Networking Chapter 6 This Vulnerability Has Been Around For More Than Decade And Still Present

Hands-On Ethical Hacking and Network Defense, Third Edition 6-1

Chapter 06

Enumeration

At a Glance

Instructor’s Manual Table of Contents

• Overview

• Objectives

• Teaching Tips

• Quick Quizzes

Hands-On Ethical Hacking and Network Defense, Third Edition 6-2

Lecture Notes

Overview

This chapter describes the process of enumeration. Enumeration involves connecting to a

system and obtaining information about users, passwords, and shared resources. Students will

learn what tools can be used to enumerate Windows systems. Finally, this chapter presents

tools to enumerate *nix OS targets.

Chapter Objectives

After reading this chapter and completing the exercises, the student will be able to:

• Describe the enumeration step of security testing

• Enumerate Windows OS targets

• Enumerate *nix OS targets

Teaching Tips

Introduction to Enumeration

1. Explain that enumeration is the next step after port scanning. It involves connecting to a

system, not just identifying that a system is present on the network. Enumeration

2. Describe the process of enumeration. You start by port scanning and footprinting a

3. Several enumeration tools are available for any OS. Usually security testers are

6-1 gives an example of how to install and use NBTscan on a Linux machine.

Hands-On Ethical Hacking and Network Defense, Third Edition 6-3

Teaching

Tip

Almost all Linux distributions have a GUI tool that allows users to install

applications graphically.

Enumerating Windows Operating Systems

1. When enumerating an OS, it is important to know its history because attacks for older

NetBIOS Basics

1. Describe the Network Basic Input Output System (NetBIOS), a Windows programming

2. Explain NetBIOS names. When you assign a name to a Windows system, you are

assigning it a NetBIOS name. NetBIOS names consist of 16 characters, where the last

character is reserved for a hexadecimal number (00 to FF) that identifies the type of

service running on that computer. NetBIOS names must be unique on a network. Use

Table 6-2 to describe the NetBIOS names and suffixes associated with the last character

of a NetBIOS name.

Security

Tip

Read http://www.microsoft.com/technet/security/bulletin/MS03-034.mspx for an

example of a NetBIOS vulnerability.

NetBIOS Null Sessions

1. Explain that one of the biggest vulnerabilities of NetBIOS systems is a null session,

which is an unauthenticated connection to a Windows computer that uses no logon and

NetBIOS Enumeration Tools

1. Describe the Nbtstat command. Nbtstat command is a powerful enumeration tool

2. Explain the Net view command that is also included with Windows. The Net view

3. Activity 6-2 describes the use of these enumeration tools and also introduces the Net

use command, which allows a user to connect to a computer with shared folders or files.

Additional Enumeration Tools

1. This section covers additional enumeration tools such as DumpSec, Hyena, Nessus, and

OpenVAS (Greenbone Security Assistant).

DumpSec

1. Introduce DumpSec, another powerful enumeration tool for Windows systems.

DumpSec is produced by Foundstone, Inc. and allows you to connect to a server and

download (or “dump”) information such as:

a. Permissions for shares

b. Permissions for printers

Hyena

1. Describe Hyena, an excellent GUI product for managing and securing Windows OSs.

With this tool you can easily see shares and logon names for Windows servers and

domain controllers. In addition, Hyena display a graphical representation of the

following areas:

a. Microsoft Terminal Services

Nessus and OpenVAS (aka Greenbone Security Assistant)

1. Describe OpenVAS. OpenVAS is an open-source descendent of Nessus. It is a popular

tool for identifying vulnerabilities.

2. Explain that the latest version of Nessus Server and Client can run on Windows, Mac

Hands-On Ethical Hacking and Network Defense, Third Edition 6-5

Teaching

Tip

Visit http://www.nessus.org, the official Nessus Web site.

Quick Quiz 1

1. True or False: Enumeration involves connecting to a system, not just identifying that a

system is present on a network.

2. To determine what resources or shares are on a network, security testers must first

determine what OS is being used via port scanning and what other method?

A. ping sweeping

B. application scanning

C. footprinting

D. scripting

3. Which of the following is a Windows programming interface that allows computers to

communicate across a local area network (LAN)?

A. NetBIOS

B. OpenVAS

C. Netware

D. Null Session

4. True or False: The Nbtstat command is a powerful enumeration tool not included with

Windows.

5. What built-in Windows tool gives you a quick way to see whether there are any shared

resources on a computer or server?

Enumerating the *nix Operating System

1. This section covers enumeration tools for UNIX systems. Discuss a few of the more

Hands-On Ethical Hacking and Network Defense, Third Edition 6-6

*NIX Enumeration

1. Discuss the Simple Network Management Protocol (SNMP) network management

3. Mention that Nessus is another important *nix enumeration tool. Illustrate its ability to

assess vulnerabilities using Figure 6-15.

4. Introduce the Finger utility as a useful enumeration tool for security testers and hackers

to find out who’s logged in to a *nix system. Mention that the Finger daemon (fingerd)

listens on TCP port 79.

Security

Tip

Check http://www.computerhope.com/unix/ufinger.htm for more information

about the Finger command.

Quick Quiz 2

1. True or False: Only AT&T can use the name UNIX.

2. True or False: Solaris was developed by Red Hat Enterprise.

3. Linux is a variation of UNIX originally designed for inexpensive Intel PCs. Who

created the Linux OS?

4. Which of the following is useful for administrators who want to see system statistics,

version numbers, and other detailed host information remotely?

A. Finger

B. SNMP

C. Nessus

D. NMap

5. What older utility enables you to find out who’s logged in to a *nix system?

Hands-On Ethical Hacking and Network Defense, Third Edition 6-7

Class Discussion Topics

1. With respect to security, what operating system do your students prefer? Why?

2. Many network administrators are aware of security problems, but fail to properly

Additional Projects

1. Divide your class into two groups: A and B. Group A should fresh install any Windows

2. Ask your students to visit the Red Hat Enterprise Linux site and investigate the major

Additional Resources

1. Nessus Client:

2. NetBIOS Enumeration Tools:

3. Top 100 Network Security Tools:

4. An Overview of NetBIOS:

5. Oscanner: An Oracle Enumeration tool:

Key Terms

See Glossary for definitions of Key Terms.

➢ enum4linux

➢ enumeration

Hands-On Ethical Hacking and Network Defense, Third Edition 6-8

➢ Network Basic Input/Output System (NetBIOS)

Technical Notes for Activities

Activity 6-1: This activity requires a classroom Linux CD, a computer running Windows,

and an Internet connection.

Activity 6-2: This activity requires a computer running Windows and a network connection.