1 1 00:00:00,600 --> 00:00:02,610 Enumeration Tools. 2 2 00:00:02,610 --> 00:00:04,410 In this lesson, we are going to talk about 3 3 00:00:04,410 --> 00:00:07,260 some of the enumeration tools that we're going to experience 4 4 00:00:07,260 --> 00:00:09,360 as we're trying to enumerate our networks. 5 5 00:00:09,360 --> 00:00:11,880 Now, what exactly is enumeration? 6 6 00:00:11,880 --> 00:00:14,430 Well, enumeration is the process to identify 7 7 00:00:14,430 --> 00:00:17,790 and scan network ranges and hosts that belong to the target 8 8 00:00:17,790 --> 00:00:20,220 and then map out an attack surface. 9 9 00:00:20,220 --> 00:00:22,950 So essentially, if an attacker is looking at your network, 10 10 00:00:22,950 --> 00:00:24,600 they're trying to enumerate to figure out 11 11 00:00:24,600 --> 00:00:27,030 what the network looks like so they can attack it. 12 12 00:00:27,030 --> 00:00:29,610 But as defenders, we're also going to enumerate our network, 13 13 00:00:29,610 --> 00:00:31,980 because we want to know what our attack surface is. 14 14 00:00:31,980 --> 00:00:35,880 And so enumeration is used by both attackers and defenders. 15 15 00:00:35,880 --> 00:00:37,710 Now, as we start looking at enumeration, 16 16 00:00:37,710 --> 00:00:40,020 there is really two kinds of enumeration. 17 17 00:00:40,020 --> 00:00:43,530 We have active enumeration and passive enumeration. 18 18 00:00:43,530 --> 00:00:45,420 When we talk about an active enumeration, 19 19 00:00:45,420 --> 00:00:47,100 this occurs when a connection is made 20 20 00:00:47,100 --> 00:00:48,930 from the attacker to a target 21 21 00:00:48,930 --> 00:00:51,930 and there's data being transmitted back and forth. 22 22 00:00:51,930 --> 00:00:53,610 Now, when we are dealing with that, 23 23 00:00:53,610 --> 00:00:55,350 sometimes we don't want to be active, 24 24 00:00:55,350 --> 00:00:58,050 because by being active, somebody can detect us 25 25 00:00:58,050 --> 00:00:59,880 because we're actually touching their system. 26 26 00:00:59,880 --> 00:01:01,980 We also can be traced back if we're an attacker, 27 27 00:01:01,980 --> 00:01:03,600 and that wouldn't be good for us either. 28 28 00:01:03,600 --> 00:01:05,460 So a lot of attackers use what's known 29 29 00:01:05,460 --> 00:01:07,410 as a semi-passive technique. 30 30 00:01:07,410 --> 00:01:09,930 Now, a semi-passive technique is going to use sparse 31 31 00:01:09,930 --> 00:01:12,690 and widely dispersed attempts to make that connection 32 32 00:01:12,690 --> 00:01:14,940 to the target during their reconnaissance. 33 33 00:01:14,940 --> 00:01:17,340 The reason they do this is because if they're active 34 34 00:01:17,340 --> 00:01:19,560 and they're actually reaching out and touching your machine 35 35 00:01:19,560 --> 00:01:21,150 and they're doing it very quickly, 36 36 00:01:21,150 --> 00:01:22,830 you can detect that very quickly. 37 37 00:01:22,830 --> 00:01:24,630 Most intrusion detection systems 38 38 00:01:24,630 --> 00:01:26,910 will be able to detect things like port scans 39 39 00:01:26,910 --> 00:01:28,590 and different enumeration techniques 40 40 00:01:28,590 --> 00:01:31,290 from an attacker because those are active methods. 41 41 00:01:31,290 --> 00:01:33,540 But if you're using a semi-passive method 42 42 00:01:33,540 --> 00:01:35,670 and you wait a long time in between each ping 43 43 00:01:35,670 --> 00:01:38,370 or each type of probe, that can actually delay it 44 44 00:01:38,370 --> 00:01:40,230 and make the IDS miss it. 45 45 00:01:40,230 --> 00:01:43,200 Now, on the other side, we have what's known as passive. 46 46 00:01:43,200 --> 00:01:45,120 Now, when we deal with passive enumeration, 47 47 00:01:45,120 --> 00:01:47,940 we are talking about no connection being made here. 48 48 00:01:47,940 --> 00:01:49,740 So the attacker is not actually physically 49 49 00:01:49,740 --> 00:01:51,930 touching the target they're trying to analyze. 50 50 00:01:51,930 --> 00:01:54,750 Instead, they collect data on the network 51 51 00:01:54,750 --> 00:01:57,180 and then they analyze that data to learn things 52 52 00:01:57,180 --> 00:01:59,760 about the different devices on that network. 53 53 00:01:59,760 --> 00:02:01,170 We'll talk more about how this works 54 54 00:02:01,170 --> 00:02:03,510 as we go through this section of the course. 55 55 00:02:03,510 --> 00:02:05,910 Now, one of the ways that we can do passive collection 56 56 00:02:05,910 --> 00:02:07,920 is using a networks sniffer. 57 57 00:02:07,920 --> 00:02:10,770 For example, if I have a networks sniffer on your network, 58 58 00:02:10,770 --> 00:02:12,150 I'm collecting all the traffic 59 59 00:02:12,150 --> 00:02:13,710 that's going across your network. 60 60 00:02:13,710 --> 00:02:15,150 That is considered passive, 61 61 00:02:15,150 --> 00:02:17,880 because I'm not actually touching all those machines, 62 62 00:02:17,880 --> 00:02:20,100 I'm just collecting the network data that's passing through 63 63 00:02:20,100 --> 00:02:22,110 that sniffer, and then I can analyze it 64 64 00:02:22,110 --> 00:02:24,300 to figure out what those machines are using. 65 65 00:02:24,300 --> 00:02:25,590 Now, there are lots of different ways 66 66 00:02:25,590 --> 00:02:28,710 to do passive collection and passive enumeration. 67 67 00:02:28,710 --> 00:02:30,540 You might use things like Wireshark, 68 68 00:02:30,540 --> 00:02:32,730 where you're actually looking at the packet captures 69 69 00:02:32,730 --> 00:02:34,710 and analyzing things based on that. 70 70 00:02:34,710 --> 00:02:38,640 You can use tools like Zeke or Bro, or you can use something 71 71 00:02:38,640 --> 00:02:41,280 like p0f, which is another tool. 72 72 00:02:41,280 --> 00:02:43,080 Now, if you're using something like Zeke or Bro, 73 73 00:02:43,080 --> 00:02:44,700 it's going to look like this. 74 74 00:02:44,700 --> 00:02:46,560 Here you could see that in Zeke or Bro, 75 75 00:02:46,560 --> 00:02:48,510 being used as part of Security Onion, 76 76 00:02:48,510 --> 00:02:50,160 is showing us the information 77 77 00:02:50,160 --> 00:02:52,140 about different devices on our network. 78 78 00:02:52,140 --> 00:02:54,210 As the data was crossing the network, 79 79 00:02:54,210 --> 00:02:55,500 Zeke or Bro was going through 80 80 00:02:55,500 --> 00:02:58,230 and looking at that and analyzing that traffic. 81 81 00:02:58,230 --> 00:02:59,640 From that they started figuring out 82 82 00:02:59,640 --> 00:03:01,530 what software was being used on the network, 83 83 00:03:01,530 --> 00:03:03,660 what version number was being used on that network, 84 84 00:03:03,660 --> 00:03:05,310 and what type of service or support 85 85 00:03:05,310 --> 00:03:06,540 was being used on the network, 86 86 00:03:06,540 --> 00:03:08,790 and it also shows us the IP address 87 87 00:03:08,790 --> 00:03:11,820 that identified that piece of software being run on. 88 88 00:03:11,820 --> 00:03:14,910 For example, the first entry we see here is Apache, 89 89 00:03:14,910 --> 00:03:16,950 and it's running version 2.4. 90 90 00:03:16,950 --> 00:03:19,620 This is a web server, as we can see here in the type, 91 91 00:03:19,620 --> 00:03:23,010 and its source IP address of 10.1.0.10. 92 92 00:03:23,010 --> 00:03:25,350 This tells me as an attacker, there's a web server 93 93 00:03:25,350 --> 00:03:27,210 on this network, and I may want to go after it. 94 94 00:03:27,210 --> 00:03:28,860 Now, if I skip down to the third line, 95 95 00:03:28,860 --> 00:03:31,710 I'll also see that there's Microsoft-IIS that was detected, 96 96 00:03:31,710 --> 00:03:35,100 this is version 10.0, this again is a web server, 97 97 00:03:35,100 --> 00:03:37,020 but it's Microsoft's version of web server. 98 98 00:03:37,020 --> 00:03:38,460 Instead of running Apache here, 99 99 00:03:38,460 --> 00:03:41,160 they're running Microsoft's Internet Information Services. 100 100 00:03:41,160 --> 00:03:43,530 Again, this tells me that the server is on, 101 101 00:03:43,530 --> 00:03:46,860 and in this case, it's at 10.1.0.1. 102 102 00:03:46,860 --> 00:03:48,810 So what does this tell me about this? 103 103 00:03:48,810 --> 00:03:50,820 Well, it tells me that this client is sitting here 104 104 00:03:50,820 --> 00:03:54,810 at 10.1.0.1, and it's a server, and it's running Microsoft, 105 105 00:03:54,810 --> 00:03:56,820 which means it's running Microsoft Windows 106 106 00:03:56,820 --> 00:03:58,230 and it's running IIS. 107 107 00:03:58,230 --> 00:04:00,480 Now, knowing all that, I can find vulnerabilities 108 108 00:04:00,480 --> 00:04:02,160 on that server that are associated 109 109 00:04:02,160 --> 00:04:03,210 with this piece of software, 110 110 00:04:03,210 --> 00:04:06,120 and then run my attack against it if I was an attacker. 111 111 00:04:06,120 --> 00:04:08,700 Now, the other tool I mentioned was p0f, 112 112 00:04:08,700 --> 00:04:11,520 and this is a tool that utilizes an array of sophisticated, 113 113 00:04:11,520 --> 00:04:14,223 purely passive trafficked fingerprinting techniques 114 114 00:04:14,223 --> 00:04:15,360 to be able to identify the players 115 115 00:04:15,360 --> 00:04:18,930 behind any incidental TCP IP communications. 116 116 00:04:18,930 --> 00:04:21,690 So even with just a single SYN packet, 117 117 00:04:21,690 --> 00:04:24,810 this tool can actually detect what type of operating system 118 118 00:04:24,810 --> 00:04:27,090 or what type of browser's being used. 119 119 00:04:27,090 --> 00:04:29,610 All of this can be collected through this information, 120 120 00:04:29,610 --> 00:04:30,810 and it gives you something that looks like 121 121 00:04:30,810 --> 00:04:32,490 what you see here on the screen. 122 122 00:04:32,490 --> 00:04:34,860 So here on the screen you can see there was a single packet, 123 123 00:04:34,860 --> 00:04:37,080 a SYN packet, and from that we found out 124 124 00:04:37,080 --> 00:04:39,720 that the client was using Windows XP. 125 125 00:04:39,720 --> 00:04:42,480 In addition to that, we see it was using a DSL line. 126 126 00:04:42,480 --> 00:04:44,850 We see how long this client has been up, in this case, 127 127 00:04:44,850 --> 00:04:47,040 over 11 hours, and we can also see 128 128 00:04:47,040 --> 00:04:49,830 that this is using Firefox as its web browser. 129 129 00:04:49,830 --> 00:04:52,800 All of that information from just a single SYN packet, 130 130 00:04:52,800 --> 00:04:54,720 and this is the type of information you can get 131 131 00:04:54,720 --> 00:04:56,280 from a passive reconnaissance. 132 132 00:04:56,280 --> 00:04:58,110 Now, the next thing we have to start thinking about 133 133 00:04:58,110 --> 00:05:00,540 is how can we actually set up this passive scanning 134 134 00:05:00,540 --> 00:05:03,030 on our network if we're a defender? 135 135 00:05:03,030 --> 00:05:05,370 Well, as the defender is actually a lot easier for us, 136 136 00:05:05,370 --> 00:05:07,410 because we have access to the network. 137 137 00:05:07,410 --> 00:05:09,240 One of the ways we can do this is by using 138 138 00:05:09,240 --> 00:05:12,300 legitimate passive scanning, using things like a tap 139 139 00:05:12,300 --> 00:05:15,300 or a port mirror, for example, if I connect this device 140 140 00:05:15,300 --> 00:05:17,490 to my network, I can do that in line. 141 141 00:05:17,490 --> 00:05:19,860 I can connect one part of my network into A 142 142 00:05:19,860 --> 00:05:21,360 and the other part of the network in B, 143 143 00:05:21,360 --> 00:05:24,000 and everything transmitting from A through B 144 144 00:05:24,000 --> 00:05:25,440 will have a copy of it sent out 145 145 00:05:25,440 --> 00:05:27,690 through the USB port on the other side 146 146 00:05:27,690 --> 00:05:30,150 to my machine where I can do a packet capture. 147 147 00:05:30,150 --> 00:05:32,550 Then I can analyze all that information. 148 148 00:05:32,550 --> 00:05:34,110 If I didn't have access to a device like this, 149 149 00:05:34,110 --> 00:05:37,110 which is a network tap, I can actually set up a port mirror 150 150 00:05:37,110 --> 00:05:39,960 and have all that data pushed out to a network client 151 151 00:05:39,960 --> 00:05:42,090 that is ready to capture that information. 152 152 00:05:42,090 --> 00:05:43,860 Now, all of these different tools are used 153 153 00:05:43,860 --> 00:05:45,900 for enumeration and reconnaissance, 154 154 00:05:45,900 --> 00:05:48,690 and to really support our enumeration reconnaissance efforts 155 155 00:05:48,690 --> 00:05:51,030 we're going to be using open source intelligence, 156 156 00:05:51,030 --> 00:05:53,100 footprinting, and fingerprinting. 157 157 00:05:53,100 --> 00:05:55,050 Now, when we talk about open source intelligence, 158 158 00:05:55,050 --> 00:05:56,760 these are tools that allow us to search 159 159 00:05:56,760 --> 00:05:59,040 publicly available information in order for us 160 160 00:05:59,040 --> 00:06:01,230 to aggregate and search that data. 161 161 00:06:01,230 --> 00:06:03,840 So if I'm going to get information like DNS records, 162 162 00:06:03,840 --> 00:06:06,210 IP addresses, any information that's found 163 163 00:06:06,210 --> 00:06:09,750 on a public website, that is all open source intelligence. 164 164 00:06:09,750 --> 00:06:11,700 When I started talking about footprinting, 165 165 00:06:11,700 --> 00:06:13,470 these are tools that allow us to map out 166 166 00:06:13,470 --> 00:06:15,930 the layout of the network, typically in terms 167 167 00:06:15,930 --> 00:06:19,560 of IP address usage, routing topology, and DNS namespace, 168 168 00:06:19,560 --> 00:06:22,350 including your subdomains and your hostnames. 169 169 00:06:22,350 --> 00:06:23,580 When you're thinking about footprinting 170 170 00:06:23,580 --> 00:06:25,290 I want you to think about networks, 171 171 00:06:25,290 --> 00:06:26,910 think about if you're mapping out something 172 172 00:06:26,910 --> 00:06:28,920 and you're drawing out the big outlines. 173 173 00:06:28,920 --> 00:06:30,720 If I pull up a map of the state of Florida, 174 174 00:06:30,720 --> 00:06:32,310 you might draw the major highways, 175 175 00:06:32,310 --> 00:06:35,790 like I95, and I75, and I4. 176 176 00:06:35,790 --> 00:06:37,620 That would be the idea of footprinting, 177 177 00:06:37,620 --> 00:06:39,930 it's very broad, it's very big, 178 178 00:06:39,930 --> 00:06:41,520 but it doesn't show you a single house 179 179 00:06:41,520 --> 00:06:43,710 or a single piece on that information. 180 180 00:06:43,710 --> 00:06:46,020 That's where fingerprinting comes into play. 181 181 00:06:46,020 --> 00:06:49,260 Fingerprinting uses tools that perform host system detection 182 182 00:06:49,260 --> 00:06:51,480 to map out open ports on a system, 183 183 00:06:51,480 --> 00:06:54,300 operating system type and version, file shares, 184 184 00:06:54,300 --> 00:06:57,150 running services and applications, system uptime, 185 185 00:06:57,150 --> 00:06:58,890 and other useful metadata. 186 186 00:06:58,890 --> 00:07:00,510 So we have all of this information 187 187 00:07:00,510 --> 00:07:03,180 very detailed when we talk about fingerprinting. 188 188 00:07:03,180 --> 00:07:04,740 That's the big difference here. 189 189 00:07:04,740 --> 00:07:07,950 So for the exam, you do need to understand the difference 190 190 00:07:07,950 --> 00:07:10,500 between footprinting and fingerprinting. 191 191 00:07:10,500 --> 00:07:13,020 Now, people will often use these terms interchangeably 192 192 00:07:13,020 --> 00:07:14,790 in the real world and in the workplace, 193 193 00:07:14,790 --> 00:07:17,850 but for the exam, they do mean different things. 194 194 00:07:17,850 --> 00:07:19,770 I want you to remember that footprinting 195 195 00:07:19,770 --> 00:07:21,960 is focused on the overall network layout, 196 196 00:07:21,960 --> 00:07:23,460 and fingerprinting is focused 197 197 00:07:23,460 --> 00:07:25,890 on a single host or single server. 198 198 00:07:25,890 --> 00:07:27,270 That is the idea when we start talking about 199 199 00:07:27,270 --> 00:07:28,980 footprinting versus fingerprinting 200 200 00:07:28,980 --> 00:07:31,230 and how both of them are used in enumeration.