Private networks

i was reading this article: http://www.livepublishing.co.uk/pcex...g.shtml?page=1
and it doesnt really make sense to me. particularly the parts like this:

Quote:

---

Let's port scan Victim Corp’s network using ScanPort, (www.dataset.fr/eng/scanport.html) which is a simple port scanner that allows you to specify a range of machines to scan. From the results, we can see that port 25 is open on machine 192.168.1.8, which ScanPort suggests is probably the company’s email server.

---

isnt it impossible to do a port scan to that ip and actually get a computer inside their network? it also says some stuff about finding the network's range of ip addresses using traceroute, which i dont think would work either... is this just a poorly written guide or what?

not poorly...well yeah a little poorly but most likely its written for basic users trying to get into the security world?

Today you have scanners such as Retina and Shadow Security Scanner which will tell you what ports are open, what programs are using them, and any vulnerabilities with the computer/server you are scanning. He does refer to NMAP and all...but his article is still informative IMHO.

yeah, but you cant scan private addresses on a network unless you're on the network right?

depends on how deep you get in. I.E. I dont see why you wouldn't be able to install a backdoor in a vulnerable PC inside the network, and have the trojan scan the network from the inside and contact you with its findings. Someone more experienced could give a better reasoning to this.

so, they couldnt do it without a trojan?

you cannot _directly_ access an address designated private, (192.168.x.x, 10.x.x.x or 72.16,(is it), x.x), because the routers on the public network are not allowed to route them. The only way to access them is to gain a foothold on the publicly addressed machine(s) inside the network and then make contact from there or have the privately addressed machine "shovel" a connection to the attacker through a NAT type device and then issue your commands backwards......

The writer was most likely using that IP as an example not actually suggesting it's possible to portscan such a IP range from the net.

Quote:

---

Originally posted here by Tiger Shark
you cannot _directly_ access an address designated private, (192.168.x.x, 10.x.x.x or 72.16,(is it), x.x),

---

Hey Hey,

it's actually 172 for everyone (i'm assuming that was a typo) and it's not as commonly used aas 192.168. and 10. however the entire range for those private IPs is 172.16.0.0 - 172.31.0.0 (CIDR: 172.16.0.0/12)

It's funny when you look at it... They just kept adding 4.... to the CIDR mask

10.0.0.0/8 (originally a Class A Address)
172.16.0.0/12 (originally a Class B Address)
192.168.0.0/16 (originally a Class C Address)

PS. Sorry for pulling ya'll off topic a bit.

Peace,
HT

HT: Yeah... I have only ever used the 192.168. and 10. subnets before and at my advancing age I can never remember for the life of me the third subnet.... :o

ok, thanx... i was beginning to confuse myself again