Rabu, 26 Juni 2013

NETWORK SCANNING
DAN PROBING


TUJUAN PEMBELAJARAN:
1. Mengenalkan pada mahasiswa tentang konsep Scanner dan Probing
2. Mahasiswa memahami konsep layanan jaringan dan port numbering
3. Mahasiswa mampu menganalisa kelemahan jaringan menggunakan software
scanning yang ada 
Type Scanning
 
connect scan (-sT)
Jenis scan ini konek ke port sasaran dan menyelesaikan three-way handshake (SYN,
SYN/ACK, dan ACK). Scan jenis ini mudah terdeteksi oleh sistem sasaran.
 
-sS (TCP SYN scan)
Paling populer dan merupakan scan default nmap. SYN scan juga sukar terdeteksi, karena
tidak menggunakan 3 way handshake secara lengkap, yang disebut sebagai teknik half
open scanning. SYN scan juga efektif karena dapat membedakan 3 state port, yaitu
open, filterd ataupun close. Teknik ini dikenal sebagai half-opening scanning karena uatu koneksi penuh TCP tidak sampai terbentuk. Sebaliknya, suatu paket SYN
dikirimkan ke port sasaran. Bila SYN/ACK diterima dari port sasaran, kita dapat
mengambil kesimpulan bahwa port itu berada dalam status LISTENING. Suatu
RST/ACT akan dikirim oleh mesin yang melakukan scanning sehingga koneksi penuh
tidak akan terbentuk. Teknik ini bersifat siluman dibandingkan TCP connect penuh, dan
tidak aka tercatat pada log sistem sasaran.
 
TCP FIN scan (-sF)
Teknik ini mengirim suatu paket FIN ke port sasaran. Berdasarkan RFC 793, sistem
sasaran akan mengirim balik suatu RST untuk setiap port yang tertutup. Teknik ini hanya
dapat dipakai pada stack TCP/IP berbasis UNIX.
 
TCP Xmas Tree scan (-sX)Teknik ini mengirimkan suatu paket FIN, URG, dan PUSH ke port sasaran. Berdasarkan
RFC 793, sistem sasaran akan mengembalikan suatu RST untuk semua port yang
tertutup.
 
TCP Null scan (-sN)
Teknik ini membuat off semua flag. Berdasarkan RFC 793, sistem sasaran akan
mengirim balik suatu RST untuk semua port yang tertutup.
 
TCP ACK scan (-sA)Teknik ini digunakan untuk memetakan set aturan firewall. Dapat membantu menentukan
apakah firewall itu merupakan suatu simple packet filter yang membolehkan hanya
koneksi-koneksi tertentu (koneksi dengan bit set ACK) atau suatu firewall yang
menjalankan advance packet filtering.
 
TCP Windows scan
Teknik ini dapat mendeteksi port-port terbuka maupun terfilter/tidak terfilter pada sistem-
sistem tertentu (sebagai contoh, AIX dan FreeBSD) sehubungan dengan anomali dari
ukuran windows TCP yang dilaporkan.
 
TCP RPC scan
Teknik ini spesifik hanya pada system UNIX dan digunakan untuk mendeteksi dan
mengidentifikasi port RPC (Remote Procedure Call) dan program serta normor versi
yang berhubungan dengannya.
 
UDP scan (-sU)
Teknik ini mengirimkan suatu paket UDP ke port sasaran. Bila port sasaran memberikan
respon berupa pesan (ICMP port unreachable) artinya port ini tertutup. Sebaliknya bila
tidak menerima pesan di atas, kita dapat menyimpulkan bahwa port itu terbuka. Karena
UDP dikenal sebagai connectionless protocol, akurasi teknik ini sangat bergantung pada
banyak hal sehubungan dengan penggunaan jaringan dan system resource. Sebagai
tambahan, UDP scanning merupakan proses yang amat lambat apabila anda mencoba
men-scan suatu perangkat yang menjalankan packet filtering berbeban tinggi.

Beberapa Tools dan cara scanning ke sistem
 
Netstat
Netstat merupakan utility yang powerfull untuk menngamati current state pada
server, service apa yang listening untuk incomming connection, interface mana yang
listening, siapa saja yang terhubung.
 
Nmap
Merupakan software scanner yang paling tua yang masih dipakai sampai
sekarang.
 
Nessus
Nessus merupakan suatu tools yang powerfull untuk melihat kelemahan port yang
ada pada komputer kita dan komputer lain. Nessus akan memberikan report secara
lengkap apa kelemahan komputer kita dan bagaimana cara mengatasinya.

 
1. Melakukan footprinting pada suatu alamat website:
a. root@jartel-19:/home/jartel# nslookup sis.pcr.ac.id
Server: 172.16.30.1 => ini ip server
Address: 172.16.30.1#53 =>jumlah ??
Non-authoritative answer:
Name: sis.pcr.ac.id
Address: 172.16.10.14
melihat dns sis.pcr.id
nslookup ns1.pcr.ac.id
Server: 172.16.30.1
Address: 172.16.30.1#53
Non-authoritative answer:
Name: ns1.pcr.ac.id
Address: 113.212.118.130

root@jartel-19:/home/jartel# nslookup ns2.pcr.ac.id
Server: 172.16.30.1
Address: 172.16.30.1#53
Non-authoritative answer:
Name: ns2.pcr.ac.id
Address: 113.212.118.130

b. root@jartel-19:/home/jartel# whois sis.pcr.ac.id
Not found: -V Md5.0 sis.pcr.ac.id

c. dig sis.pcr.ac.id
; <<>> DiG 9.8.1-P1 <<>> sis.pcr.ac.id
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56448
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1
;; QUESTION SECTION:
;sis.pcr.ac.id. IN A
;; ANSWER SECTION:
sis.pcr.ac.id. 9529 IN A 172.16.10.14
;; AUTHORITY SECTION:
pcr.ac.id. 12291 IN NS ns1.pcr.ac.id.
pcr.ac.id. 12291 IN NS ns2.pcr.ac.id.
;; ADDITIONAL SECTION:
ns1.pcr.ac.id. 12441 IN A 113.212.118.130
;; Query time: 8 msec
;; SERVER: 172.16.30.1#53(172.16.30.1)
;; WHEN: Thu Jun 27 08:21:27 2013
;; MSG SIZE rcvd: 99
2. root@jartel-19:/home/jartel# netstat -tpane sis.pcr.ac.id
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 116 11146 1100/mysqld
tcp 0 0 127.0.0.1:5038 0.0.0.0:* LISTEN 115 1909 1055/asterisk
tcp 0 0 0.0.0.0:2000 0.0.0.0:* LISTEN 115 1916 1055/asterisk
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 0 9981 1148/apache2
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 0 97988 806/cupsd
tcp 1 0 172.16.30.3:52790 91.189.94.25:80 CLOSE_WAIT 1000 12890 1994/ubuntu-geoip-p
tcp6 0 0 ::1:631 :::* LISTEN 0 97987 806/cupsd

root@jartel-19:/home/jartel# netstat -tupane sis.pcr.ac.id
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 116 11146 1100/mysqld
tcp 0 0 127.0.0.1:5038 0.0.0.0:* LISTEN 115 1909 1055/asterisk
tcp 0 0 0.0.0.0:2000 0.0.0.0:* LISTEN 115 1916 1055/asterisk
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 0 9981 1148/apache2
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 0 97988 806/cupsd
tcp 0 0 172.16.30.3:56621 173.194.38.163:80 ESTABLISHED 1000 177534 2207/firefox
tcp 0 0 172.16.30.3:55158 173.194.38.169:80 ESTABLISHED 1000 173164 2207/firefox
tcp 1 0 172.16.30.3:52790 91.189.94.25:80 CLOSE_WAIT 1000 12890 1994/ubuntu-geoip-p
tcp6 0 0 ::1:631 :::* LISTEN 0 97987 806/cupsd
udp 0 0 0.0.0.0:5353 0.0.0.0:* 107 7896 784/avahi-daemon: r
udp 0 0 0.0.0.0:5000 0.0.0.0:* 115 1923 1055/asterisk
udp 0 0 0.0.0.0:4520 0.0.0.0:* 115 1922 1055/asterisk
udp 0 0 0.0.0.0:5060 0.0.0.0:* 115 1918 1055/asterisk
udp 0 0 0.0.0.0:4569 0.0.0.0:* 115 1917 1055/asterisk
udp 0 0 0.0.0.0:42474 0.0.0.0:* 107 7898 784/avahi-daemon: r
udp 0 0 0.0.0.0:68 0.0.0.0:* 0 8514 888/dhclient3
udp6 0 0 :::5353 :::* 107 7897 784/avahi-daemon: r
udp6 0 0 :::46560 :::* 107 7899 784/avahi-daemon: r



3. Wireshark
root@jartel-19:/home/jartel# nmap -sT -v 172.16.10.14 ( connect scan)
Starting Nmap 5.21 ( http://nmap.org ) at 2013-06-27 08:37 WIT
Initiating Ping Scan at 08:37
Scanning 172.16.10.14 [4 ports]
Completed Ping Scan at 08:37, 0.08s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 08:37
Completed Parallel DNS resolution of 1 host. at 08:37, 0.06s elapsed
Initiating Connect Scan at 08:37
Scanning 172.16.10.14 [1000 ports]
Discovered open port 1025/tcp on 172.16.10.14
Discovered open port 135/tcp on 172.16.10.14
Discovered open port 445/tcp on 172.16.10.14
Discovered open port 8009/tcp on 172.16.10.14
Discovered open port 1036/tcp on 172.16.10.14
Discovered open port 8099/tcp on 172.16.10.14
Discovered open port 1030/tcp on 172.16.10.14
Discovered open port 3389/tcp on 172.16.10.14
Discovered open port 80/tcp on 172.16.10.14
Discovered open port 25/tcp on 172.16.10.14
Discovered open port 139/tcp on 172.16.10.14
Discovered open port 1035/tcp on 172.16.10.14
Discovered open port 8011/tcp on 172.16.10.14
Discovered open port 1026/tcp on 172.16.10.14
Completed Connect Scan at 08:37, 3.33s elapsed (1000 total ports)
Nmap scan report for 172.16.10.14
Host is up (0.0067s latency).
Not shown: 986 closed ports
PORT STATE SERVICE
25/tcp open smtp
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1025/tcp open NFS-or-IIS
1026/tcp open LSA-or-nterm
1030/tcp open iad1
1035/tcp open multidropper
1036/tcp open unknown
3389/tcp open ms-term-serv
8009/tcp open ajp13
8011/tcp open unknown
8099/tcp open unknown
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 3.50 seconds
Raw packets sent: 4 (152B) | Rcvd: 1 (28B)

root@jartel-19:/home/jartel# nmap -sS -v sis.pcr.ac.id (TCP SYN scan)
Starting Nmap 5.21 ( http://nmap.org ) at 2013-06-27 08:40 WIT
Initiating Ping Scan at 08:40
Scanning sis.pcr.ac.id (172.16.10.14) [4 ports]
Completed Ping Scan at 08:40, 0.18s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 08:40
Completed Parallel DNS resolution of 1 host. at 08:40, 0.06s elapsed
Initiating SYN Stealth Scan at 08:40
Scanning sis.pcr.ac.id (172.16.10.14) [1000 ports]
Discovered open port 25/tcp on 172.16.10.14
Discovered open port 1025/tcp on 172.16.10.14
Discovered open port 139/tcp on 172.16.10.14
Discovered open port 80/tcp on 172.16.10.14
Discovered open port 1035/tcp on 172.16.10.14
Discovered open port 1026/tcp on 172.16.10.14
Discovered open port 135/tcp on 172.16.10.14
Discovered open port 3389/tcp on 172.16.10.14
Discovered open port 445/tcp on 172.16.10.14
Discovered open port 8099/tcp on 172.16.10.14
Discovered open port 8011/tcp on 172.16.10.14
Discovered open port 8009/tcp on 172.16.10.14
Discovered open port 1030/tcp on 172.16.10.14
Discovered open port 1036/tcp on 172.16.10.14
Completed SYN Stealth Scan at 08:40, 2.84s elapsed (1000 total ports)
Nmap scan report for sis.pcr.ac.id (172.16.10.14)
Host is up (0.00097s latency).
Not shown: 986 closed ports
PORT STATE SERVICE
25/tcp open smtp
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1025/tcp open NFS-or-IIS
1026/tcp open LSA-or-nterm
1030/tcp open iad1
1035/tcp open multidropper
1036/tcp open unknown
3389/tcp open ms-term-serv
8009/tcp open ajp13
8011/tcp open unknown
8099/tcp open unknown
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 3.12 seconds
Raw packets sent: 1171 (51.500KB) | Rcvd: 1003 (40.164KB)


root@jartel-19:/home/jartel# nmap -O -v sis.pcr.ac.id (mendeteksi Operasi System)
Starting Nmap 5.21 ( http://nmap.org ) at 2013-06-27 08:42 WIT
Initiating Ping Scan at 08:42
Scanning sis.pcr.ac.id (172.16.10.14) [4 ports]
Completed Ping Scan at 08:42, 0.07s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 08:42
Completed Parallel DNS resolution of 1 host. at 08:42, 0.06s elapsed
Initiating SYN Stealth Scan at 08:42
Scanning sis.pcr.ac.id (172.16.10.14) [1000 ports]
Discovered open port 25/tcp on 172.16.10.14
Discovered open port 1025/tcp on 172.16.10.14
Discovered open port 80/tcp on 172.16.10.14
Discovered open port 3389/tcp on 172.16.10.14
Discovered open port 445/tcp on 172.16.10.14
Discovered open port 139/tcp on 172.16.10.14
Discovered open port 135/tcp on 172.16.10.14
Discovered open port 1036/tcp on 172.16.10.14
Discovered open port 8011/tcp on 172.16.10.14
Discovered open port 1030/tcp on 172.16.10.14
Discovered open port 8009/tcp on 172.16.10.14
Discovered open port 8099/tcp on 172.16.10.14
Discovered open port 1026/tcp on 172.16.10.14
Completed SYN Stealth Scan at 08:42, 2.86s elapsed (1000 total ports)
Initiating OS detection (try #1) against sis.pcr.ac.id (172.16.10.14)
Nmap scan report for sis.pcr.ac.id (172.16.10.14)
Host is up (0.0031s latency).
Not shown: 987 closed ports
PORT STATE SERVICE
25/tcp open smtp
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1025/tcp open NFS-or-IIS
1026/tcp open LSA-or-nterm
1030/tcp open iad1
1036/tcp open unknown
3389/tcp open ms-term-serv
8009/tcp open ajp13
8011/tcp open unknown
8099/tcp open unknown
Device type: general purpose
Running: Microsoft Windows XP
OS details: Microsoft Windows XP Professional SP2, Microsoft Windows XP SP2 or SP3, or Windows Server 2003
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: Incremental
Read data files from: /usr/share/nmap
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 4.41 seconds
Raw packets sent: 1189 (53.318KB) | Rcvd: 1020 (41.302KB)


root@jartel-19:/home/jartel# nmap -sF -v sis.pcr.ac.id (TCP FIN scan)
Starting Nmap 5.21 ( http://nmap.org ) at 2013-06-27 08:44 WIT
Initiating Ping Scan at 08:44
Scanning sis.pcr.ac.id (172.16.10.14) [4 ports]
Completed Ping Scan at 08:44, 0.13s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 08:44
Completed Parallel DNS resolution of 1 host. at 08:44, 0.06s elapsed
Initiating FIN Scan at 08:44
Scanning sis.pcr.ac.id (172.16.10.14) [1000 ports]
Completed FIN Scan at 08:45, 35.15s elapsed (1000 total ports)
Nmap scan report for sis.pcr.ac.id (172.16.10.14)
Host is up (0.0016s latency).
Not shown: 818 closed ports, 178 open|filtered ports
PORT STATE SERVICE
4/tcp filtered unknown
10616/tcp filtered unknown
21571/tcp filtered unknown
32770/tcp filtered sometimes-rpc3
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 35.38 seconds
Raw packets sent: 2208 (88.312KB) | Rcvd: 824 (33.088KB)


root@jartel-19:/home/jartel# nmap -sX -v sis.pcr.ac.id ( Xmas Tree scan)
Starting Nmap 5.21 ( http://nmap.org ) at 2013-06-27 08:59 WIT
Initiating Ping Scan at 08:59
Scanning sis.pcr.ac.id (172.16.10.14) [4 ports]
Completed Ping Scan at 08:59, 0.06s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 08:59
Completed Parallel DNS resolution of 1 host. at 08:59, 0.09s elapsed
Initiating XMAS Scan at 08:59
Scanning sis.pcr.ac.id (172.16.10.14) [1000 ports]
Increasing send delay for 172.16.10.14 from 0 to 5 due to 11 out of 28 dropped probes since last increase.
Increasing send delay for 172.16.10.14 from 5 to 10 due to max_successful_tryno increase to 4
XMAS Scan Timing: About 49.42% done; ETC: 09:01 (0:00:32 remaining)
Stats: 0:00:39 elapsed; 0 hosts completed (1 up), 1 undergoing XMAS Scan
XMAS Scan Timing: About 56.45% done; ETC: 09:01 (0:00:31 remaining)
Increasing send delay for 172.16.10.14 from 10 to 20 due to max_successful_tryno increase to 5
Increasing send delay for 172.16.10.14 from 20 to 40 due to max_successful_tryno increase to 6
Increasing send delay for 172.16.10.14 from 40 to 80 due to max_successful_tryno increase to 7
Completed XMAS Scan at 09:01, 91.30s elapsed (1000 total ports)
Nmap scan report for sis.pcr.ac.id (172.16.10.14)
Host is up (0.018s latency).
Not shown: 987 closed ports
PORT STATE SERVICE
513/tcp open|filtered login
1688/tcp open|filtered unknown
2557/tcp open|filtered unknown
3011/tcp filtered unknown
3784/tcp open|filtered unknown
3827/tcp open|filtered unknown
5510/tcp open|filtered secureidprop
5678/tcp open|filtered unknown
8292/tcp open|filtered unknown
9111/tcp open|filtered DragonIDSConsole
9415/tcp open|filtered unknown
9503/tcp open|filtered unknown
16012/tcp open|filtered unknown
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 91.53 seconds
Raw packets sent: 1835 (73.392KB) | Rcvd: 992 (39.696KB)


root@jartel-19:/home/jartel# nmap -sN -v sis.pcr.ac.id (Null Scan)
Starting Nmap 5.21 ( http://nmap.org ) at 2013-06-27 09:05 WIT
Initiating Ping Scan at 09:05
Scanning sis.pcr.ac.id (172.16.10.14) [4 ports]
Completed Ping Scan at 09:05, 3.11s elapsed (1 total hosts)
Nmap scan report for sis.pcr.ac.id (172.16.10.14) [host down]
Read data files from: /usr/share/nmap
Note: Host seems down. If it is really up, but blocking our ping probes, try -PN
Nmap done: 1 IP address (0 hosts up) scanned in 3.16 seconds
Raw packets sent: 8 (304B) | Rcvd: 0 (0B)

root@jartel-19:/home/jartel# nmap -sA -v sis.pcr.ac.id (TCP ACK scan)
Starting Nmap 5.21 ( http://nmap.org ) at 2013-06-27 09:07 WIT
Initiating Ping Scan at 09:07
Scanning sis.pcr.ac.id (172.16.10.14) [4 ports]
Completed Ping Scan at 09:07, 0.12s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 09:07
Completed Parallel DNS resolution of 1 host. at 09:07, 0.09s elapsed
Initiating ACK Scan at 09:07
Scanning sis.pcr.ac.id (172.16.10.14) [1000 ports]
Increasing send delay for 172.16.10.14 from 0 to 5 due to 11 out of 31 dropped probes since last increase.
Completed ACK Scan at 09:07, 7.89s elapsed (1000 total ports)
Nmap scan report for sis.pcr.ac.id (172.16.10.14)
Host is up (0.0054s latency).
All 1000 scanned ports on sis.pcr.ac.id (172.16.10.14) are unfiltered
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 8.18 seconds
Raw packets sent: 1065 (42.592KB) | Rcvd: 1001 (40.028KB)


root@jartel-19:/home/jartel# nmap -sU -v sis.pcr.ac.id
Starting Nmap 5.21 ( http://nmap.org ) at 2013-06-27 09:21 WIT
Initiating Ping Scan at 09:21
Scanning sis.pcr.ac.id (172.16.10.14) [4 ports]
Completed Ping Scan at 09:21, 3.12s elapsed (1 total hosts)
Nmap scan report for sis.pcr.ac.id (172.16.10.14) [host down]
Read data files from: /usr/share/nmap
Note: Host seems down. If it is really up, but blocking our ping probes, try -PN
Nmap done: 1 IP address (0 hosts up) scanned in 3.19 seconds
Raw packets sent: 8 (304B) | Rcvd: 0 (0B)

Berikut Konfigurasi dan Installing Nessus

1. Dowload aplikasi Nessus di website : http://www.tenable.com/products/nessus/select-your-operating-system. Setelah itu pastikan posisi file yang Nessus yang sudah di download. Agar lebih tepat proses dowload nya 


2. Sebelum kita memulai download nessusnya. Harus mengetahui kode aktifasi nya. Hal itu bisa dilakukan dengan cara mendaftar ke situs nya. Di bawah ini adalah step-step yang dilakukan

a. Masik dulu ke website nya dengan cara mengetik www.tenable.com/products/nessus . Sehingga setelah kita memasukkan alamt nya akan muncul halaman seperti ini.


b. kemudian klik lagi Obtain an Activation Code. Lalu muncul laman ini


c. setelah itu klik select pada Using Nessusnya at Home ?


d. Masukkan First Name, Last Name, dan Email kita untuk mendapatkan keynya. Setelah itu pilih I agre and klik register. Maka akan muncul hal seperti ini.


e. Setelah itu akan muncul hal seperti ini



f. Setelah itu buka email yang kita gunakan untuk register. Karena di dalam email yang digunakan tersebut terdapat key (Your activation code for the Nessus HomeFeed).


 

Sumber:
http://budi-aog.blogspot.com/2013/06/network-scanning-dan-probing-ubuntu-1110.html
Diposting oleh di

Tidak ada komentar:

Posting Komentar

Langganan: Posting Komentar (Atom)