Hack Like a Pro: Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack) « Null Byte :: WonderHowTo

Welcome back, my budding hackers!As I have mentioned many times throughoutthis series, knowing a bit of digital forensics might keep you out of a lot of trouble. In addition, digital forensics is a burgeoning and high paying career. Some knowledge and certifications in this field will likely help you land a Security Engineer position or put you on the Incident Response Team at your employer.Throughout theHack Like a Proseries, we have launched numerous attacks against our targets. In the coming articles in ourDigital Forensicsseries, I'd like to show you what some of those attacks look like from the victim's perspective and how as a digital forensic investigator you would identify them.Why Wireshark Is a Good Forensics ToolAlthough Wireshark is largely used a network analysis tool, it is also an excellent network forensics tool. If we can capture the packets with Wireshark while being attacked, or if we can work while the attack is in progress (such as in an Incident Response Team), we can learn a lot about the attack and the attacker.Step 1: Get the Basic KnowledgeThere are numerous tutorials on how to use Wireshark on the web and evena few in Null Byte(includingan earlier guide in this series on network forensics), so before we begin, I'd ask you to spend a few moments with those tutorials to familiarize yourself with this essential tool.In addition, if you are not familiar with the structure of TCP/IP packets, pleaseread up on that. I have circled the fields of the TCP/IP that we will playing close attention to here. If you aren't familiar with those fields in the IP and the TCP header, you will need to study up on those as well.Step 2: Open Wireshark in KaliBefore we start, I want you to customize Wireshark to show the destination port in the output. So open up Wireshark in Kali and go toPreferences->Columns, then add a "Dest Port (unresolved)" column with the title "Dest Port." Click onApply, thenOK.Step 3: Nmap Scan SignatureLet's start by doingan Nmap scanon the target. Nearly every hacker/attacker does an Nmap scan on their target before attacking. In this way, they can gather information regarding services, ports, OS, and applications running on the target system. Major corporations, government agencies, and other large websites receive thousands of scans per day. Let's see what that would look like from the target's perspective using Wireshark.In this case, let's assume the attacker is being a bit cautious in their scanning. Instead of using a TCP scan that would log their IP address, they are being a bit stealthy byusing a SYN scanthat will not automatically log their IP as no TCP connection is made (these are often referred to stealth or half-open scans). Such a scan command from the attacker's perspective might look like this:kali > nmap -sS -P0 192.168.1.103 -p0-1521When this scan arrives at the destination, it will likely look something like this in Wireshark:Notice that we have repeated packets coming and going from the attacker's IP of 192.168.1.123 to our target system at 192.168.1.103. Also note that each scan is hitting a different port, but not serially. Nmap is designed to scan the ports in pseudo-random order.If we wanted to see only the traffic coming from the attacker's system, we can build a filter that will show only the packets coming from the potential attacker.ip.src ==192.168.1.123We can place this filter in the "Filter" box in Wireshark, as seen below, then clickApply.Now we see only the traffic coming from the scanner. Note that each packet is targeting a different port.If we navigate to the middle pane and expand the TCP header, we will notice that they all have the SYN flag set. Packets with the SYN flag set all coming from the same IP in rapid succession to different ports is the telltale signature of a port scan. Save that IP address, as it is likely to be the IP of your soon-to-be attacker!Step 4: DoS Syn Flood SignatureNext, let's attempt a DoS attack against the target. In this case, we will use ourHping3tool to flood it with SYN packets. Since we don't need a TCP connection to DoS, we can spoof our IP address making it very difficult for an investigator to trace the source of the attack.In addition, many firewalls, intrusion detection systems, and other security devices are designed to blacklist IP addresses that send too many packets within a slice of time. By randomly changing our IP addresses for each packet, it will largely defeat such a security measure.The SYN flood is used to create many uncompleted half connections to the server. The idea here is to use up all the connections in the connection queue so that other legitimate users can't connect to the server. Hping3 does this task admirably.The command the attacker might use looks something like this:kali > hping3 --rand-source -f -S 192.168.1.103 -p80 --floodLet's break this command down a bit:--rand-sourcesends random source IP addresses to the target.-ffragments the packets making it more likely to get past security devices.-Ssends SYN packets to create half-open connections.192.168.1.103is the target IP address.--floodsends packets as fast as possible.When those packets arrive at the target, they will look like this in Wireshark.As you can see in the screenshot above, each packet is coming from a different IP address and all targeting port 80. This is typical DoS attack against a website.Also, take a look at the "Time" column. Notice how little time elapses between each packet—just thousands of a second. This is another signature of a DoS attack and one that many security devices monitor when alerting or acting upon a suspected DoS attack.When you navigate to the middle pane, we can dissect the packet headers. Let's first expand the IP header by clicking on the plus sign next to the IP. When we scroll down a bit, we will see the flags. These are not the flags of the TCP header (S, T, U, P, F, R), but rather the fragment or don't fragment flag. This flag tells the receiving system whether the packet is fragmented or not. It is normally set to "Don't fragment," except when a packet is fragmented (then it is set to "More fragments"). In our case, neither flag is set. This is a telltale sign of malicious traffic, as normal traffic would have either of these flags set, but never neither.Once again, in the middle pane of Wireshark, we can dissect the TCP header and see the destination port is 80 and the TCP flag for all the packets is set to SYN. No ACKs, no RSTs, no FINs, which would be normal, but just all SYNs.Wireshark is an excellent tool for doing network digital forensics if we have the captured packets or the attack is ongoing. Here we have examined and identified signatures of two simple attacks, the port scan and theDoS attack.In future network forensic tutorials, we will examine more complex attacks in order for you to identify them, so keep coming back, by budding hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)How To:Become a Computer Forensics Pro with This $29 TrainingHow To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 11 (Using Splunk)How To:The Five Phases of HackingHack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing)News:Why YOU Should Study Digital ForensicsHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)Hack Like a Pro:Networking Basics for the Aspiring Hacker, Part 2 (TCP/IP)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)How to Hack Databases:Hunting for Microsoft's SQL ServerHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 8 (More Windows Registry Forensics)How To:Tactical Nmap for Beginner Network ReconnaissanceHack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)Hack Like a Pro:How to Use the New p0f 3.0 for OS Fingerprinting & ForensicsHack Like a Pro:How to Conduct Passive OS Fingerprinting with p0fHack Like a Pro:How to Set Up a Honeypot & How to Avoid ThemHack Like a Pro:How to Read & Write Snort Rules to Evade an NIDS (Network Intrusion Detection System)How To:Brute-Force SSH, FTP, VNC & More with BruteDumHow To:Conduct Recon on a Web Target with Python ToolsHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)Hack Like a Pro:How to Fingerprint Web Servers Using HttprintHack Like a Pro:Advanced Nmap for ReconnaissanceHack Like a Pro:An Introduction to Regular Expressions, Part 2Hack Like a Pro:Creating a Virtually Undetectable Covert Channel with RECUBNews:Chinese Hack of U.S. Employment Records Reveals the Weakness of Signature-Based Defense SystemsHow To:Hack WPA WiFi Passwords by Cracking the WPS PINHow To:Use WebTech to Discover What Technologies a Website UsesHow To:Use NMAP 7 to Discover Vulnerabilities, Launch DoS Attacks and More!How To:Map Networks & Connect to Discovered Devices Using Your PhoneHack Like a Pro:How to Conduct Active Reconnaissance on Your Target with hping3Hack Like a Pro:How to Scan the Globe for Vulnerable Ports & ServicesHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItHacking Reconnaissance:Finding Vulnerabilities in Your Target Using NmapWeekend Homework:How to Become a Null Byte Contributor (1/29/2012)Weekend Homework:How to Become a Null Byte Contributor (1/12/2012)