Script for finding servers of a particular kind. IIS Apache or Otherwise.

For this script you need to have nmap installed. In the example script I made I am search for IIS servers but you can use it to search for any kind, just search for them in the format that nmap saves them as. So apache servers would change the variable to this:
my $webserver_type = qr!(Apache)!;

So this script saves all open servers to one file, all servers of a particular type to another file, and it saves all results to a file. You can cahnge where those files are by editing these variables:
my $hunt = "/root/serverhunt";
my $found = "/root/found";
my $open_file = "/root/open";

**Oh and it just appends to the file, so you can run it and it will never overwrite your progress, just add to it.**


This does scans randomly in increments of 100, you can change how many times you want it to loop by changing this variable:
my $howmanyloops = "1";
So if you wanted to do it twice you would put:
my $howmanyloops = "2";

Ok so before you get going with this you probably need to be aware of the legality of port scanning. Port scanning may attract unwanted attention. Talk to a lawyer before port scanning. I'm not liable for you using this script. Etc Etc....

use strict;
use warnings;

my $webserver_type = qr!(IIS)!;
my $open = qr!(open)!;
my $howmanyloops = "1";

my $hunt = "/root/serverhunt";
my $found = "/root/found";
my $open_file = "/root/open";

my $nmap_scan;
my @hunt_file;
my $line;
my $iter = 0;

while($iter < $howmanyloops){
 $nmap_scan = `nmap -sV -iR 100 -P0 -p 80 -oG $hunt`;
 open HUNT, $hunt;
 @hunt_file = ;
 close(HUNT);
 open FOUND, ">>", $found;
 open OPENFILE, ">>", $open_file;
 foreach(@hunt_file){
  $line = $_;
  if($line =~ $webserver_type){
   print FOUND $line; 
  }
  if($line =~ $open){
   print OPENFILE $line; 
  }
 }
 ++$iter;
}
close(FOUND);

Awful Linux Podcast

Download: Mp3
I might actually decide to name the podcast awful linux podcast.....hmmmm

Lesson Plan:

Going over the very basics of linux. And since this will be distrubuted in beggening hacking type places, I am going to focus on honing your linux skills with the use of nmap.

Everything is a file.


cd
cd ..
cd /root
cd root
ls
cat
less
nmap - You will have to install

grep
grep options pattern file
grep 'bullshit' filename
cat filename | grep 'bullshit'


Basic Install processes

Package Managment
CentOS, Redhat, Fedora Core,(SuSe I think), etc
yum install packageName

Debian, Ubuntu, etc
apt-get install packageName

FreeBSD
cd /usr/ports/category
make && make install && make install clean
or
make
make install
make install clean

TarBalls
All Systems

gunzip tar.tar.gz
tar -xvvf tar.tar
./configure
make
make install

processes
ps aux
kill
killall firefox-bin

Text editors
vi
emacs
Don't pussy out, man up

Thoughts about hacking consumer grade wireless "routers".

People call those little things you connect to your cable or dsl modem wireless routers, but that's not really what they are. So what are they? They are part switch, part WAP(wireless access point), and part router. So you have four switch ports, and those are on one side of the routing and one port is for the internet which is on the other side of the routing. The WAP(Wireless access point) part is on the same side of the routing as the 4 switch ports, so all of that is behind the "router" which is doing Network Address Translation or NAT, which is actually what is protecting you. Well really we call it NAT but it's not really NAT, it's actually PAT or Port address translation. So your hiding behind a single IP and only if your computer makes connections to the outside can connections from the outside come in.

Your Network +++++++++++++++++++++++++++++++++++Intarweb



**Yes the router has two IP's, that's how routing works silly**
**And x.x.x.x is an IP assigned by your ISP**

I was asked how to get through, NAT which is to say PAT, which is a layer of security the router inherently gives it's users.

How do we break it so that connections from the outside can get in without having the internal network make the first move?

So the first thing isn't a hack, it's a feature of these "routers". It's called port forwarding and what it does, is it takes a port on a single computer on the internal network and puts that port directly on the internet. For example you start a home business running a website to sell candid shots of your girlfriend to the internet at large, or maybe you just want to have the candid shots and reap the benifits of having ads on the page selling the for 5 cents a click, well thats besides the point I don't care how your exploiting your girlfriend it's just important it gets done. Anyways so you have your site hosted on your home computer, you will have to forward that port to your computer with the webserver running on it. If you forward that port on your router to your computer, then that port on the home pc is exposed to the world and all can get to it. If anything is port forwarded on your router, and that software is vulnerable to an exploit, like the webserver you are using, evil hackers can break that software and get into your computer, or lets say you had 3389(RDP) port forwarded on your windows machine so that you could remote into it from the road, you know to add more pics of your girl, or other girls who you had told you worked for Girls gone wild and were wondering if they would like to audition for a paying part in the new magazine you aren't heading up. Well they could use TSGRIND or something else to brute force passwords.

So the evil hacker found your router and doesn't want to pay for your girl friends pics. The first thing he is going to do is a port scan probably with nmap and probably something like this:

nmap x.x.x.x -P0


**Being that x.x.x.x is your routers external IP**

**-P0 is saying don't send ping to check if the box is alive this is because most consumer grade wireless "routers" don't care about ICMP, becuase well I don't know it's really stupid, there used to be called this thing called ping of death, that could knock machines down, but all modern oses and these consumer grade devices are patched against this so I have no idea why they do this, if you ask me it's stupid becuase ICMP is a helpful troubleshooting tool. And proof that smart people still use it, ping google, you will typically get 3 out of four of your ICMP packets back, why don't you get one back, hell if I know I have some thoughts but I don't work for google and this post isn't about that. Also that is an capital p and a zero not a capital o.**

Ok so this nmap may return with some open ports, for the most part if the ports are described as open, they are probably forwarded. So that gives you, errr the evil hacker his current points of interest. Then if there was software behind those ports he would try to break it. Ok moving on...

How can I get in if all ports are blocked. Well if the router software itself is vulnerable I can use an exploit to break into it, and then use it to port forward inside of your network, or use it as a launching point for my nefarious deeds. How does the evil hacker do this....beyond the scope of this post.

Next issue, if you download any malware it can run on your local machine and then make connections to other machines on the intarweb that can then control or alter your machine. NAT obviously can't protect you from your stupidity. Don't download garbage or your fucked.

So the evil hacker knows where you live. Oh I know scary....well you shouldn't have filled out the domain information for your girl friends bestiality porn website accurately hackers use that stuff to figure shit like that out. So he drives to your house and he sits out side, well stupidly you left your wireless signal unencrypted, or you only used WEP...or smartly you used WPA, however your passphrase was a dictionary word....retard.

So he cracked your shit. Well why do you care. Because a very stupid company named Microsoft, in partnership with HP, made a protocol called SSDP. Why is SSDP stupid? Wiki says:

Quote:SSDP provides a mechanism which network clients can use to discover network services. Clients can use SSDP with little or no static configuration.

Wtf m8? Devices and software on your network CAN MAKE CHANGES TO YOUR FUCKING ROUTER. Meaning anyone who knows how to use ssdp can make a program that if launched on the inside of your network, whether from your machine or a malicious machine that is on your wireless network, can configure your router to portforward to whatever it chooses.

Thanks M$ we really love you.

Ok now that that's over, how do you guys like this style of post?

nmap lesson 2 (begginer)

Ok so you know how to nmap:
nmap 192.168.1.1
and you know how to nmap –P0 –O
nmap 192.168.1.1 –P0 –O
So now you want to know more. Ok so let’s find out your IP address. If you are in windows do an ipconfig if you are in *nix do a ifconfig. Ok so typically your behind a wireless router or something if you have cable or dsl. Or if your range is in between any of these:
10.0.0.0 to 10.255.255.255
172.16.0.0 to 172.31.255.255
192.168.0.0 to 192.168.255.255
That means you have a private IP address and that your router navigates the internet for you using NAT(PAT technically). So you need to find your publicly routable address. To find this goto ipchicken.com and it will tell you your external IP. So let’s say your IP is 68.52.155.53. Ok take this address and run it through arin.net or ripe.net if you are in Europe or afrinic if you are in Africa, etc..
Ok so my address gives me two, possible selections for Comcast:
Comcast Cable Communications, Inc. JUMPSTART-1 (NET-68-32-0-0-1)
68.32.0.0 - 68.63.255.255
Comcast Cable Communications, Inc. NASHVILLE-3 (NET-68-52-128-0-1)
68.52.128.0 - 68.52.159.255

I am going to choose the Nashville one because that is where I am at and it is a smaller range.
So I want to narrow my range down as much as possible so I have less results to look at. So I want to scan IP’s that are near mine, because most likely those are other Comcast customers and potentially even my neighbors. So I want to scan the range 68.52.155.x . x is going to stand for 0 through 255 and I also want to output this to a text file so that I can review it later, because it is going to take a long time. So here is my command:
nmap 68.52.155.0/24 –P0 –O –oN bob.txt
This well output everything to bob.txt in the current directory.
Next Lesson, interpreting ports.

nmap step 1(begginer)

Your first nmap lesson.
Nmap is a port scanner, you can use it to find open ports. Once you find the open ports you can discover whether or not they are exploitable. Nmap can also be helpful in network troubleshooting or determining what os is behind what ip. But this tutorial just explains the basic scanning portion. You will need to download nmap. Nmap is at:
http://nmap.org/download.html
When you install it, it will come with WinPCAP which updates your TCP/IP stack. It will install this as part of the install. The version of NMAP you choose may come with a GUI, don’t use it. Use the cli.

Ok so after you get through installing nmap open the cmd. So start cmd, by hitting start, then run, then typing cmd. In vista you only need to hit start then type cmd. Now to aim nmap at your target you type:
nmap targetiporname
That will work for most targets, example:
nmap google.com
However that doesn’t work for all targets, some targets have ICMP(ping) turned off, and nmap pings a target to make sure it is up before scanning. So you may want to turn that feature off. So type:
nmap targetiporname –P0
Ok so that is a capital P and a zero. Usually I want to to know the OS my target is using as well so I do a
nmap targetiporname –P0 –O
And that is a capital O, so you should be able to scan your target now. I will right step 2 very soon, if you have any troubles with step 1 just get in contact with me.