Your IP (Internet Protocol) address is your unique ID on the internet. It’s synonymous with your home address. Anyone in the world can contact your computer through its IP address, and send a retrieve information with it.
I’m sure at one time or another you’ve heard that hackers can hack your computer via your IP address. This is one of the reasons proxies and anonymity services exist, to protect people from learning your IP address. So how are hackers using just an address to get into your computer and make your life hell?
Open ports. Your computer runs services like media sharing on what are called ports. A port is just an opening that a service uses as a communications endpoint. There are 65,535 total allocated ports in TCP/UDP. To exploit a service on a port, a hacker wouldbanner grab for the software and version. After they learn that information, they would search sites like Packet Storm for known exploits to run against the service.
Today’s Null Byte is going to demonstrate a simple “port scan” on local computer using Nmap, and teach how a hacker would exploit these services, as well as how to guard ourselves against it. This will be done under Linux, but Nmap is available for all platforms. If you can’t figure out how to install it in Windows with the GUI installer (yeah, right), follow along using Cygwin.
Step 1 Download & Install Nmap
Bold words are commands that must be entered in a terminal emulator.
First, we must download Nmap, which is going to be our tool that we use for port scanning and information gathering:
Now, extract the archive:
tar -zxvf nmap-5.51.tar.bz2
Change to the newly made directory:
cd <directory name>
This is the standard installation procedure:
make && sudo make install
Nmap should now be installed!
Step 2 Scan for a Target
Let’s scan a local computer. I’m going to use a website as an example, rather than a local computer. This is because my firewall is absolutely crazy, and filters out scans. Don’t scan a remote computer with the intentions of doing bad deeds. This is for educational purposes only.
Start by mapping out your local network:
sudo nmap -sP 192.168.1.0/24
That should return a list of hosts that are up for a port scan!
Step 3 Scan Your Individual Target
Out of the returned list of targets, pick one that you would like to scan for services. Let’s do a full scan of all the TCP/UDP ports:
sudo nmap -p 1-65535 -T4 -A -v <target IP goes here>
You should get something that looks like the following image:
Step 4 Banner Grabbing
For this, you can use the regular ol’ telnet client. Telnet comes with Windows and most Linux distros:
telnet <host IP> <port banner to grab>
From this, I would learn which software version the service is running, then see if I can find a way to exploit it.