The Nmap Project

Total Page：16

File Type：pdf, Size：1020Kb

Insecure.Org The Nmap Project Fotis Hantzis aka ithilgore sock-raw.org FOSSCOMM 2016 Insecure.Org whoami • Exploiting TCP and the Persist Timer Infiniteness (Phrack #66) • Abusing Network Protocols (stealthy portscanning through XMPP exploitation) • Nmap developer, Ncrack author • Startup ventures @ithilgore Insecure.Org http://phrack.org/issues/51/11.html#article Insecure.Org Ndiff NSE Npcap Zenmap Insecure.Org Trinity uses Nmap in Matrix Reloaded Insecure.Org CIA using Zenmap in Bourne Ultimatum Insecure.Org Die Hard 4 Insecure.Org And many more: http://nmap.org/movies Elysium Insecure.Org > 1000 students $5.000 stipends 3 – 4 months ~ 150 open source organizations Insecure.Org Past Nmap GSoC Accomplishments o Nping – generic packet crafting tool o Ncat – the modern netcat o Npcap – packet sniffing library (WPF) o Ncrack – network auth cracking tool o NSE – Nmap Scripting Engine o Zenmap – GUI for Nmap o Ndiff – diff for network scans Insecure.Org http://nmap.org/ncrack High speed network authentication cracking tool Insecure.Org Ncrack’s Main Features o Intelligent Core Engine o Service Recognition through Nmap (-oN, -oX) o Fine-grained timing control (cl, CL, to, cd, at, T1-T5) o Built-in username/password lists o Session stop/resume o Modular architecture o Nsock based (asynchronous) Insecure.Org Ncrack modules o SSH – custom opensshlib based on OpenSSH o RDP – extremely hard protocol by MS SMB o • Telnet o SIP • FTP • HTTP (basic/digest) • PostgreSQL • MySQL Contributions • VNC • POP3 • Redis Insecure.Org New Ncrack 0.5 release o New modules: Redis, PostgreSQL, MySQL, SIP, HTTP digest o pairwise user/pass iteration o proxy support o New opensshlib based on OpenSSH 7.1 https://nmap.org/ncrack https://github.com/nmap/ncrack Insecure.Org Ncrack modules TODO list: • CVS, SVN • Microsoft SQL • HTTP Form • IMAP https://nmap.org/ncrack/ devguide.html • SNMP • LDAP • XMPP • Rsync, Rlogin Insecure.Org Greek Nmap Developers • George Chatzisofroniou: NSE scripts, GSoC 2013 • Evangelos Deirmetzoglou: Ncrack modules • Fotis Hantzis: Ncrack author, Nmap dev, GSoC: {2009, 2010} - student 2016 - mentor Insecure.Org Thanks for watching! Follow me: @ithilgore http://sock-raw.org http://nmap.org http://nmap.org/ncrack http://github.com/nmap/ncrack Questions?.

Copy Link

Recommended publications

Towards Web-Based Delta Synchronization for Cloud Storage Services
Towards Web-based Delta Synchronization for Cloud Storage Services He Xiao Zhenhua Li ∗ Ennan Zhai Tianyin Xu Tsinghua University Tsinghua University Yale University UIUC Yang Li Yunhao Liu Quanlu Zhang Yao Liu Tsinghua University Tsinghua University Microsoft Research SUNY Binghamton Abstract savings in the presence of users’ file edits [29, 39, 40]. Delta synchronization (sync) is crucial for network-level Unfortunately, today delta sync is only available for efficiency of cloud storage services. Practical delta sync PC clients and mobile apps, but not for the web—the most pervasive and OS-independent access method [37]. techniques are, however, only available for PC clients 0 and mobile apps, but not web browsers—the most per- After a file f is edited into a new version f by users, vasive and OS-independent access method. To under- Dropbox’s PC client will apply delta sync to automati- stand the obstacles of web-based delta sync, we imple- cally upload only the altered bits to the cloud; in contrast, Dropbox’s web interface requires users to manually up- ment a delta sync solution, WebRsync, using state-of- 0 1 the-art web techniques based on rsync, the de facto delta load the entire content of f to the cloud. This gap sig- sync protocol for PC clients. Our measurements show nificantly affects web-based user experiences in terms of that WebRsync severely suffers from the inefficiency of both sync speed and traffic cost. JavaScript execution inside web browsers, thus leading Web is a fairly popular access method for cloud stor- to frequent stagnation and even hanging.
[Show full text]
Cheat Sheet – Common Ports (PDF)
COMMON PORTS packetlife.net TCP/UDP Port Numbers 7 Echo 554 RTSP 2745 Bagle.H 6891-6901 Windows Live 19 Chargen 546-547 DHCPv6 2967 Symantec AV 6970 Quicktime 20-21 FTP 560 rmonitor 3050 Interbase DB 7212 GhostSurf 22 SSH/SCP 563 NNTP over SSL 3074 XBOX Live 7648-7649 CU-SeeMe 23 Telnet 587 SMTP 3124 HTTP Proxy 8000 Internet Radio 25 SMTP 591 FileMaker 3127 MyDoom 8080 HTTP Proxy 42 WINS Replication 593 Microsoft DCOM 3128 HTTP Proxy 8086-8087 Kaspersky AV 43 WHOIS 631 Internet Printing 3222 GLBP 8118 Privoxy 49 TACACS 636 LDAP over SSL 3260 iSCSI Target 8200 VMware Server 53 DNS 639 MSDP (PIM) 3306 MySQL 8500 Adobe ColdFusion 67-68 DHCP/BOOTP 646 LDP (MPLS) 3389 Terminal Server 8767 TeamSpeak 69 TFTP 691 MS Exchange 3689 iTunes 8866 Bagle.B 70 Gopher 860 iSCSI 3690 Subversion 9100 HP JetDirect 79 Finger 873 rsync 3724 World of Warcraft 9101-9103 Bacula 80 HTTP 902 VMware Server 3784-3785 Ventrilo 9119 MXit 88 Kerberos 989-990 FTP over SSL 4333 mSQL 9800 WebDAV 102 MS Exchange 993 IMAP4 over SSL 4444 Blaster 9898 Dabber 110 POP3 995 POP3 over SSL 4664 Google Desktop 9988 Rbot/Spybot 113 Ident 1025 Microsoft RPC 4672 eMule 9999 Urchin 119 NNTP (Usenet) 1026-1029 Windows Messenger 4899 Radmin 10000 Webmin 123 NTP 1080 SOCKS Proxy 5000 UPnP 10000 BackupExec 135 Microsoft RPC 1080 MyDoom 5001 Slingbox 10113-10116 NetIQ 137-139 NetBIOS 1194 OpenVPN 5001 iperf 11371 OpenPGP 143 IMAP4 1214 Kazaa 5004-5005 RTP 12035-12036 Second Life 161-162 SNMP 1241 Nessus 5050 Yahoo! Messenger 12345 NetBus 177 XDMCP 1311 Dell OpenManage 5060 SIP 13720-13721
[Show full text]
List of NMAP Scripts Use with the Nmap –Script Option
List of NMAP Scripts Use with the nmap –script option Retrieves information from a listening acarsd daemon. Acarsd decodes ACARS (Aircraft Communication Addressing and Reporting System) data in real time. The information retrieved acarsd-info by this script includes the daemon version, API version, administrator e-mail address and listening frequency. Shows extra information about IPv6 addresses, such as address-info embedded MAC or IPv4 addresses when available. Performs password guessing against Apple Filing Protocol afp-brute (AFP). Attempts to get useful information about files from AFP afp-ls volumes. The output is intended to resemble the output of ls. Detects the Mac OS X AFP directory traversal vulnerability, afp-path-vuln CVE-2010-0533. Shows AFP server information. This information includes the server's hostname, IPv4 and IPv6 addresses, and hardware type afp-serverinfo (for example Macmini or MacBookPro). Shows AFP shares and ACLs. afp-showmount Retrieves the authentication scheme and realm of an AJP service ajp-auth (Apache JServ Protocol) that requires authentication. Performs brute force passwords auditing against the Apache JServ protocol. The Apache JServ Protocol is commonly used by ajp-brute web servers to communicate with back-end Java application server containers. Performs a HEAD or GET request against either the root directory or any optional directory of an Apache JServ Protocol ajp-headers server and returns the server response headers. Discovers which options are supported by the AJP (Apache JServ Protocol) server by sending an OPTIONS request and lists ajp-methods potentially risky methods. ajp-request Requests a URI over the Apache JServ Protocol and displays the result (or stores it in a file).
[Show full text]
17 Basic Networking Clients
Certification Basic Networking Clients UNIT 17 Basic Networking Clients 1 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc. UNIT 16: Objectives ? Learn basic network commands ? Learn how to communicate securely with remote hosts ? Understand the use of rsync and wget 2 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc. UNIT 17: Agenda ? ssh / scp / telnet ? lftp ? links ? mutt ? rsync / wget ? ping / traceroute / host 3 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc. ssh: Secure Shell ? Public-key encryption technology replacement for various unsecure services ? Allows secure access to remote systems · $ ssh joe@barney -or- · $ ssh -l joe barney joe@barney's password: · $ ssh barney ls /tmp 4 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc. scp: Secure copy ? Secure replacement for rcp ? Layered on top of ssh · $ scp source destination ? Remote files can be specified using: · user@host:/path/to/file · -r option enables recursion · -p preserves times and permissions · -C compresses datastream 5 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc. telnet and the “r” services ? Insecure protocols ? telnet: Login names and passwords pass over the network in clear text ? “r” services (rsh, rlogin, rcp): generally insecure authentication mechanism ? telnet client can be used to connect to services running on arbitrary ports ? Example: testing your mail server: $ telnet localhost 25 6 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc. lftp ? Versatile command-line FTP client ? Anonymous or real-user sessions $ lftp ftp.cdrom.com $ lftp -u joe ftp.myserver.com ? Automated transfers with lftpget 7 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc.
[Show full text]
Pragma Systems & Stay-Linked™: Remote SSH Connectivity Done Right
WHITE PAPER Pragma Systems & Stay‐Linked™: Remote SSH Connectivity Done Right This paper is designed to serve as a primer for upgrading – or choosing and implementing – a highly effective, secure SSH connectivity solution. This document provides an overview of key regulatory and market developments driving the need to make remote computing systems more secure; takes a look at the origins of SSH and the factors that have led to its becoming the enterprise security protocol of choice; outlines key components of an optimal SSH‐based security approach; and, then, examines the market’s most trusted, effective, end‐to‐end, server and client SSH security solution, offered in partnership by Pragma Systems and Stay‐Linked. Pragma Systems & Stay‐Linked™: Remote SSH Connectivity Done Right Contents Executive Summary ............................................................................................................................................. 3 Takin’ it to the streets ......................................................................................................................................... 3 Clearly, it’s time to leave clear text behind ........................................................................................................ 4 Regulatory rundown ........................................................................................................................................... 4 Gaga for gadgets ................................................................................................................................................
[Show full text]
Rsync Considered Inefficient and Harmful
rsync considered inefficient and harmful [email protected] [email protected] 1 RPKI uses rsync • RPKI uses rsync as its data publicaon protocol for wider public access. • The use is very constrained: – it’s a source, not a sink – It’s got specific objects in the tree (hopefully) • The use has been somewhat controversial – Not an IETF standard – Issues around efficiency/efficacy/scaling – Proposals to use HTTP, delta protocols • Tes>ng by NIST/BBN/RIPE on its behaviour 2 rsync: the protocol 3 rsync: the protocol • Andrew Tridgell design (with Paul Mackerass) – PhD thesis 1999, protocol 1996 • Designed to be highly efficient in using the net – Block checksums, only block differences sent – FleXible (a gazillion op>ons) – Send and Receive func>on de-coupled from client & server role • Massive organic feature growth in a single implementaon • Now on v31 of the protocol. – Such changes. Many op>ons. 4 rsync: the protocol 1. Connect. This iden>fies a client and a server – The client & server can be the sender or receiver and vice versa. These are completely decoupled from ‘who calls’ 2. Client passes capabili>es list, arguments – Iden>fies who takes the Sender/Receiver role 3. If Receiver, client sends a set of filter expressions at this point. 4. Receiver sends a list of checksums of blocks in files it thinks may be changed (if has none, sends null) 5. Sender sends a delta of new bytes plus eXis>ng blocks to the client to reconstruct the file 5 rsync: the protocol • The outcome is highly efficient on the wire • The checksum blocks eXchanged for the delta algorithm are a modified CRC32, that works on a sliding window.
[Show full text]
Algorithms for Low-Latency Remote File Synchronization
Algorithms for Low-Latency Remote File Synchronization Ý Hao Yan£ Utku Irmak Torsten Suel CIS Department Yahoo! Inc., CIS Department Polytechnic University 2821 Mission College Blvd, Polytechnic University Brooklyn, NY 11201 Santa Clara, CA 95054 Brooklyn, NY 11201 [email protected] [email protected] [email protected] Abstract tions of data within their distributed architectures. In all ofthese The remote file synchronization problem is how to update an applications, there are usually significant similarities between outdated version of a file located on one machine to the current successive versions of the files, and we would like to exploit version located on another machine with a minimal amount of these in order to decrease the amount of data that is transmit- network communication. It arises in many scenarios including ted. If the new files differ only very slightly from their previous web site mirroring, file system backup and replication, or web versions, then the cost should be very low, while for more sig- access over slow links. A widely used open-source tool called nificant changes, more data may have to be transmitted. rsync uses a single round of messages to solve this problem Remote file synchronization has been studied extensively (plus an initial round for exchanging meta information). While over the last ten years, and existing approaches can be divided research has shown that significant additional savings in band- into single-round and multi-round protocols. Single-round pro- width are possible by using multiple rounds, such approaches tocols [32, 12] are preferable in scenarios involving small files are often not desirable due to network latencies, increased pro- and large network latencies (e.g., web access over slow links).
[Show full text]
Network File Sharing Protocols
Network File Sharing Protocols Lucius quests her hotchpotch ethnologically, she contradistinguish it self-righteously. Dialogic Millicent catch prayingly. Sheridan usually foils stintedly or pirouette anaerobiotically when trilobed Saxon disposes genotypically and homeward. It is recommended that this type be accepted by all FTP implementations. So how do you protect yourself from these malware infected movies? Which protocol is even an option for you is based on your use scenario. Learn about the latest issues in cybersecurity and how they affect you. As more clients access the file, share important files digitally and work as a team even sitting miles apart. Friendly name of the printer object. SMB is built in to every version of Windows. As you can see NFS offers a better performance and is unbeatable if the files are medium sized or small. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. You are correct, thank you. It syncs files between devices on a local network or between remote devices over the internet. Sets the maximum number of channels for all subsequent sessions. Session control packets Establishes and discontinues a connection to shared server resources. Please fill in all required fields before continuing. File names in CIFS are encoded using unicode characters. The configured natural language of the printer. After entering its resources or network protocols that protocol over the server supports file services while originally connected you must be set. Download a free fully functional evaluation of JSCAPE MFT Server. The File Transfer Protocol follows the specifications of the Telnet protocol for all communications over the control connection.
[Show full text]
AIS Data Profile 30 December 2016
AIS Data Profile 30 December 2016 STIX Tab STIX Sub-Tab IN/OUT Examples Field Guidance Type Text Type STIX Core STIX Type BOTH [Company Name]:[Column A]- @id This is a required field - NCCIC will replace on xs:QName Schema restricted text [Company Unique ID] dissemination with NCCIC values. (partial) BOTH 1.1.1 @version This is a required field - DHS will not accepted stix:STIXPackageVersionEnum Vocabulary defined text anything other than 1.1.1 If anything other than the accepted value is submitted the field will be removed during the sanitization process. BOTH 2002-05-30T09:00:00 @timestamp This is a required field - Schema restricted text - xs:dateTime Schema restricted text This field should be date and time only. BOTH NA STIX_Header This is a required Container Object. stix:STIXHeaderType Container BOTH NA Indicators Container Object stix:IndicatorsType Container BOTH NA TTPs Container Object stix:TTPsType Container BOTH NA Courses_of_Action Container Object stix:CoursesOfActionType Container BOTH NA Exploit_Targets Container Object stix_common:ExploitTargetsType Container STIX Header Type BOTH Provides an unstructured, text Title Review Field - On automated dissemination this xs:string Free form text title field will be replaced by an auto-generated Title. The submitted contents will be reviewed/modified/sanitized and disseminated via human manual process. Future capabilities may eliminate the human review process. BOTH See Vocab Tab Package_Intent This is a required field - Reference the Vocab stixCommon:ControlledVocabularyStringType Vocabulary defined text Tab - stixVocabs:PackageIntentEnum-1.0 stixVocabs:PackageIntentEnum-1.0 If anything other than the accepted value is submitted the field will be removed during the sanitization process.
[Show full text]
All-In-One Cloud Storage Gateways with Integrated Data Protection And
CTERA C400 / C800 Cloud Attached Storage® Appliances All-in-One Cloud Storage Gateways with Integrated Data Protection and Network Attached Storage Integrated On-Site & Off-Site Data Backup and Disaster Recovery Robust Enterprise-Grade NAS Features Cloud File Sharing and Synchronization Hybrid Storage Appliances with Integrated Cloud Services for SMBs and Branch Offices The C400 and C800 appliances from CTERA Networks combine network attached storage (NAS) functionality with comprehensive data protection, providing fast local backup & recovery integrated with cloud storage for disaster recovery, remote access and file sharing. With the included CTERA backup software, managed agents, remote management capabilities and end-to-end data protection, the C400 and C800 provide a highly cost-effective, easy-to-manage alternative to more expensive, disparate solutions. Lightning-fast on-site backup and restore, with integrated, globally de-duplicated, Hybrid Cloud & On-Premises efficient cloud backup that provides an off-site copy for disaster recovery. Protect the business against data loss and minimize disaster recovery time using a Complete Data Protection single solution – including roaming laptops, remote users, servers and workstations. Full-fledged NAS appliances supporting RAID 5/6 for redundancy, inline volume Robust Network Storage encryption, thin-provisioned snapshots, iSCSI and Active Directory integration. Using the CTERA Portal, service providers and enterprise IT can manage and Central Management monitor any number of CTERA appliances from a unified Web console. Access local and cloud-stored files from anywhere, on locally or over the Web. File-Based Collaboration Share files with project groups and occasional users with email invitations. Synchronize files to and from the cloud between multiple users.
[Show full text]
UC-8410A Series Linux Software User's Manual
UC-8410A Series Linux Software User’s Manual Edition 2.0, July 2018 www.moxa.com/product © 2018 Moxa Inc. All rights reserved. UC-8410A Series Linux Software User’s Manual The software described in this manual is furnished under a license agreement and may be used only in accordance with the terms of that agreement. Copyright Notice © 2018 Moxa Inc. All rights reserved. Trademarks The MOXA logo is a registered trademark of Moxa Inc. All other trademarks or registered marks in this manual belong to their respective manufacturers. Disclaimer Information in this document is subject to change without notice and does not represent a commitment on the part of Moxa. Moxa provides this document as is, without warranty of any kind, either expressed or implied, including, but not limited to, its particular purpose. Moxa reserves the right to make improvements and/or changes to this manual, or to the products and/or the programs described in this manual, at any time. Information provided in this manual is intended to be accurate and reliable. However, Moxa assumes no responsibility for its use, or for any infringements on the rights of third parties that may result from its use. This product might include unintentional technical or typographical errors. Changes are periodically made to the information herein to correct such errors, and these changes are incorporated into new editions of the publication. Technical Support Contact Information www.moxa.com/support Moxa Americas Moxa China (Shanghai office) Toll-free: 1-888-669-2872 Toll-free: 800-820-5036 Tel: +1-714-528-6777 Tel: +86-21-5258-9955 Fax: +1-714-528-6778 Fax: +86-21-5258-5505 Moxa Europe Moxa Asia-Pacific Tel: +49-89-3 70 03 99-0 Tel: +886-2-8919-1230 Fax: +49-89-3 70 03 99-99 Fax: +886-2-8919-1231 Moxa India Tel: +91-80-4172-9088 Fax: +91-80-4132-1045 Table of Contents 1.
[Show full text]
Practical Perl Tools: Hither and Yon DAVIDCOLUMNS N
Practical Perl Tools: Hither and Yon DAVIDCOLUMNS N. BLANK-EDELMAN David N. Blank-Edelman is Today’s column will be all about hither and yon . Actually, this column will be more the director of technology at about moving files from hither to yon or perhaps yon to hither (not entirely sure the Northeastern University which; pity William Safire didn’t write more Perl modules while he was alive) . If College of Computer and you’ve ever had to move data around, this will be the column for you . Information Science and the author of the O’Reilly book Automating System Administration Built-In Functions and Core Modules for File Copying/Moving with Perl (the second edition of the Otter Let’s start close to home with the function and modules that ship with Perl . Perl book), available at purveyors of fine dead has a rename() function should you want to change the name of a file, perhaps trees everywhere. He has spent the past 24+ moving it in the process to a different place in the current file system . To copy data, years as a system/network administrator in there’s always code like this: large multi-platform environments, including Brandeis University, Cambridge Technology open my $OLDFILE, ‘<’, ‘oldfilename’ or Group, and the MIT Media Laboratory. He was die “Can’t open oldfilename for reading:$!\n”; the program chair of the LISA ’05 conference open my $NEWCOPY, ‘>’, ‘newfilename’ or and one of the LISA ’06 Invited Talks co-chairs. die “Can’t open newfilename for writing:$!\n”; David is honored to have been the recipient # binmode() makes sure no end-of-line translation is of the 2009 SAGE Outstanding Achievement # done on the OSes that make a distinction Award and to serve on the USENIX Board of # between binary and non-binary files Directors beginning in June of 2010.
[Show full text]