Instructor: Enumeration Tools. 2 2
In this lesson, we are going to talk about 3 3
some of the enumeration tools that we're going to experience 4 4
as we're trying to enumerate our networks. 5 5
Now, what exactly is enumeration? 6 6
Well, enumeration is the process to identify 7 7
and scan network ranges and hosts that belong to the target 8 8
and then map out an attack surface. 9 9
So essentially, if an attacker is looking at your network, 10 10
they're trying to enumerate to figure out 11 11
what the network looks like so they can attack it. 12 12
But as defenders, we're also going to enumerate our network, 13 13
because we want to know what our attack surface is. 14 14
And so enumeration is used by both attackers and defenders. 15 15
Now, as we start looking at enumeration, 16 16
there is really two kinds of enumeration. 17 17
We have active enumeration and passive enumeration. 18 18
When we talk about an active enumeration, 19 19
this occurs when a connection is made 20 20
from the attacker to a target 21 21
and there's data being transmitted back and forth. 22 22
Now, when we are dealing with that, 23 23
sometimes we don't want to be active, 24 24
because by being active, somebody can detect us 25 25
because we're actually touching their system. 26 26
We also can be traced back if we're an attacker, 27 27
and that wouldn't be good for us either. 28 28
So a lot of attackers use what's known 29 29
as a semi-passive technique. 30 30
Now, a semi-passive technique is going to use sparse 31 31
and widely dispersed attempts to make that connection 32 32
to the target during their reconnaissance. 33 33
The reason they do this is because if they're active 34 34
and they're actually reaching out and touching your machine 35 35
and they're doing it very quickly, 36 36
you can detect that very quickly. 37 37
Most intrusion detection systems 38 38
will be able to detect things like port scans 39 39
and different enumeration techniques 40 40
from an attacker because those are active methods. 41 41
But if you're using a semi-passive method 42 42
and you wait a long time in between each ping 43 43
or each type of probe, that can actually delay it 44 44
and make the IDS miss it. 45 45
Now, on the other side, we have what's known as passive. 46 46
Now, when we deal with passive enumeration, 47 47
we are talking about no connection being made here. 48 48
So the attacker is not actually physically 49 49
touching the target they're trying to analyze. 50 50
Instead, they collect data on the network 51 51
and then they analyze that data to learn things 52 52
about the different devices on that network. 53 53
We'll talk more about how this works 54 54
as we go through this section of the course. 55 55
Now, one of the ways that we can do passive collection 56 56
is using a networks sniffer. 57 57
For example, if I have a networks sniffer on your network, 58 58
I'm collecting all the traffic 59 59
that's going across your network. 60 60
That is considered passive, 61 61
because I'm not actually touching all those machines, 62 62
I'm just collecting the network data that's passing through 63 63
that sniffer, and then I can analyze it 64 64
to figure out what those machines are using. 65 65
Now, there are lots of different ways 66 66
to do passive collection and passive enumeration. 67 67
You might use things like Wireshark, 68 68
where you're actually looking at the packet captures 69 69
and analyzing things based on that. 70 70
You can use tools like Zeke or Bro, or you can use something 71 71
like p0f, which is another tool. 72 72
Now, if you're using something like Zeke or Bro, 73 73
it's going to look like this. 74 74
Here you could see that in Zeke or Bro, 75 75
being used as part of Security Onion, 76 76
is showing us the information 77 77
about different devices on our network. 78 78
As the data was crossing the network, 79 79
Zeke or Bro was going through 80 80
and looking at that and analyzing that traffic. 81 81
From that they started figuring out 82 82
what software was being used on the network, 83 83
what version number was being used on that network, 84 84
and what type of service or support 85 85
was being used on the network, 86 86
and it also shows us the IP address 87 87
that identified that piece of software being run on. 88 88
For example, the first entry we see here is Apache, 89 89
and it's running version 2.4. 90 90
This is a web server, as we can see here in the type, 91 91
and its source IP address of 10.1.0.10. 92 92
This tells me as an attacker, there's a web server 93 93
on this network, and I may want to go after it. 94 94
Now, if I skip down to the third line, 95 95
I'll also see that there's Microsoft-IIS that was detected, 96 96
this is version 10.0, this again is a web server, 97 97
but it's Microsoft's version of web server. 98 98
Instead of running Apache here, 99 99
they're running Microsoft's Internet Information Services. 100 100
Again, this tells me that the server is on, 101 101
and in this case, it's at 10.1.0.1. 102 102
So what does this tell me about this? 103 103
Well, it tells me that this client is sitting here 104 104
at 10.1.0.1, and it's a server, and it's running Microsoft, 105 105
which means it's running Microsoft Windows 106 106
and it's running IIS. 107 107
Now, knowing all that, I can find vulnerabilities 108 108
on that server that are associated 109 109
with this piece of software, 110 110
and then run my attack against it if I was an attacker. 111 111
Now, the other tool I mentioned was p0f, 112 112
and this is a tool that utilizes an array of sophisticated, 113 113
purely passive trafficked fingerprinting techniques 114 114
to be able to identify the players 115 115
behind any incidental TCP IP communications. 116 116
So even with just a single SYN packet, 117 117
this tool can actually detect what type of operating system 118 118
or what type of browser's being used. 119 119
All of this can be collected through this information, 120 120
and it gives you something that looks like 121 121
what you see here on the screen. 122 122
So here on the screen you can see there was a single packet, 123 123
a SYN packet, and from that we found out 124 124
that the client was using Windows XP. 125 125
In addition to that, we see it was using a DSL line. 126 126
We see how long this client has been up, in this case, 127 127
over 11 hours, and we can also see 128 128
that this is using Firefox as its web browser. 129 129
All of that information from just a single SYN packet, 130 130
and this is the type of information you can get 131 131
from a passive reconnaissance. 132 132
Now, the next thing we have to start thinking about 133 133
is how can we actually set up this passive scanning 134 134
on our network if we're a defender? 135 135
Well, as the defender is actually a lot easier for us, 136 136
because we have access to the network. 137 137
One of the ways we can do this is by using 138 138
legitimate passive scanning, using things like a tap 139 139
or a port mirror, for example, if I connect this device 140 140
to my network, I can do that in line. 141 141
I can connect one part of my network into A 142 142
and the other part of the network in B, 143 143
and everything transmitting from A through B 144 144
will have a copy of it sent out 145 145
through the USB port on the other side 146 146
to my machine where I can do a packet capture. 147 147
Then I can analyze all that information. 148 148
If I didn't have access to a device like this, 149 149
which is a network tap, I can actually set up a port mirror 150 150
and have all that data pushed out to a network client 151 151
that is ready to capture that information. 152 152
Now, all of these different tools are used 153 153
for enumeration and reconnaissance, 154 154
and to really support our enumeration reconnaissance efforts 155 155
we're going to be using open source intelligence, 156 156
footprinting, and fingerprinting. 157 157
Now, when we talk about open source intelligence, 158 158
these are tools that allow us to search 159 159
publicly available information in order for us 160 160
to aggregate and search that data. 161 161
So if I'm going to get information like DNS records, 162 162
IP addresses, any information that's found 163 163
on a public website, that is all open source intelligence. 164 164
When I started talking about footprinting, 165 165
these are tools that allow us to map out 166 166
the layout of the network, typically in terms 167 167
of IP address usage, routing topology, and DNS namespace, 168 168
including your subdomains and your hostnames. 169 169
When you're thinking about footprinting 170 170
I want you to think about networks, 171 171
think about if you're mapping out something 172 172
and you're drawing out the big outlines. 173 173
If I pull up a map of the state of Florida, 174 174
you might draw the major highways, 175 175
like I95, and I75, and I4. 176 176
That would be the idea of footprinting, 177 177
it's very broad, it's very big, 178 178
but it doesn't show you a single house 179 179
or a single piece on that information. 180 180
That's where fingerprinting comes into play. 181 181
Fingerprinting uses tools that perform host system detection 182 182
to map out open ports on a system, 183 183
operating system type and version, file shares, 184 184
running services and applications, system uptime, 185 185
and other useful metadata. 186 186
So we have all of this information 187 187
very detailed when we talk about fingerprinting. 188 188
That's the big difference here. 189 189
So for the exam, you do need to understand the difference 190 190
between footprinting and fingerprinting. 191 191
Now, people will often use these terms interchangeably 192 192
in the real world and in the workplace, 193 193
but for the exam, they do mean different things. 194 194
I want you to remember that footprinting 195 195
is focused on the overall network layout, 196 196
and fingerprinting is focused 197 197
on a single host or single server. 198 198
That is the idea when we start talking about 199 199
footprinting versus fingerprinting 200 200
and how both of them are used in enumeration.