NETCAT POWER TOOLS
CHAPTER 1 INTRODUCTION TO NETCAT INTRODUCTION INSTALLATION WINDOWS INSTALLATION LINUX INSTALLATION INSTALLING NETCAT AS A PACKAGE INSTALLING NETCAT FROM SOURCE CONFIRMING YOUR INSTALLATION NETCAT’S COMMAND OPTIONS MODES OF OPERATION COMMON COMMAND OPTIONS REDIRECTOR TOOLS BASIC OPERATIONS SIMPLE CHAT INTERFACE PORT SCANNING TRANSFERRING FILES BANNER GRABBING REDIRECTING PORTS AND TRAFFIC OTHER USES SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 NETCAT PENETRATION TESTING FEATURES PORT SCANNING AND SERVICE IDENTIFICATION USING NETCAT AS A PORT SCANNER SCRIPTING NETCAT TO IDENTIFY MULTIPLE WEB SERVER BANNERS SERVICE IDENTIFICATION EGRESS FIREWALL TESTING SYSTEM B - THE SYSTEM ON THE OUTSIDE OF THE FIREWALL SYSTEM A - THE SYSTEM ON THE INSIDE OF THE FIREWALL AVOIDING DETECTION ON A WINDOWS SYSTEM EVADING THE WINDOWS XP/WINDOWS 2003 SERVER FIREWALL CONTENTS EXAMPLE MAKING FIREWALL EXCEPTIONS USING NETSH COMMANDS DETERMINING THE STATE OF THE FIREWALL EVADING ANTIVIRUS DETECTION RECOMPILING NETCAT CREATING A NETCAT BACKDOOR ON A WINDOWS XP OR WINDOWS 2003 SERVER BACKDOOR CONNECTION METHODS INITIATING A DIRECT CONNECTION TO THE BACKDOOR BENEFIT OF THIS METHOD DRAWBACKS TO THIS METHOD INITIATING A CONNECTION FROM THE BACKDOOR BENEFITS OF THIS CONNECTION METHOD DRAWBACK TO THIS METHOD BACKDOOR EXECUTION METHODS EXECUTING THE BACKDOOR USING A REGISTRY ENTRY BENEFITS OF THIS METHOD EXECUTING THE BACKDOOR USING A WINDOWS SERVICE EXECUTING THE BACKDOOR USING WINDOWS TASK SCHEDULER BENEFIT TO THIS METHOD BACKDOOR EXECUTION SUMMARY CHAPTER 3 ENUMERATION AND SCANNING WITH NETCAT AND NMAP OBJECTIVES BEFORE YOU START WHY DO THIS? APPROACH SCANNING ENUMERATION NOTES AND DOCUMENTATION ACTIVE VERSUS PASSIVE MOVING ON CORE TECHNOLOGY HOW SCANNING WORKS GOING BEHIND THE SCENES WITH ENUMERATION RPC ENUMERATION FINGERPRINTING BEING LOUD, QUIET, AND ALL THAT LIES BETWEEN TIMING BANDWIDTH ISSUES UNUSUAL PACKET FORMATION OPEN SOURCE TOOLS NMAP NMAP: PING SWEEP NMAP: ICMP OPTIONS NMAP: OUTPUT OPTIONS NMAP: STEALTH SCANNING NMAP: OS FINGERPRINTING NMAP: SCRIPTING NMAP: SPEED OPTIONS NETENUM: PING SWEEP UNICORNSCAN: PORT SCAN AND FUZZING SCANRAND: PORT SCAN NMAP: BANNER GRABBING NETCAT P0F: PASSIVE OS FINGERPRINTING XPROBE2: OS FINGERPRINTING HTTPRINT IKE-SCAN: VPN ASSESSMENT AMAP: APPLICATION VERSION DETECTION WINDOWS ENUMERATION: SMBGETSERVERINFO/SMBDUMPUSERS/SMBCLIENT CHAPTER 4 BANNER GRABBING WITH NETCAT BENEFITS OF BANNER GRABBING BENEFITS FOR THE SERVER OWNER FINDING UNAUTHORIZED SERVERS BENEFITS FOR A NETWORK ATTACKER WHY NOT NMAP? BASIC BANNER GRABBING WEB SERVERS (HTTP) ACQUIRING JUST THE HEADER DEALING WITH OBFUSCATED BANNERS APACHE SERVERTOKENS READING THE SUBTLE CLUES IN AN OBFUSCATED HEADER HTTP 1 0 VS HTTP 1 1 SECURE HTTP SERVERS (HTTPS) FILE TRANSFER PROTOCOL (FTP) SERVERS IMMENSE FTP PAYLOADS E-MAIL SERVERS POST OFFICE PROTOCOL (POP) SERVERS SIMPLE MAIL TRANSPORT PROTOCOL (SMTP) SERVERS SO, BACK TO THE BANNER GRABBING FINGERPRINTING SMTP SERVER RESPONSES HOW TO MODIFY YOUR E-MAIL BANNERS SENDMAIL BANNERS MICROSOFT EXCHANGE SMTP BANNERS MICROSOFT EXCHANGE POP AND IMAP BANNERS SECURE SHELL (SSH) SERVERS HIDING THE SSH BANNER BANNER GRABBING WITH A PACKET SNIFFER CHAPTER 5 THE DARK SIDE OF NETCAT SNIFFING TRAFFIC WITHIN A SYSTEM SNIFFING TRAFFIC BY RELOCATING A SERVICE SNIFFING TRAFFIC WITHOUT RELOCATING A SERVICE ROGUE TUNNEL ATTACKS CONNECTING THROUGH A PIVOT SYSTEM USING SECURE SHELL USING REDIRECTION MAN-IN-THE-MIDDLE ATTACKS BACKDOORS AND SHELL SHOVELING BACKDOORS SHELL SHOVELING SHOVELING WITH NO DIRECT CONNECTION TO TARGET SHOVELING WITH DIRECT CONNECTION TO TARGET NETCAT ON WINDOWS CHAPTER 6 TRANSFERRING FILES USING NETCAT WHEN TO USE NETCAT TO TRANSFER FILES SOMETIMES LESS REALLY IS LESS SECURITY CONCERNS SOFTWARE INSTALLATION ON WINDOWS CLIENTS WHERE NETCAT SHINES SPEED OF DEPLOYMENT STEALTH SMALL FOOTPRINT SIMPLE OPERATION PERFORMING BASIC FILE TRANSFERS TRANSFERRING FILES WITH THE ORIGINAL NETCAT CLOSING NETCAT WHEN THE TRANSFER IS COMPLETED OTHER OPTIONS AND CONSIDERATIONS TIMING TRANSFERS, THROUGHPUT, ETC… TUNNELING A TRANSFER THROUGH AN INTERMEDIARY USING NETCAT VARIANTS CRYPTCAT GNU NETCAT SBD SOCAT SOCAT BASICS TRANSFERRING FILES WITH SOCAT ENCRYPTION MIXING AND MATCHING ENSURING FILE CONFIDENTIALITY USING OPENSSH INSTALLING AND CONFIGURING SECURE SHELL CONFIGURING OPENSSH PORT FORWARDING USING SSL CONFIGURING STUNNEL USING IPSEC CONFIGURING IPSEC ON WINDOWS CONFIGURING IPSEC ON LINUX ENSURING FILE INTEGRITY HASHING TOOLS USING NETCAT FOR TESTING TESTING BANDWIDTH TESTING CONNECTIVITY CHAPTER 7 TROUBLESHOOTING WITH NETCAT SCANNING A SYSTEM TESTING NETWORK LATENCY USING NETCAT AS A LISTENER ON OUR TARGET SYSTEM USING A PRE-EXISTING SERVICE ON OUR TARGET SYSTEM USING A UDP SERVICE USING A TCP SERVICE APPLICATION CONNECTIVITY TROUBLESHOOTING HTTP TROUBLESHOOTING FTP TROUBLESHOOTING ACTIVE FTP TRANSFERS USING NETCAT TROUBLESHOOTING PASSIVE FTP TRANSFERS USING NETCAT