Re: All tcp ports open?

From: sol seclists (ramatkal_at_hotmail.com)
Date: 08/30/04

  • Next message: Erik Birkholz: "Re: All tcp ports open?" 
    To: "Ben Timby" <asp@webexc.com>, <pen-test@securityfocus.com>
Date: Mon, 30 Aug 2004 23:00:47 +0200

    A script which does exactly what you desrcibe is mentioned in the book
    "hacking: the art of exploitation" by jon erickson only on a linux machine.

    the basic idea is something like:

    use tcpdump to monitor all incoming SYN packets not destined for any
    listening service and then use a packet generation tool (such as nemsis) to
    generate a packet with a seq#+1 and the SYN and ACK flags set.

    ----- Original Message -----
    From: "Ben Timby" <asp@webexc.com>
    To: <pen-test@securityfocus.com>
    Sent: Sunday, August 29, 2004 9:04 AM
    Subject: All tcp ports open?

    > I am not sure what is doing this, but I assume it is a software (or some
    > kind of) firewall/hids, can anybody point me in the right direction?
    >
    > I am pen-testing a Windows webserver, and a port scan reveals ALL tcp
    > ports open. hping also confirms that a SA is returned for any S packets
    > sent to any port I try. I can connect via netcat any of the ports, and
    > send data, but nothing is returned. In order to verify services, I am
    > required to connect and check for a banner or send appropriate protocol
    > commands to elicit a response.
    >
    > Has anyone seen this, or have any idea of what this is?
    >
    > Thanks.
    >
    > -------------------------------------------------------------------------- 

    ----
> Ethical Hacking at the InfoSec Institute. All of our class sizes are
> guaranteed to be 12 students or less to facilitate one-on-one interaction
> with one of our expert instructors. Check out our Advanced Hacking course,
> learn to write exploits and attack security infrastructure. Attend a
course
> taught by an expert instructor with years of in-the-field pen testing
> experience in our state of the art hacking lab. Master the skills of an
> Ethical Hacker to better assess the security of your organization.
>
> http://www.infosecinstitute.com/courses/ethical_hacking_training.html
> --------------------------------------------------------------------------
-----
>
>
------------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. All of our class sizes are
guaranteed to be 12 students or less to facilitate one-on-one interaction
with one of our expert instructors. Check out our Advanced Hacking course,
learn to write exploits and attack security infrastructure. Attend a course
taught by an expert instructor with years of in-the-field pen testing
experience in our state of the art hacking lab. Master the skills of an
Ethical Hacker to better assess the security of your organization.
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
-------------------------------------------------------------------------------
  • Next message: Erik Birkholz: "Re: All tcp ports open?"

    Relevant Pages

    • Re: All tcp ports open?
      ... This is not a safe assumption, many services do not respond with a banner. ... Subject: All tcp ports open? ... > Ethical Hacking at the InfoSec Institute. ... > learn to write exploits and attack security infrastructure. ...
      (Pen-Test)
    • RE: LDAP Pentest
      ... Subject: LDAP Pentest ... Ethical Hacking at the InfoSec Institute. ... learn to write exploits and attack security infrastructure. ... experience in our state of the art hacking lab. ...
      (Pen-Test)
    • RE: All tcp ports open?
      ... firewall respond with all open ports. ... all ports are reported closed but rsh is reported open. ... Check out our Advanced Hacking ... Check out our Advanced Hacking course, learn to write exploits and attack security infrastructure. ...
      (Pen-Test)
    • RE: All tcp ports open?
      ... Subject: All tcp ports open? ... >Hacking course, learn to write exploits and attack security ...
      (Pen-Test)
    • Re: All tcp ports open?
      ... All ports seem to be ... > Ethical Hacking at the InfoSec Institute. ... Check out our Advanced Hacking course, learn to write exploits and attack security infrastructure. ...
      (Pen-Test)