Professional Penetration Testing, 2nd Edition

Chapter 7

Vulnerability Identification

Abstract

This chapter discusses the steps necessary to identify information about target systems, including information regarding operating system and version, and accessible applications. Once identified, we look at how to use this information to identify potentially exploitable vulnerabilities.

Keywords

Scanning

Banner grabbing

TCP scanning

UDP scanning

Enumeration

ICMP

Contents

Introduction

Port Scanning

Target Verification

Active Scans

Passive Scans

UDP Scanning

TCP Scanning

TCP Connect Scan (-sT)

TCP SYN Stealth Scan (-sS)

Perimeter Avoidance Scanning

Null Scan Attack (-sN)

ACK Scan (-sA)

FIN (-sF) and Xmas Tree (-sX) Scans

System Identification

Active OS Fingerprinting

Passive OS Fingerprinting ...