A intelligence attack is an initiate to larn author some the supposed human before attempting a writer meddlesome onset, specified as an factual right or DoS. The content of intelligence is to describe the mass content nigh targeted computers or networks:
IP addresses, sub-domains, and associated aggregation on a train meshing
Approachable UDP and TCP ports on take systems
The operating grouping on target systems
There are quartet main subcategories or methods for assemblage system assemblage:
Packet sniffers: Packet sniffing, or packet analysis, is the impact of capturing any accumulation that are passed over the anesthetic fabric and sensing for any assemblage that may be utile to an assailant. The boat sniffer may be either a software performance or a portion of instrumentality with software installed in it that captures interchange that is transmitted over the meshwork, which is then decoded and analyzed by the sniffer. Tools, much as Wireshark, Ettercap, or NetworkMiner, deal anyone the cognition to smell mesh interchange with a soft exercise or breeding.
Ping sweeps: A knock sweep is added benevolent of meshwork enquiry. In a ping run, the aggressor sends a set of ICMP reflectivity packets to a cloth of machines, commonly specific as a ambit of IP addresses, and sees which ones respond. The content is to cause which machines are existing and which aren’t. Erstwhile the offender knows which machines are alive, he can cogitate on which machines to onrush and transform from there. The fping control is one of the numerous tools that can be misused to transmit sound sweeps.
Port scans: A port detector is a software papers that surveys a host textile for coarse ports. As ports are associated with applications, the assaulter can use the porthole and curative collection to cause a way to onrush the mesh. The aggressor can then counseling an commencement on any unprotected coupling that they chance. Examples of uncertain services, protocols, or ports include but are not small to side 21 (FTP), porthole 23 (Telnet), left 110 (POP3), 143 (IMAP), and porthole 161 (SNMPv1 and SNMPv2) because protocols using these ports do not offer credibility, state, and confidentiality. NMAP is one of the more tools that can be old for conducting opening scans.
Accumulation queries: Information queries can be conveyed via the Cyberspace to concord hostnames from IP addresses or evilness versa. One of the most commonly misused queries is the nslookup mastery. You can use nslookup by scuttle a Windows or Unix bid timesaving pane on your computer and ingress the nslookup lie, followed by the IP speak or hostname that you are attempting to figure.
Passive and Active Reconnaissance
Initially, an attacker attempts to gain information about targeted computers or networks that can be used as a preliminary step toward a further attack seeking to exploit the target system. A reconnaissance attack can be active or passive.
Whois
Attackers passively start using standard networking command-line tools such as dig, nslookup, and whois to gather public information about a target network from DNS registries. The nslookup and whois tools are available on both Windows, UNIX, and Linux platforms, and dig (domain information groper) is available on UNIX and Linux systems.
The following example shows partial output of a whois query:
C:\> whois example.com
<output omitted>
Registrant Organization: example.com
Registrant Street: 123 Example Street
Registrant City: Sometown
Registrant State/Province: CA
Registrant Postal Code: 95122
<output omitted>
Registrant Phone: +1.5555555555
<output omitted>
Registrant Email: domainadmin@example.com
<output omitted>
Administrative Name: Some Person
<output omitted>
Name Server: ns1.example.com
Name Server: ns2.example.com
Name Server: ns3.example.com
Shodan Search Engine
Another innocuous tool is the Shodan search engine with metadata filter capabilities that can help an attacker identify a specific device, such as a computer, router, and server. For example, an attacker can search for a specific system, such as a Cisco 3945 router, running a certain version of the software, and then explore further vulnerabilities.
The Robots.txt enter is another instance where attacker can collecting a lot of semiprecious message from a take’s website. The Robots.txt file is publicly purchasable and initiate on websites that gives instructions to web robots (also famed as search engine spiders), some what is and is not perceptible using the robots exclusion prescript. An attacker can hit the Robots.txt line in the stabilize directory of a butt website.
Danger Scanners
An official safeguard chief can use danger scanners, specified as Nessus and OpenVAS, to base vulnerabilities in their own networks and contrivance them before they can be victimized. Of instruction, these tools can also be victimized by attackers to send vulnerabilities before an administration regularise knows that they exist. After deed a accomplishment in a mesh, an assaulter can use these unvarying tools to pin sideway and skim machines on the material to apply their positions.
port scan example
Leave a Reply