Hack Like a Pro: How to Scan the Globe for Vulnerable Ports & Services « Null Byte :: WonderHowTo

Welcome back, my hacker novitiates!Finding vulnerabilities in systems can be one of the most time-consuming tasks for a hacker. There will be times, though, when you'll find yourself in a position that you know that a particular port represents a vulnerable application or service.The Story of Max VisionFor example, the gray-hat hacker,Max Bulter, aka Max Vision, the founder of arachNIDS who's now serving 9 years in federal prison, found that the Aloha Point-of-Sale (POS) system had installed a remote backdoor to all their systems in order to provide technical assistance purposes to their customers.These Aloha systems are used by small-to-medium sized restaurants that take thousands of credit card numbers each year. Knowing this, Max set a computer program to constantly scan the U.S. for systems that had port 5505 open. This would indicate that the computer was running Alaho's POS system, as port 5505 is not used by any other common service, and that the vulnerable service was open and available.When he found the port open, he would then execute an exploit against that port and service and scavenge all the credit card numbers he could. He then sold them for $5 to $50 each bringing him a tidy return for each hack.How to Scan for Vulnerable PortsIn this tutorial, we'll write a short script that does exactly what Max Vision was doing and send a report with every IP address of the vulnerable system.Step 1: Open a Text EditorTo create our script, we need to open a text editor. Any of theLinuxtext editors will work;vi,emacs,gedit(in the GNOME),Kate, orKWrite. In this guide, we'll use the KWrite editor built intoBackTrack5v3 KDE. We simply type in a terminal:kwrite globalportscan.shWe can name our script anything, but I have chosen to call itglobalportscan.sh.This will open a blank file editor for our script.Step 2: Create the ScriptNow we need to type the following lines in our script file.#!/bin/bashThe required opening of all BASH scripts.nmap -sT 74.125.225.0/24 -p 5505 -oG alohaDoes an nmap connect scan (-sT) to the subnet of google.com and looks for the port 5505 open and sends the output (-oG) to a file called aloha.cat aloha | grep open > alohaopenOpens the file aloha and filters (grep) for lines that say open, and stores those lines in a file called alohaopen.cat alohaopen | cut -f2 -d ":" | cut -f1 -d "(" > alohavulnOpens the file alohaopen and cuts it at the second field (-f2) defined by the delimiter (-d) semicolon (":"), then pipes that to a second cut command that cuts the file at the first field (-f1) defined by the delimiter (-d) paren ("(") and saves it into a file named alohavuln.cat alohavulnFinally, we open and display the file that contains all the IP addresses of systems with port 5505 open.Step 3: Run the ScriptNow that you have saved the script, it's time to run it.sh globalportscan.shNow, sit back and wait for your results. It could take a while depending upon how many IP addresses you're scanning. In our example, we're only scanning 255 addresses, so it only takes a few minutes, but you could very well set this up to scan millions of addresses, in which you might wait days for results.Step 4: Final ResultsWe can run this script on any IP address or network. I just used google.com as an example (you're not likely to find port 5505 open at google.com). You should see results that look something like this:Of course, this vulnerability is likely closed in nearly all systems now, but this script can easily be edited to scan for other ports and other IP addresses depending upon your needs.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicensePOS systemandWorldimages via Shutterstock, Max photos viaWIREDandSanta Clara County SheriffRelatedHack Like a Pro:Advanced Nmap for ReconnaissanceHow to Hack Databases:Hunting for Microsoft's SQL ServerHack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHow To:Locate & Exploit Devices Vulnerable to the Libssh Security FlawHack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHow To:Tactical Nmap for Beginner Network ReconnaissanceHow To:Map Networks & Connect to Discovered Devices Using Your PhoneHack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapSPLOIT:How to Make a Python Port ScannerHack Like a Pro:Creating a Virtually Undetectable Covert Channel with RECUBHow To:Hack TOR Hidden ServicesHow To:Discover Computers Vulnerable to EternalBlue & EternalRomance Zero-DaysHow To:Do an Idle Scan with NmapHow To:Hack Hackademic.RTB1 Machine Part 1Hack Like a Pro:How to Hack Web Apps, Part 7 (Finding Hidden Objects with DIRB)News:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Discover Open Ports Using Metasploit's Built-in Port ScannerHow To:Automate Brute-Force Attacks for Nmap ScansHow To:Discover & Attack Services on Web Apps or Networks with SpartaNews:Scandy Gives Tango Owners a Taste of 3D ScanningHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)News:The 5 Best Apps for Scanning Text & Documents on AndroidHack Like a Pro:How to Set Up a Honeypot & How to Avoid ThemBest Android Antivirus:Avast vs. AVG vs. Kaspersky vs. McAfeeHow To:Conduct Recon on a Web Target with Python ToolsHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:How to Find Vulnerable Targets Using Shodan—The World's Most Dangerous Search EngineHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItHacking Reconnaissance:Finding Vulnerabilities in Your Target Using NmapInstagram Challenge:Globe's GlowNews:Russell Crotty's Astronomical Paper GlobesHow To:Protect Your Mac & Linux Computers from Hacks by Creating an iptables FirewallNews:Congrats to Natalie Portman for her Golden Globe Best Actress win!News:***Where to get *GUNS*EXPLOSIVES* From Mission's***