.. include:: /global.rst ================================================= Lab 02: Performing Active Reconnaissance ================================================= Overview ======== This lab moved from public research to directly probing systems in an isolated lab network. I discovered hosts, fingerprinted operating systems, compared how scan types look on the wire, and ran vulnerability scans to find weaknesses worth investigating further. Objectives ========== - Discover live hosts and identify their operating systems - Compare scan types through their packet sequences - Build custom scan profiles - Run vulnerability scans and interpret the results Tools and Technologies ====================== - Nmap and Zenmap (host discovery, port scanning, OS detection) - Nmap Scripting Engine (``ssh-hostkey``) - Wireshark (packet analysis) - Nessus Essentials (vulnerability scanning) - OpenVAS / Greenbone Security Manager (vulnerability scanning) - Kali Linux and Windows attack machines Lab Writeup =========== Host Discovery and OS Fingerprinting ------------------------------------ Zenmap's ping and Quick scan plus profiles identified the hosts below and mapped them on a network topology view. .. list-table:: :header-rows: 1 * - IP Address - Operating System Identified * - 172.30.0.20 - Microsoft Windows (version unknown) * - 172.30.0.30 - Microsoft Windows Server 2012 * - 172.30.0.40 - Microsoft Windows Server 2016 * - 172.31.0.40 - Linux 2.6.32 * - 172.31.0.50 - Linux 3.11-4.1 * - 172.31.0.60 - Linux 2.6.15-2.6.26 Scan Traffic Analysis --------------------- - **SYN scan:** captured the 3-packet sequence (SYN, SYN/ACK, RST), which resets the connection before the handshake completes - **TCP Connect scan:** captured the 4-packet sequence (SYN, SYN/ACK, ACK, RST), which completes the handshake before closing - **UDP scan:** scanned port 53 on 172.30.0.1 and captured the ICMP Destination Unreachable responses - **ACK scan:** reported all 100 scanned ports on 172.30.0.20 as filtered with no response Targeted Nmap Scans ------------------- - Used the ``ssh-hostkey`` script to retrieve the DSA and RSA host keys from 172.31.0.60 - Created a custom Zenmap profile (``nmap -p "22, 80, 443" -n -PS``), which showed ports 22 and 80 open and port 443 closed on 172.31.0.60 Vulnerability Scanning ---------------------- - Created a Nessus policy and scan that flagged **MS17-010**, a high-severity SMBv1 remote code execution vulnerability linked to ETERNALBLUE and WannaCry - Ran an OpenVAS scan that detected a weak MySQL / MariaDB password, with changing the password as the recommended mitigation - Saw OpenVAS also report a high-severity vsftpd backdoor and anonymous FTP login on 172.31.0.40 Key Findings ============ - Scan types leave different traffic patterns, which affects how visible they are to defenders - Filtered ports can hide services from some scan types, so a single scan doesn't give the full picture - OS fingerprinting gives useful leads, but results may be imprecise or return a range of versions - Older systems can still carry critical, well-known vulnerabilities - Simple configuration problems like weak passwords can be as serious as missing patches Key Skills Learned ================== - Running and customizing Nmap and Zenmap scans - Reading TCP and UDP scan behavior in Wireshark - Using Nmap scripts to gather service details - Configuring and running Nessus and OpenVAS scans - Reading vulnerability reports, including severity and remediation guidance Topics Covered ============== - Active reconnaissance and network enumeration - Host discovery and port scanning - OS fingerprinting - TCP handshake and UDP behavior - Vulnerability assessment Conclusion ========== This lab showed how to turn a list of IP addresses into a prioritized view of potential weaknesses. Seeing each scan in Wireshark also made it clear what these tools actually send across the network and what a defender would be able to see. Lab File ========= .. raw:: html