NetScanTools 5

Could someone who uses netscantools link me or help me out-
I posted a while ago how my computer kept getting port scanned, so i decided to learn what portscanning was, and i got netscantools to do it. Im scanning my roomates PC, win xp home with no firewall. After I do it, it shows me a bunch of ports with the green circle, but i cant connect to them. Does the green circle have to have the D in it? It says service found but no data recieved. Or am I sounding like a dork? Or do I need a swift kick in the head? Lets hear it..

Sometimes ports are opened without services attached to them. Could you post what ports were open and maybe I or someone else can explain. Also I just downloaded GFI LANguard network security scanner, and I have to say it rocks. I have scanned all the computers on my network, and found some interesting things. It has a 30 day evaluation period and I think it is still free after that it just has fewer features. They have a pro version which you pay for.

edit
I also scanned the ip of my router, and found something I never knew. You all know that a lot of routers have web configuration interfaces. Well when I scanned the router it told me that there was a web server and also a unix operating system. Either it was detecting a computer inside my network(not likely because the only unix like comp I have is RH9 and it detected that on a different scan) or my router is running unix. Kindof neat. Does anyone know more about this, do routers actually run their own mini OS?

Do you have any port forwarding setup on your router?
The scanner would follow this same path if you did. You would think languard would be a little better than that, I can ping a router and if it is resonsive to pings I can usually tell what it is from OS fingerprinting.

00025 - TCP - smtp
00080 - TCP - http
00081 - TCP - unknown
00082 - TCP - unknown
00083 - TCP - unknown
00110 - TCP - pop3
00119 - TCP - nntp
00139 - TCP - netbios-ssn

These ports were open but didnt respond with information- how would you connect to them?

cool
for 25 type this at the command prompt: telnet xxx.xxx.xxx.xxx 25
where the x's are the ip address. then type helo localhost
mail from:<[email protected]>
rcpt to:<[email protected]>
data
message here
.
quit

for port 80 just open your browser and type in http://xxx.xxx.xxx.xxx where the x's are the ip, if he actually has a web page it will show up.

for 110 there isn't much you can do without an account.

for 139 go to start>run and type
\\xxx.xxx.xxx.xxx
where the x's are the ip and you should see all the shares if the person actually has netbios enabled and is sharing something and is not password protecting it.

as for the rest, don't have a clue. If any of these don't work, it is because the port is open but there is no service running or it is a service using a port for a different service.

Assuming you have permission from your roomate........Have you tried to connect with Telnet or use a "Net" (or any) command from a Command Prompt? there are alot of advanced techniques that you can use once you get the basic "enumeration info" from NetScanTools. Be a bit more specific on what you have tried and maybe we can figure it out.

Quote:

---

I also scanned the ip of my router, and found something I never knew. You all know that a lot of routers have web configuration interfaces. Well when I scanned the router it told me that there was a web server and also a unix operating system. Either it was detecting a computer inside my network(not likely because the only unix like comp I have is RH9 and it detected that on a different scan) or my router is running unix. Kindof neat. Does anyone know more about this, do routers actually run their own mini OS?

---

Well there is cisco IOS, which is Inter-networking Operating Software which is a little OS that the router uses for configurations etc, Im still taking cisco so i don't have it mastered..
But as for GFI, that program has been known for false positives..It caused me alot of head aches when I was scanning my systems, but they were just misinterpreted services, that sort of thing..

HAHAHA i did the thing on port 139, he was workin on his computer and i started print off pictures of leprehcans! Awesome- is there a name for what i just did, or was it just childs play?

All you did was access what he was sharing. In this case I guess he was sharing a printer. Just don't do that to anyone you don't know because I think it is illegal given that you are gaining unauthorized access to a remote machine. On the other hand if they have sharing on, they are almost giving you authorization by sharing it with no password. It is your call. I would like to print out a message that says you are insecure, or put up a firewall to all the people with that port open and no password on their shares. Check out my post What am I doing wrong?
for tips on securing and password protecting your friends shares.

Excellent. Thanks a lot for your help- AO rocks

Quote:

---

Originally posted here by rmcgoo
Excellent. Thanks a lot for your help- AO rocks

---

You've got that right. I would give you some positive ap's for saying that, but I have to spread mine around. You got lucky today, you probably wouldn't get that explicit of an answer most of the time here.

Quote:

---

HAHAHA i did the thing on port 139, he was workin on his computer and i started print off pictures of leprehcans! Awesome- is there a name for what i just did, or was it just childs play?

---

Thats not a good thing... that means anyone else who gets to his PC can do the same thing.
That means he has defualt shares and no password protecting it... nor any other access control.

You should have him disable file/print sharing, kill the http server (unless he needs it) and setup a software antivirus/firewall and just allow the PCs that need access to it. If its just a workstation and you don't share devices, block all.

More than likely... you're ISP is going to be your mail server... unless you have set one up yourself. There is no need for him to have port 25 open on the recieving end. 110 is ok, as that is how you get your mail.

It is generally a good idea to block all to start anyway, then allow as you need.

Wazz, i havent tried any net commands, and havent used telnet much at all- Link me or tell me about it!

Oh yeah I know, we deliberately turned off the firewall on his machine- but thanks for the heads up anyway

net commands would get you the same thing as typing \\xxx.xxx.xxx.xxx at the run prompt only that latter is much faster. Telnet is used to connect to services on a remote machine. Since you have found those ports open, a good place to start is to telnet to all the ports and see what happens
telnet xxx.xxx.xxx.xxx port
there is a tut in the tut forum by noODle: http://www.antionline.com/showthread...ghlight=telnet
that should get you going. Happy hacking(I use this word meaning discovering new things).

Of course- the only reason I started doing this is because this is exactly what I learned someone on my campus was doing to me. At least until i sent my logs in

It might be a good idea to repost one or two of those port list sites. These are basically the list of services that run on the first 1024 reserved ports, plus a few more special ones. Neither list is complete and they complement each other really well.

http://www.opendoor.com/doorstop/ports.html
http://www.hackerwhacker.com/portslist.html

This is a list of the 10 most probed ports. It is constantly being updated:

http://www.dshield.org/topports.php

Glad you're having fun rmcgoo, just be careful...LOL Go to a command prompt and type net. You'll get a specific list of options you can use with the net command...poke around yourself a bit to find some interesting things. Telnet is very cool as well....once connect to any given port, bang on the keyboard a bit and on certain ports, you'll get some "curious" info..have a blast!

P.S. - I wouldn't try this on any random boxes or specific "targets".....you can get into BIG trouble grasshoppa!

one last question- I understand that when my roomates folders are shared, I have the ability to take and place different files- but when I try to exectute one of these files, it runs on my machine. If malware was placed onto my machines shared folder, how would a hacker run the program on my machine? Also- is zone alarm any good? I dont feel like payin for another copy of norton

The "Hacker" would either have to have control of your machine, or you would have to run it. Basically you have access to folders on a machine, but not a machine, therefore your machine is still used to run the files. If you had some sort of remote connection tool such as VNC then you could run programs on another computer. As for firewalls, I have heard that Sygate is really good from FrameWork. I have used zonealarm and thought it was alright, but it is not the most secure.

Quote:

---

Originally posted here by n01100110
Well there is cisco IOS, which is Inter-networking Operating Software which is a little OS that the router uses for configurations etc, Im still taking cisco so i don't have it mastered..
But as for GFI, that program has been known for false positives..It caused me alot of head aches when I was scanning my systems, but they were just misinterpreted services, that sort of thing..

---

A lot of times when you do a portscan of a router, it has difficulty guessing the remote Operating system. When this happens, it tends to tell you that it is some sort of a Unix/Linux system. As for the webserver part, you might have an option turned on that lets you access your routers config over the internet which would maybe show up on a portscan as having a webserver running. For example, with my Linksys router I can turn on or off the option to access my router over the internet.