Port scanning is obviously the most common approach for determining what service daemons exist on a host, but it isn't the only way. An IDS that detects portscans might be a helpful tool to give an admin a headsup in SOME scenarios, but depending on a hacker to portscan is like picking low-hanging fruit.
As researchers, we should be aware of all possible avenues for an attacker to accomplish a goal.
So how else might an attacker enumerate which service ports are available on a remote server?
If SNMP is available and the community strings are default/guessable, often this can provide an interface for listing listening ports. This is interesting because we can often retrieve the entire TCP connection table (including all established connections/listening ports) using only SNMP. This could allow an attacker to glean even MORE information than a portscan would if there was a firewall in place.
Another way would be through a zone transfer. Often times DNS names clearly indicate a service. If zone transfers aren't disallowed to the attacker, this could be a useful feature:
S:\>nslookup
Default Server: ns
Address: 10.81.1.12
> set type=ns
> learnsecurityonline.com
Server: ns
Address: 10.81.1.12
Non-authoritative answer:
learnsecurityonline.com nameserver = ns10.dynamichosting.biz
learnsecurityonline.com nameserver = ns11.dynamichosting.biz
ns10.dynamichosting.biz internet address = 216.83.6.33
ns11.dynamichosting.biz internet address = 216.83.31.25
> server ns10.dynamichosting.biz
Default Server: ns10.dynamichosting.biz
Address: 216.83.6.33
> set type=any
> ls -d learnsecurityonline.com
[ns10.dynamichosting.biz]
...
learnsecurityonline.com. A 216.83.24.173
ftp A 216.83.24.173
mail A 216.83.24.173
webmail A 216.83.24.173
www A 216.83.24.173
...
>
These are only a few. Can anyone else think of uncommon methods for accomplishing common hacker tasks? portscanning or otherwise?
Show Posts
Tutorials : Need guidance 
