol)
    21 FTP (File Transfer Protocol)
    22 SSH (Secure Shell)
    23 Telnet
    25 SMTP (Send Mail Transfer Protocol)
    43 whois
    53 DNS (Domain Name Service)
    68 DHCP (Dynamic Host Control Protocol)
    79 Finger
    80 HTTP (HyperText Transfer Protocol)
    110 POP3 (Post Office Protocol, version 3)
    115 SFTP (Secure File Transfer Protocol)
    119 NNTP (Network New Transfer Protocol)
    123 NTP (Network Time Protocol)
    137 NetBIOS-ns
    138 NetBIOS-dgm
    139 NetBIOS
    143 IMAP (Internet Message Access Protocol)
    161 SNMP (Simple Network Management Protocol)
    194 IRC (Internet Relay Chat)
    220 IMAP3 (Internet Message Access Protocol 3)
    389 LDAP (Lightweight Directory Access Protocol)
    443 SSL (Secure Socket Layer)
    445 SMB (NetBIOS over TCP)
    666 Doom
    993 SIMAP (Secure Internet Message Access Protocol)
    995 SPOP (Secure Post Office Protocol)

    Summary

    This guide hasn’t been particularly in depth – I realize that. I have however, given you a slight nudge in the right direction with port scanning, and how you can do it. To understand it more, you should take the time to read some tutorials and guides on the subject. Here are some useful links.

    Nmap
    Backtrack Forums
    List of Nmap Commands
    Irongeek

  • Beginners Guide to Radio Scanning

    Beginners Guide to Radio Scanning

    Daktologist’s Beginners Guide To Radio Scanning

    Before I begin I would like to say that this is from personal experience and worked for me but you may have different ideas so please add your ideas :). This guide shows my current set up and deals with setting up a desktop scanner due to the slightly more difficult set up required, although hand held scanners are available they are simple to set up and mainly require you to insert the correct batteries attach the supplied antenna and your ready to go. Unfortunitly in parts of the world scanning is illegal ( parts of Europe from memory. ) so if you get arrested it isn’t my problem, fortunately here in nz you can listen to anything you want apart from encrypted signals so it is no problem.

    Anyway first you will want to find a place for your scanner preferably close to a power socket so you can plug it in and close to where you will put your antenna as you will want to keep your antenna cable as short as possible to prevent signal losses which prevent reception of weak signals.

    The other main thing you will want to do is google the frequencies of things like the police and airport or whatever you want to listen in your area too as this makes things easier than trying to search for the frequencies of things manually as it may take a while. I commonly listen to the cops as some funny shit does happen from time to time, that and it can be handy to know if your about to be raided or what not, and you can listen in on phone calls and the lulz do ensue from time to time especially listening in on people you know, its amazing what you can learn about someone from their phone calls.

    Anyway its up to you really what you can listen to and your scanner can unlock this whole different world of radio you didn’t know existed.

    So what can you listen to other than the cops and the phone calls of that random girl you use to work with you ask? Well apart from law enforcement there’s air traffic, utility’s, fire, ambulance, pagers, your neighbours outdated cordless phone, shipping, the international space station and the list goes on

    Welcome to the world of Radio Scanning

    Receiver

    The Receiver or “Scanner” as it is also known is by far the most important part as if you didn’t have it the rest of this guide would be useless, as you can see in the pic below i am using the Uniden UBCT8 as it is easy to set up and to use especially for a beginner and will get you scanning the airwaves in no time. Scanners either come as a desk unit as mine is or a hand held unit as the pic of my hand held scanner shows

    The Receivers that I’m currently using:

    Desktop Scanner

    Handheld Scanner

    Antennas

    I personally just used a spare TV antenna that i had lying around and it was the cheapest option for me, as you can see in the next pic I have it in the vertical orientation as nearly all signals around here are vertically polarised. You may want to play around with the orientation as the polarisation of the signal you want to receive may be different to what it is for me. It is important that you get the polarisation right as you can go from receiving a strong clear signal in one orientation to no signal at all or at the very most a weak and noisy signal in the other so it pays to check the polarisation before blaming the weak signal on being too far away from its source or a useless antenna

    My Antenna:

    as you can see I have two antennas connected which are connected to the scanner through a splitter ( not shown ) as I’m trying to receive signals from two locations, at times yagi antennas like the antenna on the right can be a pain as they are directional where is the folded dipole on the left isn’t and allows reception of signals from any direction. I mainly have the yagi for receiving the somewhat weak signals from the airport ground control and from the closest city, mainly due to the radio traffic being higher and there being more to listen in on and therefore have it pointing about halfway between the airport and town so I can receive signals from both somewhat while the folded dipole makes it easier to receive signals from nearby as well as strong signals from town

    Cabling

    The cable between your scanner and antenna is an important part as is the choice in cable type. Coaxial cable is recommended as cable losses are lower than just using regular electrical cable or 300 ohm ribbon cable ( old style TV cable ) if you do use ribbon cable ensure it doesn’t come in contact with metal objects such as the antenna mounts as this increases losses. coax can be attached to metal objects as it is shielded. I use RG6 coax usually as it exhibits lower losses than RG59 or similar

    Connectors

    Attaching the correct connector to the cable for your scanner is important as if you get this wrong you cannot connect your cable to your scanner obviously. The two most common connectors are the BNC connector which you push and turn to attach it, and the N connector which is slightly larger and screws onto the socket on the receiver. As you may be able to see in one of the pics below you can see that i am using an F connector to BNC adaptor as it was what i had at the time and these can be an option if you have a TV antenna with an F connector attached to the cable already or if you have a screw on F connector as crimp on BNC connectors need a proper crimp tool to attach them and the crimp tool can be expensive. I commonly use F connectors and an adapter as it is quick and easy to attach to the cable. In case you are asking your self “what is an “F” connector well they are the same as the screw on connector that is on the cable that feeds your satellite TV receiver

    BNC Plug

    BNC Socket on the back of my scanner

    Balun

    A balun is a impedance matching transformer that converts the balanced 300 Ohm output of the antenna to the unbalanced 75 ohm coaxial cable. If you don’t use a balun then weak signals can be harder or impossible to receive

    The balun that is on my antenna:

    Discuss this.