Telnet abuse
Results 1 to 6 of 6

Thread: Telnet abuse

  1. #1
    Junior Member
    Join Date
    Dec 2002
    Posts
    26

    Question Telnet abuse

    I know you can telnet to SMTP, POP, IMAP, and FTP, send mail, download mail and download files with these services. I know this is a security concern and there are several ways to protect this from happening. I've also been told you can telnet to port 80 and do various things there. What I'm wondering what damage can an attacker do if they wear to gain unathorized access to this port, how would they do it and what you can do to prevent this. I've tried telnetting to a friends server(with his permission of course) on port and see if I could figure it out myself. Any input or further references to this subject would be greatly appreciated.

  2. #2
    AO übergeek phishphreek's Avatar
    Join Date
    Jan 2002
    Posts
    4,325
    I'm wondering what damage can an attacker do if they wear to gain unathorized access to this port
    If you are meaning port 80 (nomally HTTP), then none.

    They can find out what OS and web server you are using, unless it is masked.

    Check out the tutorial by binary005 on "HTTP Basics".
    Quitmzilla is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.

  3. #3
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,786
    the most used and most effective tool used against a web site is the web browser.
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  4. #4
    Senior Member
    Join Date
    Sep 2001
    Posts
    1,027
    Well, you have to understand that "telneting to a server/port" really only means that you are using a telnet client (an app that connects to a host on a specified port, and sends characters you input, to the remote host) to connect to a specific service.

    This is nothing extra-ordinary. The only diffrence between "telneting" to a pop server and using a mail client to connect to it, is that you'll have to know the protocol/commands for that specific service.
    That you send:
    "user myusername
    pass mypass"
    to a pop3 server by hand (in telnet) or in an automated manner (mail client) really dosen't make any diffrence to the pop server.
    Same goes for http servers... Only diffrence is that YOU will have to work harder to get the same results.

    Ok, yes, sometimes telnetting will give you more details, like http headers or banners that are usually hidden by client apps because un-interesting to the common user, but it's not like it's a "hack" in itself. That banner get's sent to your web browser anyways, it's just usually not showed to you.

    Ammo
    Credit travels up, blame travels down -- The Boss

  5. #5
    Member
    Join Date
    Dec 2002
    Posts
    88
    Connecting to port 80 via telnet would enable you to send HTTP request, like your browser does and ppl have already said here. Only difference is that you can use it to get information through its methods, and sending malformed requests. But most of them might be done via browser, as tedob1 said. To get information about your sever (cgi vulnerablities), they may just use whisker, which is a tool that automates an otherwise quite boring process. You should just be aware of what kind of message reaches your webserver, not if they connected via telnet, netcat or Opera. Keep your servers up to date, and pay attention to your PHP files and CGI..

  6. #6
    Senior Member
    Join Date
    Oct 2002
    Posts
    4,055
    Yeah, it's mostly uneffecting unless a user is trying to gain knowledge on what server your running (http) and what version, which could be used to help them to try to exploit your web server. Simply connecting to the site on port 80 isn't going to do much, nothing that (like others said) you can't do with a normal web browser. Just remember to always update your software (versions, patches, etc) and you should be fine.
    Space For Rent.. =]

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •