Wow, that was a great tutorial! I learned a lot from that.
-Ben
Printable View
Wow, that was a great tutorial! I learned a lot from that.
-Ben
LOL, Tiger, I had no idea you were a "Masta Gangsta" too.Quote:
quote:
220 Crack House - Da Masta Gangstaz
Login credentials accepted by ftp server!
HEY, Hoss..... Leave my bloody servers alone..... DAMMIT......
Nice work..... Where do you want me to put your toys?
Actually, we use names like that in proof-of-concept demonstrations. Using colorful names like that seem to get non technical managers a little more interested when we create the image of the mean evil haxor. All I can tell ya is that it works in getting them interested and that's why we name our lab boxes in such ways. Of course my home FTP server is named, "Icy Hot Stunta" ;).
For anyone who is interested, the Ricoh Aficio 1075 departmental all in one printer has an anonymous FTP service running that will allow you to bounce NMAP (see the tut) scans off of it. I found this while doing an audit on the product. Needless to say, this POS will not be getting near an RJ45 jack in our facility. It also has a large list of other issues but this is the only one that is associated with this tut.
--TH13
hey,
I was playing around with this and found something rather interesting. MsMittens suggested I'd post it here.
OK, two friends of mine were willing to take each a seperate scan and look in their IDS or firewall, to see the what IDS's would see.
The guy with the firewall/router saw only the scan coming of the zombie, which is good. The guy with the IDS saw the nmap scan coming with three different zombies. He logged my origin ip.
This is my output :
I used on both at least one same working bounce target.
OK, as you can see the nmap run finished succesfully. Are even these idlescans rafled by IDS's these days ? Obviously the firewall was fooled.Quote:
root@Furious shrekkie # nmap -v -P0 -sI A.B.C.D *.*.*.*
Starting nmap 3.48 ( http://www.insecure.org/nmap/ ) at 2004-01-07 20:27 Local time zone must be set--see zic manual page
Host target.com (*.*.*.*) appears to be up ... good.
Idlescan using zombie A.B.C.D (A.B.C.D:80); Class: Incremental
Initiating Idlescan against target.com (*.*.*.*)
All 1657 scanned ports on target.com (*.*.*.*) are: closed
Nmap run completed -- 1 IP address (1 host up) scanned in 79.691 seconds
Also note that the primary objective was not to find open ports here, only to see how the firewall/IDS would act.
Here an example of the IDS log :
Greetz,Quote:
[06/Jan/2004 20:22:21] "Ids" action = permitted, raddr = MY.ORIGIN.IP.HERE , msg = '"Port scan has been detected"', url = '', direc = in, class = 'network-scan', priority = portscan
Yes, the idle scan technique is *verrry* effective which makes it that much more dangerous.
Would this be the experiment you IMed me about Shrekkie?
thehorse13,
No, I did two different myself today. I can't understand how the IDS picked it up tho.
Greetz,