Re: All tcp ports open?

From: Tim (tim-pentest_at_sentinelchicken.org)
Date: 08/29/04

  • Next message: Kevin Sheldrake: "Re: All tcp ports open?" 
    Date: Sun, 29 Aug 2004 13:42:45 -0400
To: Ben Timby <asp@webexc.com>

    > I am not sure what is doing this, but I assume it is a software (or some
    > kind of) firewall/hids, can anybody point me in the right direction?
    >
    > I am pen-testing a Windows webserver, and a port scan reveals ALL tcp
    > ports open. hping also confirms that a SA is returned for any S packets
    > sent to any port I try. I can connect via netcat any of the ports, and
    > send data, but nothing is returned. In order to verify services, I am
    > required to connect and check for a banner or send appropriate protocol
    > commands to elicit a response.
    >
    > Has anyone seen this, or have any idea of what this is?

    I have seen some load balancers behave this way, but it could also be a
    firewall responding with SYN/ACK on blocked ports to make it harder for
    an attacker to see what is open. (The book "Hacking: The Art of
    Exploitation" by Jon Erickson describes a strategy like this, though I
    am sure there are many other papers that do as well.) Are you scanning
    with a SYN scan, or a full connect()? When you connect to a port that
    you are pretty sure should be closed, does the host ACK your data that
    you send once the connection is established? If not, then it is
    probably just a sneaky FW configuration.

    Have you tried other scans (FIN, ACK, Xmas, etc)?

    tim

    ------------------------------------------------------------------------------
    Ethical Hacking at the InfoSec Institute. All of our class sizes are
    guaranteed to be 12 students or less to facilitate one-on-one interaction
    with one of our expert instructors. Check out our Advanced Hacking course,
    learn to write exploits and attack security infrastructure. Attend a course
    taught by an expert instructor with years of in-the-field pen testing
    experience in our state of the art hacking lab. Master the skills of an
    Ethical Hacker to better assess the security of your organization.

    http://www.infosecinstitute.com/courses/ethical_hacking_training.html
    -------------------------------------------------------------------------------

  • Next message: Kevin Sheldrake: "Re: All tcp ports open?"

    Relevant Pages

    • RE: Tool to find hidden web proxy server
      ... reporter that runs as a service and periodically reports on port usage. ... Ethical Hacking at the InfoSec Institute. ... with one of our expert instructors. ... learn to write exploits and attack security infrastructure. ...
      (Pen-Test)
    • Re: tcp port 999
      ... Have you tried a netstat -an on the machine that the ... I could set up anything to port 999 means nothing. ... Ethical Hacking at the InfoSec Institute. ... learn to write exploits and attack security infrastructure. ...
      (Pen-Test)
    • Re: Strange response from network
      ... My guess is that hop 7 is home of a firewall of some sort. ... Regarding the port number, my guess is that port 2443 is the 2nd SSL ... Ethical Hacking at the InfoSec Institute. ... learn to write exploits and attack security infrastructure. ...
      (Pen-Test)
    • RE: Tool to find hidden web proxy server
      ... a port scan of your hosts and look for suspicious or non-standard ports. ... Ethical Hacking at the InfoSec Institute. ... Check out our Advanced Hacking course, ... learn to write exploits and attack security infrastructure. ...
      (Pen-Test)
    • Re: Exploit Archive
      ... > *test only what's open, don't be a dreamer and try to audit a closed port, I ... systems configurations match the security policy of the site. ... why I lay alot more validity to configuration audits then I do to port ... Ethical Hacking at the InfoSec Institute. ...
      (Pen-Test)