Network Scanning

Introduction
Take back control of your network. 
Keep it clean and secure.

Adrian Mikeliunas, CISSP

amikeliunas@worldbank.org
INT-3, June 13, 2005
 Outline
• Definitions
• Types of Scans
• Methodology
• Tools
• Reports
• Observations
• Summary
INT-3 Network Scanning 2
 Who Scans?
“From friendlier to foe”

• Information Security Personnel

• Systems Administrators [policy]
• Auditors, Consultants, or Ethical
Hackers [Penetration Testing]
• Unauthorized Personnel [boot CD]
• Compromised systems [worms, bots]
• Internal or External Hackers
INT-3 Network Scanning 3
 What to Scan?
• Network Devices
– Firewalls, Routers, Wireless, Video Conferencing
• Servers
– Databases, Web Servers, File & Print, …
• Desktops, Laptops, PDAs
– Antivirus, Firewall, Patch levels
– Running Peer to Peer (P2P)?
• Wireless
– 802.11x, Encryption, SSID, WEP, WPA

INT-3 Network Scanning 4

 When to Scan?
“Right before the attack…”

• During Business hours:

– Better network & admin support
– Non-compliant activities detected

• After business hours:

– Cleaner network traffic
– Busy time for intruders

INT-3 Network Scanning 5

 Where to Scan from?
“Depends on what you can see…”

• Intranet
– You can view ALL your trusted devices
– Run from scanner server [database] & multiple
authorized clients
• Internet & Remote Locations
– Verify firewall rules, services available
• De-militarized Zone (DMZ)
– Verify hardened systems policies
• Specific subnet
– Troubleshooting, target a specific system

INT-3 Network Scanning 6

 Why Scan?
”One step ahead from intruders…”

• Business Objectives • Security Life Cycle

– Network Inventory – Policy & Standards
– Vulnerability – Self-Assessment
Management – Design Architecture
– Risk Assessment – Deploy
– Regulations or Policy – Manage [patch]
Compliance – Educate
– Auditors or Certification
Requirements

INT-3 Network Scanning 7

 How to scan?
• Obtain Scanner Tool
• Install & perform initial test
• Learn how to use it properly!
– Disable Denial of Service Tests, …
• Meet with project sponsor, clients, or
interested parties to propose:
– Scan Schedule & Policies
– Reporting frequency
– Who fixes vulnerabilities
– Who verifies work done
INT-3 Network Scanning 8
 My Experience
• Scanning since 1998
– WB Group: http://www.worldbank.org
• Composed of five organizations: IBRD, IDA,
IFC, MIGA and ICSID
• Headquarters: Washington, DC & more than
100 country offices, more than 12,000 people.
– Other related organizations:
• http://home.developmentgateway.org
• http://www.gdln.org

INT-3 Network Scanning 9

Vulnerability Management
Discover

Verify Scan

Resolve Report

INT-3 Network Scanning 10

 Scan Objectives
“Begin with the end in mind”

• Benign:
– Inventory
– Auditing
– Security Policy
• Malicious:
– Intruders
– Worms or trojans
– Misconfigured devices

INT-3 Network Scanning 11

 Definitions
• Scanning
– The active process of analyzing your
networked systems to detect vulnerabilities
in order to fix them and improve security.
• Sniffing
– The passive process of analyzing network
packets and detect anomalies and
intruders.

INT-3 Network Scanning 12

 Scanning Types

• Network Scan [fast]

– Identify connected or wireless systems for your IP
address ranges
• Port Scan (0-65535)
– Identify which ports look open and available
• Service Scan
– Connect to these ports and identify service
version/banner
• Vulnerability Scan [slow]
– Target specific services with specific codes to
analyze reaction and see if vulnerable

INT-3 Network Scanning 13

 Scanning Methodologies
“Rules of Engagement”

• Regular Scheduled Scans

– Policy Requirement
– Institutional history is relevant
• Ad Hoc (“one time” scans)
– Incident Related
• Outsourced Scans
– Performed by 3rd party

INT-3 Network Scanning 14

 Scheduled Scanning
• Regular Scheduled Scans:
– Based on a known asset list
– Based on a specific policy or “rules”
– Store scan results in a Database [history]
– Analyze results (Vulnerability Report)
– Reports sent to management & sys admins
– Follow up to verify fixes
• Outsourced Scans [Qualys.com]
– Auditor requested
– No security staff

INT-3 Network Scanning 15

 One time Scans

• Ad Hoc based on exceptions

– Incident related
– Verification
• Tools:
– Superscan (W)
– MS Security Base Analyzer (W)
– Nmap (U/W)
– LanGuard (W)

U=Unix W=Windows
INT-3 Network Scanning 16
Superscan 4

INT-3 Network Scanning 17

SuperScan: Tools

INT-3 Network Scanning 18

SuperScan: Windows Enumeration

INT-3 Network Scanning 19

 Microsoft® Baseline Security Analyzer

• Checks for
Security updates
on local or remote
systems
• Windows checks
• IIS checks
• SQL checks
• Desktop application checks
INT-3 Network Scanning 20
 nmap
• The King of scanners
– Free open source utility for network
exploration or security auditing. (U/W)
– Used by Nessus & ISS Internet Scanner
– Flexible, Easy, Powerful, Portable
• Identifies Operating Systems, grabs banners
• UDP, TCP SYN & Connect scans
• Stealth FIN, Xmas Tree, or Null scans
• IP spoofing, Idlescan (blind TCP port scan)

INT-3 Network Scanning 21

 nmap example
nmap ­A ­T4 ­F www.insecure.org
Starting nmap 3.40PVT16 ( http://www.insecure.org/nmap/ ) at 2003­09­06 19:49 PDT
Interesting ports on www.insecure.org (205.217.153.53):
(The 1206 ports scanned but not shown below are in state: filtered)
PORT    STATE  SERVICE VERSION
22/tcp  open   ssh     OpenSSH 3.1p1 (protocol 1.99)
25/tcp  open   smtp    Qmail smtpd
53/tcp  open   domain  ISC Bind 9.2.1
80/tcp  open   http    Apache httpd 2.0.39 ((Unix) mod_perl/1.99_07­dev Perl/v5.6.1)
113/tcp closed auth
Device type: general purpose
Running: Linux 2.4.X|2.5.X
OS details: Linux Kernel 2.4.0 ­ 2.5.20
Uptime 108.307 days (since Wed May 21 12:27:44 2003)

Nmap run completed ­­ 1 IP address (1 host up) scanned in 34.962 seconds
INT-3 Network Scanning 22
 nmap

Featured in the Matrix Reloaded!

INT-3 Network Scanning 23

LanGuard: one time scan

INT-3 Network Scanning 24

LanGuard: Verification

INT-3 Network Scanning 25

Enterprise Scanner Architecture

SCANNER
SERVER

CLIENT
CONSOLE
DB
LAN
Reports
INT-3 Network Scanning
DEVICES 26
Enterprise Scan Results/Reports
• Historical Trends
• Asset List
• Vulnerability Assessment
– CVE / CAN relation is strongly
recommended (for Criticality)
• Tools:
– ISS Site Protector
– Nessus/ Tenable

INT-3 Network Scanning 27

ISS Site Protector - login

INT-3 Network Scanning 28

ISS Target Selection

INT-3 Network Scanning 29

ISS Policy Selection 1/2

INT-3 Network Scanning 30

ISS Policy Selection 2/2

INT-3 Network Scanning 31

ISS Schedule

INT-3 Network Scanning 32

ISS Results

INT-3 Network Scanning 33

 Nessus Login

INT-3 Network Scanning 34

 Nessus
Policy
1/2
(Plugins)

INT-3 Network Scanning 35

 Nessus
Policy
2/2
(Prefs.)

INT-3 Network Scanning 36

 Nessus
Targets

INT-3 Network Scanning 37

 Nessus
Scan

INT-3 Network Scanning 38

 Nessus
Results

INT-3 Network Scanning 39

Nessus: Windows Client & results

INT-3 Network Scanning 40

INT-3 Network Scanning 41
Tenable: Enterprise

INT-3 Network Scanning 42

 Tool Reference 1/2
• http://www.insecure.org NMAP (U/W)
• http://www.foundstone.com Superscan

• http://nessus.org (U/W)
• http://www.gfi.com (W) LanGuard

• http://www.microsoft.com/mbsa
MBSASetup-EN.msi
U=Unix W=Windows
INT-3 Network Scanning 43
 Tool Reference 2/2
• http://www.tenablesecurity.com
Nessus+ (U/W)
• http://www.iss.net Site Protector,
Internet Scanner (W)

• http://www.sans.org/top20/ Reference
• http://knoppix.com
Knoppix: bootable CD with a collection of
GNU/Linux software (U), including
nmap & nessus.

U=Unix W=Windows
INT-3 Network Scanning 44