Unlike passive information gathering, which involves an intermediate system for gathering information, active information gathering involves a direct connection with the target.The client probes for information directly with the target with no intermediate system in between. While this technique may reveal much more information than passive information gathering, there’s always a chance of security alarms going off on the target system. Since there’s a direct connection with the target system, all the information requests would be logged and can later be traced back to the source. The following diagram depicts active information gathering where the client is directly probing the target system:

OSI Model / TCP/IP Model

The Open Systems Interconnection model (OSI model) is a conceptual model that characterises and standardises the communication functions of a telecommunication or computing system without regard to its underlying internal structure and technology. Its goal is the interoperability of diverse communication systems with standard communication protocols.

The TCP/IP model is a concise version of the OSI model. It contains four layers, unlike seven layers in the OSI model. The layers are:

  1. Process/Application Layer
  2. Host-to-Host/Transport Layer
  3. Internet Layer
  4. Network Access/Link Layer

Mapping between OSI Model and TCP/IP Model:

Difference between TCP/IP and OSI Model:

                       TCP/IP                      OSI
TCP refers to Transmission Control Protocol. OSI refers to Open Systems Interconnection.
TCP/IP has 4 layers. OSI has 7 layers.
TCP/IP is more reliable OSI is less reliable
TCP/IP does not have very strict boundaries. OSI has strict boundaries
TCP/IP follow a horizontal approach. OSI follows a vertical approach.
TCP/IP uses both session and presentation layer in the application layer itself. OSI uses different session and presentation layers.
TCP/IP developed protocols then model. OSI developed model then protocol.
Transport layer in TCP/IP does not provide assurance delivery of packets. In OSI model, transport layer provides assurance delivery of packets.
TCP/IP model network layer only provides connection less services. Connection less and connection oriented both services are provided by network layer in OSI model.
Protocols cannot be replaced easily in TCP/IP model. While in OSI model, Protocols are better covered and is easy to replace with the change in technology.

Layer 2 Discovery – Arping / netdiscover

Layer 2 tools can act faster than layer 3 but it can not go to another network. The packets stays in the same network.

└─# arping -c 3                                                                                                      1 ⨯
60 bytes from 00:78:cd:00:fd:f4 ( index=0 time=4.034 msec
60 bytes from 00:78:cd:00:fd:f4 ( index=1 time=2.622 msec
60 bytes from 00:78:cd:00:fd:f4 ( index=2 time=3.788 msec

--- statistics ---
3 packets transmitted, 3 packets received,   0% unanswered (0 extra)
rtt min/avg/max/std-dev = 2.622/3.481/4.034/0.616 ms
Mac Address Look Up: https://ift.tt/3ffrLCJ

└─# netdiscover -i eth0 -r    

 Currently scanning: Finished!   |   Screen View: Unique Hosts                                                                      
 172 Captured ARP Req/Rep packets, from 30 hosts.   Total size: 10320                                                               
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------         08:ea:40:f8:48:a2     48    2880  SHENZHEN BILIAN ELECTRONIC CO.,LTD                                              08:ea:40:fc:48:f3     46    2760  SHENZHEN BILIAN ELECTRONIC CO.,LTD                                              08:ea:40:f8:44:63     36    2160  SHENZHEN BILIAN ELECTRONIC CO.,LTD                                          00:78:cd:00:fd:f4      1      60  Ignition Design Labs                                                          08:cc:68:40:71:c1      1      60  Cisco Systems, Inc                                                            00:0c:29:1b:b7:e1      1      60  VMware, Inc.      

└─# netdiscover -p   

 Currently scanning: (passive)   |   Screen View: Unique Hosts                                                                      
 307 Captured ARP Req/Rep packets, from 12 hosts.   Total size: 18420                                                               
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------         08:ea:40:f8:44:63     94    5640  SHENZHEN BILIAN ELECTRONIC CO.,LTD                                        24:be:05:e2:40:8f     13     780  Hewlett Packard                                                                   08:ea:40:f8:48:a2     82    4920  SHENZHEN BILIAN ELECTRONIC CO.,LTD                                              08:ea:40:fc:48:f3     82    4920  SHENZHEN BILIAN ELECTRONIC CO.,LTD                                              00:78:cd:03:d3:00      6     360  Ignition Design Labs                                                        00:78:cd:03:d3:00      2     120  Ignition Design Labs                                                        5c:cf:7f:73:26:55     13     780  Espressif Inc.                                                                    00:78:cd:01:05:b8      6     360  Ignition Design Labs                                                              00:78:cd:03:d7:40      4     240  Ignition Design Labs

Layer 3 Discovery – Ping

Layer 3 tools can be used to discover different networks. 


hping / fping

  • Use traceroute mode (–traceroute), be verbose (-V) in ICMP mode (-1) against the target (www.xxx.com):
    • root@kali:~# hping3 –traceroute -V -1 www.xxx.com
  • -q: brief output. -c: packets numbers. -d:packet site. -S:SYN packets.  -p:Port Number. -w:tcp window size. –flood: shoot at discretion, replies will be ignored. –rand-source: hide source ip using a fake random ip. 
    • hping3 -q -c 10 -d 120 -S -w 64 -p 80 –flood –rand-source www.xxx.com 
  • fping -g -c 1 | grep ms > results.txt

Layer 4 Discovery – Nmap

According to the official Nmap website –

“Nmap  is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. “

Nmap Target Selection

Scan a single IP nmap
Scan a host nmap www.test.com
Scan a range of IPs nmap
Scan a subnet nmap
Scan targets from a text file nmap -iL list-of-ips.txt

Nmap Port Selection

Scan a single Port nmap -p 22
Scan a range of ports nmap -p 1-100
Scan 100 most common ports (Fast) nmap -F
Scan all 65535 ports nmap -p-

Nmap Port Scan types

Scan using TCP connect nmap -sT
Scan using TCP SYN scan (default) nmap -sS
Scan UDP ports nmap -sU -p 123,161,162
Scan selected ports – ignore discovery nmap -Pn -F

Service and OS Detection

Detect OS and Services nmap -A
Standard service detection nmap -sV
More aggressive Service Detection nmap -sV –version-intensity 5
Lighter banner grabbing detection nmap -sV –version-intensity 0

Nmap Output Formats

Save default output to file nmap -oN outputfile.txt
Save results as XML nmap -oX outputfile.xml
Save results in a format for grep nmap -oG outputfile.txt
Save in all formats nmap -oA outputfile

Digging deeper with NSE Scripts

Scan using default safe scripts nmap -sV -sC
Get help for a script nmap –script-help=ssl-heartbleed
Scan using a specific NSE script nmap -sV -p 443 –script=ssl-heartbleed.nse
Scan with a set of scripts nmap -sV –script=smb*

A scan to search for DDOS reflection UDP services

Scan for UDP DDOS reflectors nmap –sU –A –PN –n –pU:19,53,123,161 –script=ntp-monlist,dns-recursion,snmp-sysdescr

HTTP Service Information

Gather page titles from HTTP services nmap –script=http-title
Get HTTP headers of web services nmap –script=http-headers
Find web apps from known paths nmap –script=http-enum

Detect Heartbleed SSL Vulnerability

Heartbleed Testing nmap -sV -p 443 –script=ssl-heartbleed

IP Address information

Find Information about IP address nmap –script=asn-query,whois,ip-geolocation-maxmind


>>> ARP().display()
###[ ARP ]### 
  hwtype= 0x1
  ptype= IPv4
  hwlen= None
  plen= None
  op= who-has
  hwsrc= 00:0c:29:fc:11:ce
  hwdst= 00:00:00:00:00:00
>>> sr1(ARP(pdst=""))
Begin emission:
Finished sending 1 packets.
Received 1 packets, got 1 answers, remaining 0 packets
<ARP  hwtype=0x1 ptype=IPv4 hwlen=6 plen=4 op=is-at hwsrc=00:78:cd:00:fd:f4 psrc= hwdst=00:0c:29:fc:11:ce pdst= |<Padding  load='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' |>>                                     

>> IP().display()
###[ IP ]### 
  version= 4
  ihl= None
  tos= 0x0
  len= None
  id= 1
  frag= 0
  ttl= 64
  proto= hopopt
  chksum= None

>>> ICMP().display()
###[ ICMP ]### 
  type= echo-request
  code= 0
  chksum= None
  id= 0x0
  seq= 0x0

>>> sr1(IP(dst="")/ICMP(),timeout=1)
Begin emission:
Finished sending 1 packets.
Received 1 packets, got 1 answers, remaining 0 packets
<IP  version=4 ihl=5 tos=0x0 len=28 id=50232 flags= frag=0 ttl=64 proto=icmp chksum=0x3143 src= dst= |<ICMP  type=echo-reply code=0 chksum=0xffff id=0x0 seq=0x0 |<Padding  load='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' |>>>                                                                                                                        

Half open port scanning

>>> TCP().display()
###[ TCP ]### 
  sport= ftp_data
  dport= http
  seq= 0
  ack= 0
  dataofs= None
  reserved= 0
  flags= S
  window= 8192
  chksum= None
  urgptr= 0
  options= []

>>> sr1(IP(dst="")/TCP(flags="S",dport=80),timeout=1)
Begin emission:
Finished sending 1 packets.
Received 2 packets, got 1 answers, remaining 0 packets
<IP  version=4 ihl=5 tos=0x0 len=44 id=0 flags=DF frag=0 ttl=64 proto=tcp chksum=0xb566 src= dst= |<TCP  sport=http dport=ftp_data seq=3654116272 ack=1 dataofs=6 reserved=0 flags=SA window=29200 chksum=0x62bd urgptr=0 options=[('MSS', 1460)] |<Padding  load='\x00\x00' |>>>

from Blogger http://blog.51sec.org/2021/05/pen-test-lab-3active-information.html

By Jon

Leave a Reply

Ads Blocker Image Powered by Code Help Pro

Ads Blocker Detected!!!

We have detected that you are using extensions to block ads. Please support us by disabling these ads blocker.