Information and Network Security Lab
Total Page:16
File Type:pdf, Size:1020Kb
INFORMATION AND NETWORK SECURITY LAB 17CSL77 LAB MANNUAL FOR VII SEMESTER Computer Science & Engineering By Mr. Vivek Sharma S Asst. Prof Dept., of CSE 1. LEARN TO INSTALL WINE / VIRTUAL BOX OR ANY OTHER EQUIVALENT SOFTWARE ON THE HOST OS. Virtualization is the process of emulating hardware inside a virtual machine. Virtualization can include the following: Application Virtual Machines. Mainframe Virtual Machines. Parallel Virtual Machines. Operating System Virtual Machines. Download the latest version of Sun Virtual Box from the website. The installation steps are 1. Double Click on Virtual Box Executable File. 2. Welcome to the Oracle VM appears [Setup Wizard] Click Next. 3. Custom Setup Screen with all the features of VM appears Click Next. 4. Options to create shortcut on Desktop and Quick launch bar Click Next. 5. Ready to Install Click on Install button. 6. Click Finish Start Oracle VM Virtual Box. And now install any kind of Operating Systems as Guest Operating System. The Configuration of Guest OS is shown below. Written by G.RAVINDARKUMAR [APT 365] EXPERIMENT NO:1 PERFORM AN EXPERIMENT TO GRAB A BANNER WITH TELNET AND PERFORM THE TASK USING NETCAT UTILITY. Banner Grabbing is a technique to determine which application or service is running on the specified port by attempting to make a connection to this host. Banner Grabbing can be performed in two ways. 1. ONLINE (Thru Internet connection by connecting to remote websites) 2. OFFLINE (Thru Local LAN or with Virtual Box Guest OS) 1. First Enable the TELNET service on your computer by typing the command given; Type the command SERVICES.MSC in run command menu, Click on Telnet service and enable the service, select it automatic and Click Start. 2. Open Command prompt and type the following ; telnet www.rediff.com 80 (http port) and press enter key twice. 3. Now you can see the rediff website web server’s information. 4. You can also try it on your local machine connecting to your Guest OS like telnet Guest IP address(example: 192.168.56.101) 80 and press enter twice. 5. The same Banner grabbing can also perform by the NETCAT utility available at http://netcat.sourceforge.net the compressed file. 6. Extract on your local drive and perform the following in the command prompt; Netcat www.rediff.com 80 (http port) and press enter twice to see the result. 7. Use the same procedure on Guest Operating System like But before using netcat command please install the IIS (Internet Information Server) from Add/Remove components on your Guest OS, then apply this; Netcat –vv –n guest ip address(example: 192.168.56.101) 80 and press enter twice to see the result. -vv=verbose mode , -n=numerical IP address only. EXPERIMENT NO:2 USING NMAP 1)FIND OPEN PORTS ON A SYSTEM 2) FIND THE MACHINES WHICH ARE ACTIVE 3)FIND THE VERSION OF REMOTE OS ON OTHER SYSTEMS 4)FIND THE VERSION OF S/W INSTALLED ON OTHER SYSTEM 1. Download Nmap from www.nmap.org and install the Nmap Software with WinPcap Driver utility. 2. Execute the Nmap-Zenmap GUI tool from Program Menu or Desktop Icon. 3. Type the Target Machine IP Address(ie.Guest OS or any website Address) 4. Perform the profiles shown in the utility. EXPERIMENT NO: 3 ERFORMA AN EXPERIMENT TO DEMONSTRATE HOW TO SNIFF FOR ROUTER TRAFFIC BY USING THE TOOL WIRESHARK. A packet sniffer, sometimes referred to as a network monitor or network analyzer, can be used by a network or system administrator to monitor and troubleshoot network traffic. Using the information captured by the packet sniffer an administrator can identify erroneous packets and use the data to pinpoint bottlenecks and help maintain efficient network data transmission. In its simple form a packet sniffer simply captures all of the packets of data that pass through a given network interface. By placing a packet sniffer on a network in promiscuous mode, a Malicious intruder can capture and analyze all of the network traffic. Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible. Download and install wireshark network analyzer. Steps to capture traffic: 1. Open Wireshark network analyzer. 2. Select interface: Goto capture option in menu bar and select interface Start Caputuring EXPERIMENT NO: 4 PERFORM AN EXPERIMENT HOW TO USE DUMPSEC. SomarSoft's DumpSec is a (free) security auditing program for Microsoft Windows NT/2000. It dumps the permissions (DACLs) and audit settings (SACLs) for the file system, registry, printers and shares in a concise, readable format, so that holes in system security are readily apparent. DumpSec also dumps user, group and replication information. DumpSec is a must have product for Windows NT systems administrators and computer security auditors. 1. Download & install dumpsec. 2. Open dumpsec and select computer 2. Now select report=> dump users as table and click ok. Printer Sharing Report Permission on Shares: EXPERIMENT NO : 5 PERFORM AN WIRELESS AUDIT OF AN ACCESS POINT / ROUTER AND DECRYPT WEP AND WPA. NetStumbler (Network Stumbler) is one of the Wi-Fi hacking tool which only compatible with windows, this tool also a freeware. With this program, we can search for wireless network which open and infiltrate the network. Its having some compatibility and network adapter issues. Download and install Netstumbler It is highly recommended that your PC should have wireless network card in order to access wireless router. Now Run Netstumbler in record mode and configure wireless card. There are several indicators regarding the strength of the signal, such as GREEN indicates Strong, YELLOW and other color indicates a weaker signal, RED indicates a very weak and GREY indicates a signal loss. Lock symbol with GREEN bubble indicates the Access point has encryption enabled. MAC assigned to Wireless Access Point is displayed on right hand pane. The next coloumn displays the Access points Service Set Identifier[SSID] which is useful to crack the password. To decrypt use WireShark tool by selecting EditpreferencesIEEE 802.11 Enter the WEP keys as a string of hexadecimal numbers as A1B2C3D4E5 Adding Keys: Wireless Toolbar If you are using the Windows version of Wireshark and you have an AirPcap adapter you can add decryption keys using the wireless toolbar. If the toolbar isn't visible, you can show it by selecting View->Wireless Toolbar. Click on the Decryption Keys... button on the toolbar: This will open the decryption key managment window. As shown in the window you can select between three decryption modes: None, Wireshark, and Driver: EXPERIMENT NO: 6 PERFORM AN EXPERIMENT TO SNIFF TRAFFIC USING ARP POISONING. Address Resolution Protocol (ARP) poisoning is a type of attack where the Media Access Control [MAC] address by the attacker called spoofing. ARP poison routing uses the stored cache as a way to reroute or redirect ;packets from a target, to an intermediate machine. Thus MAN in MIDDLE watch the traffic between Source and Target machines. To perform this Install CAIN and Abel tool and do the following: Click on Sniffer menu. Click on hosts on the button portion window. Click Start sniffer and APR service from Standard toolbar menu. Right Click on the hosts window and click on Scan MAC address. Select all hosts in my subnet or range FROM and TO IP address and Click OK. Now you view the MAC and IP address of Remote / Local machines. Click on APR button on toolbar menu. Left Click on right pane of APR window and then Click on ‘+’ symbol on standard toolbar. APR enables you to poison IP traffic between the selected host . Click on any IP address on the left side list and the other IP selected on the right side. Left Click on Right side on the IP address and Click OK. Wathch the poisoning effect FROM and TO IP address. The analysis of this traffic can also be performed by other tool called ETHEREAL. ABEL is the second part of program composed by two files able.exe and abel.dll. The service can be installed with Administrative Priviledges on the Target Machine. Execute Abel.exe from ProgramFiles Folder. Expand Microsoft windows Network and Click on all Computers. Right Click on Computer and Connect as Administrative Credentials. Once connected Right Click on services icon and select install Abel, the two files abe.exe and abel.dll will be copied on to connected Computer. Now bring up a console prompt on the connected Computer examine the password hashes. EXPERIMENT NO: 7 DEMONSTRATE INTRUSION DETECTION SYSTEM (IDS) USING ANY TOOL EG . SNORT OR ANY OTHER S/W SNORT can be configured to run in three modes: 1. Sniffer mode 2. Packet Logger mode 3. Network Intrusion Detection System mode cmd Sniffer modesnort –v Print out the TCP/IP packets header on the screen Snort –vd show the TCP/IP ICMP header with application data in transit. Packet Logger mode snort –dev –l c:\log [create this directory in the C drive] and snort will automatically know to go into packet logger mode, it collects every packet it sees and places it in log directory. snort –dev –l c:\log –h ipaddress/24 This rule tells snort that you want to print out the data link and TCP/IP headers as well as application data into the log directory. snort –l c:\log –b This is binary mode logs everything into a single file. Network Intrusion Detection System mode snort –d c:\log –h ipaddress/24 –c snort.conf This is a configuration file applies rule to each packet to decide it an action based upon the rule type in the file.