Writing your own port scanner using netcat
While attackers utilize the proxying application and Tor network, it is also possible to write their own custom network port scanner. The following one-line command can be utilized during penetration testing to identify the list of open ports just by using netcat, as shown in Figure 3.19:
while read r; do nc -v -z $r 1-65535; done < iplist
Figure 3.19: Running a one-line Bash script to do port scanning
The same script can be modified for more targeted attacks on a single IP, as follows:
while read r; do nc -v -z target $r; done < ports
The chances of getting alerted in any intrusion detection system using custom port scanners are high compared to other port scanners.
Fingerprinting the operating system
Determining the OS of a remote system is conducted using two types of scans:
- Active fingerprinting: The attacker sends normal and malformed packets to the target and records its response pattern...
