Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 41 guests and 1 member online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Network Pen Testingarrow Pentesting. What to do after port scan?
EH-Net
May 25, 2013, 07:13:44 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1] 2   Go Down
  Print  
Author Topic: Pentesting. What to do after port scan?  (Read 16880 times)
0 Members and 1 Guest are viewing this topic.
Dissident85
Newbie
*
Offline Offline

Posts: 16



View Profile
« on: May 05, 2008, 06:37:42 PM »

Hi all, I am attempting to do some pen testing for the first time. Ok so I have scaned the servers I want to test using nmap, and I now have a list of open ports and the service and version for each port. I know that I need to find an appropriate exploit. But that is where I am stuck. How do I know what one to use? I have been looking through metasploit but there are just so many.

Below are the resaults of my port scan I performed. Any advice???

Quote
windows server 2k
PORT      STATE SERVICE            VERSION
7/tcp     open  echo
9/tcp     open  discard?
13/tcp    open  daytime            Microsoft Windows USA daytime
17/tcp    open  qotd               Windows qotd
19/tcp    open  chargen
21/tcp    open  tcpwrapped
25/tcp    open  smtp               Microsoft ESMTP 5.0.2195.6713
|  SMTP: Responded to EHLO command
|  ****** Hello [10.0.0.6]
|  AUTH GSSAPI NTLM LOGIN
|  AUTH=LOGIN
|  TURN
|  ATRN
|  SIZE 2097152
|  ETRN
|  PIPELINING
|  DSN
|  ENHANCEDSTATUSCODES
|  8bitmime
|  BINARYMIME
|  CHUNKING
|  VRFY
|  Responded to HELP command
|  This server supports the following commands:
|_ HELO EHLO STARTTLS RCPT DATA RSET MAIL QUIT HELP AUTH TURN ATRN ETRN BDAT VRFY
53/tcp    open  domain             Microsoft DNS
80/tcp    open  http               Microsoft IIS webserver 5.0
|_ HTML title:
135/tcp   open  msrpc              Microsoft Windows RPC
139/tcp   open  netbios-ssn
443/tcp   open  ssl                Microsoft IIS SSL
|  SSLv2: server still supports SSLv2
|     SSL2_RC4_128_WITH_MD5
|     SSL2_DES_192_EDE3_CBC_WITH_MD5
|     SSL2_RC2_CBC_128_CBC_WITH_MD5
|     SSL2_DES_64_CBC_WITH_MD5
|     SSL2_RC4_128_EXPORT40_WITH_MD5
|_    SSL2_RC2_CBC_128_CBC_WITH_MD5
445/tcp   open  microsoft-ds       Microsoft Windows 2000 microsoft-ds
1025/tcp  open  msrpc              Microsoft Windows RPC
1026/tcp  open  msrpc              Microsoft Windows RPC
1029/tcp  open  msrpc              Microsoft Windows RPC
3389/tcp  open  microsoft-rdp      Microsoft Terminal Service
6101/tcp  open  VeritasBackupExec?
6106/tcp  open  msrpc              Microsoft Windows RPC
10000/tcp open  backupexec         Veritas Backup Exec 9.0


Windows server 2003

PORT     STATE  SERVICE       VERSION
21/tcp   open   ftp?
25/tcp   open   smtp          Microsoft ESMTP 6.0.3790.3959
|  SMTP: Responded to EHLO command
|  **.*********.local Hello [10.0.0.15]
|  TURN
|  SIZE
|  ETRN
|  PIPELINING
|  DSN
|  ENHANCEDSTATUSCODES
|  8bitmime
|  BINARYMIME
|  CHUNKING
|  VRFY
|  X-EXPS GSSAPI NTLM LOGIN
|  X-EXPS=LOGIN
|  AUTH GSSAPI NTLM LOGIN
|  AUTH=LOGIN
|  X-LINK2STATE
|  XEXCH50
|  Responded to HELP command
|  This server supports the following commands:
|_ HELO EHLO STARTTLS RCPT DATA RSET MAIL QUIT HELP AUTH TURN ETRN BDAT VRFY
80/tcp   open   http          Microsoft IIS webserver 6.0
|_ HTML title: Site doesn't have a title.
443/tcp  closed https
1723/tcp open   pptp          Microsoft (Firmware: 3790)
3389/tcp open   microsoft-rdp Microsoft Terminal Service
Logged
BillV
Hero Member
*****
Offline Offline

Posts: 1892


View Profile WWW
« Reply #1 on: May 06, 2008, 07:36:49 AM »

Hi all, I am attempting to do some pen testing for the first time.

Care to elaborate? What are you testing? Your own system(s)?
Logged
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 4169


Editor-In-Chief


View Profile WWW
« Reply #2 on: May 06, 2008, 10:32:46 AM »

A pretty standard thing to do after a port scan is a vulnerability scan. Try Nessus. You may want to look up some pen testing or ethical hacking methodologies before continuing. Search this forum for "methodology" to get a good start.

I would second BillV's questions and add another. Are these production servers? Even if you have full permission to test production servers, I would never touch them on my first ever attempt at a pen test. Try this out in a lab first. Try to mimic the OS, patch level and running services, etc. Then go through the methodology in your lab.

Hope this helps,
Don
Logged

CISSP, MCSE, CSTA, Security+ SME
Kev
Sr. Member
****
Offline Offline

Posts: 428


View Profile
« Reply #3 on: May 06, 2008, 12:51:48 PM »

Wow what a nice scan. You cant get in with that?
Logged
Dissident85
Newbie
*
Offline Offline

Posts: 16



View Profile
« Reply #4 on: May 06, 2008, 08:50:55 PM »

Hi all, I am attempting to do some pen testing for the first time.

Care to elaborate? What are you testing? Your own system(s)?

I am testing 2 servers at my work. a mail server and a web server... they are the 2 servers that are exposed to the internet.
Logged
Dissident85
Newbie
*
Offline Offline

Posts: 16



View Profile
« Reply #5 on: May 06, 2008, 08:56:11 PM »

A pretty standard thing to do after a port scan is a vulnerability scan. Try Nessus. You may want to look up some pen testing or ethical hacking methodologies before continuing. Search this forum for "methodology" to get a good start.

I would second BillV's questions and add another. Are these production servers? Even if you have full permission to test production servers, I would never touch them on my first ever attempt at a pen test. Try this out in a lab first. Try to mimic the OS, patch level and running services, etc. Then go through the methodology in your lab.

Hope this helps,
Don
well i have full backups of the servers, perhaps i could take yesterdays backups and load them into vmware? then try to penetrate them?

as for a vonerability scan, i would use one of these tools http://backtrack.offensive-security.com/index.php/Tools#Vulnerability_Identification right?

Yes i have permision to perform these test. We are a small company and from what started as a job as a web developer has turned into web developer / IT Admin.
Logged
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 4169


Editor-In-Chief


View Profile WWW
« Reply #6 on: May 06, 2008, 08:57:16 PM »

Well, even if their intended purpose is different, they both are web servers, and one is even on IIS 5 which is bad news. Upgrading that would be my first recommendation.

Don
Logged

CISSP, MCSE, CSTA, Security+ SME
Dissident85
Newbie
*
Offline Offline

Posts: 16



View Profile
« Reply #7 on: May 06, 2008, 08:59:42 PM »

Wow what a nice scan. You cant get in with that?

Yes i was also quite surprised with the results of that scan. nmap really is a wonderful tool.

well what i have been doing is trying to find exploits. on sites like milw0rm and using metasploit. but haven't had any luck.

i guess as don said i need to do a venerability scan... im thinking prob cause i missed that stop could be why i am having so much trouble getting in.
Logged
LSOChris
Guest
« Reply #8 on: May 06, 2008, 09:31:11 PM »

i'd be taking a look at the veritas services, no one ever updates that stuff :-P
Logged
BillV
Hero Member
*****
Offline Offline

Posts: 1892


View Profile WWW
« Reply #9 on: May 06, 2008, 09:48:47 PM »

i'd be taking a look at the veritas services, no one ever updates that stuff :-P

Yeah, v9 is a good 3 versions behind
Logged
Dissident85
Newbie
*
Offline Offline

Posts: 16



View Profile
« Reply #10 on: May 06, 2008, 10:12:46 PM »

i'd be taking a look at the veritas services, no one ever updates that stuff :-P

veritas services???

Edit: Sorry, just looked into it, i know what you are talking about...

By the way, dose anyone know how to convert a ".v2i" to a ".vmdk" Huh?
« Last Edit: May 06, 2008, 10:21:53 PM by Loic » Logged
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 4169


Editor-In-Chief


View Profile WWW
« Reply #11 on: May 06, 2008, 10:19:02 PM »

Quote
10000/tcp open  backupexec         Veritas Backup Exec 9.0
Logged

CISSP, MCSE, CSTA, Security+ SME
Dissident85
Newbie
*
Offline Offline

Posts: 16



View Profile
« Reply #12 on: May 06, 2008, 10:30:41 PM »

ok, so i just did a search on securityfocus.com and miliw0rm.com and i couldn't any exploits for version, dose that mean that there are no public exploits for that version?
Logged
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 4169


Editor-In-Chief


View Profile WWW
« Reply #13 on: May 06, 2008, 10:42:50 PM »

You seem to be very stuck on getting an exploit. You're not even at that stage yet. Plus, there are plenty of other ways into a machine in addition to exploits.

Don
Logged

CISSP, MCSE, CSTA, Security+ SME
Kev
Sr. Member
****
Offline Offline

Posts: 428


View Profile
« Reply #14 on: May 07, 2008, 02:07:23 AM »

Very true Don.  Why is it that some people think the only way to "get in" is to exploit? Its sweet when you get one but I always take issue with those that think if we could only code better there would be no more stealing of data. The majority of my "hacks" have been using techniques that don't involve a software exploit. Please don't think just because your system is patched that you are 100% safe.
Logged
Pages: [1] 2   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.08 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.