More social engineering fun (post-Thursday)

All right, team! I don't know what you've done yet in response to Tuesday's challenges, but here's something I want you to try.

Get someone you don't know to ASK, face to face (Karl..), for your phone number, email address, etc. Don't just give it to them outright, make them ask for it. You can make them work really hard for it if you want to, or you can give them a really lovely primrose path, (i.e. "We should stay in touch! ")

Everybody has to try. Who's going to be the first one to conquer this one? Comment!

Social Engineering tactics homework

1.

Eight ball in MY preferred corner pocket...too easy! Sat in the computer lab area outside our class, I was in between two empty seats, girl walks up and tried to sit to my right. I told her there was a virus on that PC, so she sat to my left.

2.

Construction going on around my building, I walked through my alleyway and noticed a construction truck with the driver parked on a private parking spot. I told him that I owned the spot (which I don't) and kindly requested him to move. He agreed and did so.

Hypnosis and Social Engineering

An interesting post I found just now on The Ethical Hacker Network (great website overall) about how hypnosis doesn't work as well for social engineering as one might be led to think.

http://www.ethicalhacker.net/content/view/366/24/

Eight Ball in the Corner Pocket

Right so done with that one :)

Project 8 - Decoy Scan

Decoy Scan Using nmap

Exercise 1: in this exercise, you’ll use nmap to perform a decoy scan, which mixes
your IP address with bogus IP addresses (using the -D option):

1. From a BackTrack shell, type the following (only type what's in bold, on one line):
user1@pentest:~#nmap -n -D192.168.1.5,10.5.1.2,me,172.1.2.4 target_IP_address > /root/ceh/decoy_scan

Syntax breakdown:
nmap: program name
-n: program option to never resolve DNS names
-D192.168.1.5,10.5.1.2,me,172.1.2.4: program option to cloak your scan with the supplied bogus and real IP addresses target_IP_address: the IP address of the target system
> /root/ceh/decoy_scan: redirect the output to a file called decoy_scan in the /root/ceh directory

2. Examine your results:
user1@pentest:~#cat /root/ceh/decoy_scan | less


3.  Email your results to proflheureux@gmail.com.

Project 7 - Port Scanning Using TCP

TCP SYN Scan Using nmap

Let's build on this common port scan so that your actions are stealthier.


In the next example, you will add two additional options: the -g and the –p options:
The -g option specifies the source port on the scanning machine (your system).
The most common option to use here is port 80 (because it's allowed through most
border network devices). The -p option sets the ports on the target system to scan.


Exercise 1: TCP SYN scan:


1. Using the -sS flag option, you will send the target system a SYN packet, but upon receiving the SYN/ACK from the target system, your system will not respond with an ACK packet (thus, completing the 3-way handshake). Instead, your system will respond with a RST packet (the port is then considered open). If you receive an RST/ACK packet from the target system, it indicates that there is not a running process on that port, or the process running on the port is not listening for connections.

2. The syntax to perform a TCP SYN scan is (only type what's in bold, on one line):
user1@pentest:~#nmap -sS -vv -g 80 -p 80,88,135,139,389,445 target_IP_address > /root/ceh/syn_scan

Syntax breakdown:
nmap: program name
-sS: program option for TCP SYN scan
-vv: program option for double verbose output
-g 80: program option that specifies the source port on the scanning machine
(your system)
-p 80,88,135,139,389,445: specifies the ports on the target system to scan
target_IP_address: the IP address of the target system
> /root/ceh/syn_scan: redirect the output to a file called syn_scan in the /root/ceh directory


3. Examine your results:
user1@pentest:~#cat /root/ceh/syn_scan | less

4. Record your results:  PORT STATE SERVICE


5. Repeat steps #2-3 using a different target IP address and different destination port numbers


6.  Email your results to proflheureux@gmail.com.

Project 6 - Port Scanning Using UDP

UDP Scan Using nmap

In this lab, you will use the nmap -sU option to perform a UDP scan.


With this scan type, nmap sends 0-byte UDP packets to each port on the target system. Receipt of an ICMPv4 Destination Unreachable/Port Unreachable (Type 3, Code 3) message signifies the port is closed; otherwise it is assumed open.


One major problem with this technique is that when a firewall blocks outgoing ICMPv4 Type 3, Code 3 messages, the port will appear open. These false-positives are hard to distinguish from real open ports.


Another disadvantage with UDP scanning is the speed at which it can be performed. Most OSes limit the number of ICMPv4 Type 3, Code 3 messages which can be generated in a certain time period, thus slowing the speed of a UDP scan. nmap adjusts its scan speed accordingly to avoid flooding a network with useless packets.


NOTE: Microsoft OSes do not limit the ICMPv4 Type 3, Code 3 error generation frequency, thus, making it is easier to scan a Windows machine's 65,535 UDP ports in very little time.

Exercise 1:

1. From a BackTrack shell, type the following (only type what's in bold):
user1@pentest:~# nmap -sU -v target_IP_address > /root/ceh/udpscan
Syntax breakdown:
nmap: program name
-sU: program option for UDP scan
-v: verbose mode
target_IP_address: the IP address of the target system
> /root/ceh/udpscan: redirect the output to a file called udpscan in the /root/ceh directory


2. Examine your results:
user1@pentest:~#cat /root/ceh/udpscan | less


3. Repeat steps #1-2 using different target IP addresses. Compare your results.


4.  Email your results to proflheureux@gmail.com.