Background
TCP/IP (Transmission Control Protocol/Internet Protocol) is the basic
communication language or protocol of the Internet.
TCP/IP is a two-layer program.
- The higher layer, Transmission Control Protocol, manages the
assembling of a message or file into smaller packets that are
transmitted over the Internet and received by a TCP layer that
reassembles the packets into the original message.
- The lower layer, Internet Protocol, handles the address part of
each packet so that it gets to the right destination.
Many Internet users are familiar with the even higher layer
application protocols that use TCP/IP to get to the Internet. These
include the World Wide Web's Hypertext Transfer Protocol (HTTP),
the File Transfer Protocol (FTP), Telnet (Telnet) which lets you logon
to remote computers, and the Simple Mail Transfer Protocol (SMTP).
These and other protocols are often packaged together with TCP/IP as
a "suite."
Protocols related to TCP/IP include the User Datagram Protocol (UDP),
which is used instead of TCP for special purposes. Other protocols are
used by network host computers for exchanging router information. These
include the Internet Control Message Protocol (ICMP), the Interior
Gateway Protocol (IGP), the Exterior Gateway Protocol (EGP), and the
Border Gateway Protocol (BGP).
Enumeration
Enumeration is a process to actively probe weaknesses
of the identified services.
Tools for enumeration
- Banner grabbing: telnet and netcat (nc) at
www.atstake.com/research/tools
- Enumerate common network services
- SMTP: 25 - telnet
- DNS: 53 - nslookup
- TFTP: 69 - tftp
- Finger: 79 - finger
- HTTP: 80 - nc
- Microsoft RPC: 135 - epdump
- NetBIOS Name Service: 137 - net, nltest from Windows Resource Kit,
netviewx at www.ibt.ku.dk/jesper/NTtools/, nbtstat, nbtscan
- NetBIOS Session Enumeration: 139 - net, DumpSec at www.somarsoft.com,
user2sid, enum, nete, uerinfo, userdump, GetAcct at
www.securityfriday.com
- SNMP: 161 - snmputil, snmpget, snmpwalk
- BGP: 179
- Windows Active Directory using LDAP
- Novel NetWare: 524 and IPX
- UNIX RPC: 111 - rpcinfo