Hack Like a Pro: How to Conduct Active Reconnaissance and DOS Attacks with Nmap « Null Byte :: WonderHowTo

Welcome back, my nascent Hackers!Inmy last blog, we looked at a passive way to gather information necessary for a hack. The advantage of using passive recon is that it's totally undetectable, meaning that the target never knows you're scouting them and you leave no tracks. The disadvantage, of course, is that it's limited to only some websites and not entirely reliable.In this tutorial, we'll look at active reconnaissance of a target with one of the best network scanning tools,nmap.The risk with active scanning is that you will be detected and the security hardware or security admin will block any further attempts by you to pwn the site, or worse—report you to law enforcement. Nmap has multiple modes of scanning a potential target and many ways of evading detection.Step 1: Open NmapLet's go to our hacking platform,BackTrack, and open up nmap. To find it, go the BackTrack button at the bottom left of the screen to open up the initial menu options. Then, selectBackTrack->Information Gathering->Network Analysis->Network Scanners, and click onnmap.Step 2: Using NmapWhen you select nmap, you'll open a screen that looks like the screenshot below.Note that it opens a Linux terminal with the help screen for nmap. Whenever you want to see the help screen, you can simply type at the command prompt:bt > nmap -hYou can also get the manual for nmap by typing:bt > man nmapNmap is a delightful tool for gathering information on a network or site. For instance, if we want to gather information onESPN.com, we can type:bt > nmap -sT espn.comWe can see some of the output below.This command tells nmap to scan (-s) using TCP (T) the domain espn.com. Note that the output shows us the ports that this web server has open. With this information, we can then reasonably conclude that the default services for these ports are running on this system. In this case, this server has port 25 open (SMTP), port 80 open (HTTP), port 135 open (msrpc), port 139 open (net-bios), and port 445 (msds).This is important information to have when selecting a hack/exploit as each hack is specific to technologies/services.Step 3: Operating System DetectionNmap is also capable of detecting and making a guess as to what the operating system is. Type:bt > nmap -O espn.comWe can see from the screenshot above that nmap guessed that this site is running F5 Networks with a 93% probability and OpenBSD with a lower 85% probability.Step 4: Stealth ScanThe above scan by nmap is highly reliable, but its drawback is that it's also easily detectable. Nearly every system admin will know that you're scanning their network as it creates a full TCP connection, and this is logged with your IP address in the log files.A more stealthy scan can be conducted using the -sS switch in nmap. This scan uses SYN flagged packets that do NOT create a connection on the target machine and therefore are not logged. This type of scan is slightly less reliable, but is much more stealthy. Type:bt > nmap -sS espn.comAs we can see in the screenshot above, it gave us the same results without our activity being logged by the target system.Step 5: Evading Intrusion Detection SystemsMost commercial servers and websites have intrusion detection systems (IDS) protecting them. These systems look for telltale signs of malicious activity, then alert the security administrator. Scans such as ours are easily detected by these systems and can set off an alert.However, there are numerous ways to evade these IDSs, and we'll look at one here.IDSs usually have a threshold setting. This means that if it sees numerous packets that appear to be scans, then it will alert the admin. To avoid detection, we can simply slow down our scan below this threshold. Nmap has numerous speed settings. Here we'll use the "sneaky" speed setting. Let's type:bt > nmap -sS -T2 espn.comThe -T2 setting tells nmap to use the sneaky speed. This scan will likely take longer, but it is much more likely to go undetected by the IDS.One Final NoteNmap can also be an excellentdenial of service (DOS)tool. If several individuals all send packets from nmap at a target simultaneously at high speed (nmap "insane" speed or -T5), they're likely to overwhelm the target and it will be unable to process new website requests effectively, rendering it useless.We'll continue with more reconnaissance techniques in future tutorials, so keep coming back! Until then, feel free to ask questions on this topic below, or head theNull Byte forumfor any questions off topic.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image courtesy of 20th Century FoxRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHow To:Tactical Nmap for Beginner Network ReconnaissanceHack Like a Pro:How to Conduct OS Fingerprinting with Xprobe2How to Hack Databases:Hunting for Microsoft's SQL ServerHow To:Use NMAP 7 to Discover Vulnerabilities, Launch DoS Attacks and More!Hack Like a Pro:The Hacker MethodologyHack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)Advanced Nmap:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowHack Like a Pro:Advanced Nmap for ReconnaissanceHow To:The Five Phases of HackingHow To:Attack a Vulnerable Practice Computer: A Guide from Scan to ShellHack Like a Pro:How to Use Maltego to Do Network ReconnaissanceHack Like a Pro:How to Conduct Passive Reconnaissance of a Potential TargetHow To:Automate Brute-Force Attacks for Nmap ScansHack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHack Like a Pro:How to Conduct Active Reconnaissance on Your Target with hping3Mac for Hackers:How to Organize Your Tools by Pentest StagesHow To:Advanced Penetration Testing - Part 1 (Introduction)How To:Perform Network-Based Attacks with an SBC ImplantHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)News:Banks Around the World Hit with Repeated DDoS Attacks!Hack Like a Pro:Creating a Virtually Undetectable Covert Channel with RECUBHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Easily Detect CVEs with Nmap ScriptsVideo:How to Use Maltego to Research & Mine Data Like an AnalystBecome an Elite Hacker, Part 2:Spoofing Cookies to Hack Facebook SessionsHack Like a Pro:How to Conduct Passive OS Fingerprinting with p0fHacking Reconnaissance:Finding Vulnerabilities in Your Target Using NmapHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItWeekend Homework:How to Become a Null Byte ContributorNews:Obama and Congress Approve Resolution that Supports UN Internet TakeoverHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesWeekend Homework:How to Become a Null Byte Contributor (1/29/2012)Weekend Homework:How to Become a Null Byte Contributor (1/12/2012)Vaccine bombshell:Baby monkeys develop autism after routine CDC vaccinations