Copy Link
Add to Bookmark
Report
The Discordant Opposition Journal Issue 05 File 06
::::::::::::::::::::::::::::::::::::::::::::::::::::::::May/99
::: The Discordant Opposition Journal ::: Issue 5 - File 6 :::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:The Ancient Art of Port Surfing:
cronus
You Wha ?
What, you might ask, the fuck is Port Surfing ? And that would be a
very good question. As you might have guessed from previous articles
from me, I like to think myself a bit of a hacker, thus we can conclude
that Port Surfing is of grave importance to the humble hacker.
Port Surfing is the art of moving your attentions from one port to
another on a certain system gaining as much information as possible.
With the ultimate goal of finding software that is exploitable.
Hows tha then ?
The most basic tool for Port Surfing is the portscanner. A portscanner
is a piece of code or script that scans a range of port numbers on a
certain system looking for open services. Portscanners are easily coded
containing no more than a little code to connect to sequential ports
and log the results.
Since portscanning is such an easy operation, you may ask why then, am
I rabbiting on about Port Surfing... Port Surfing is an intimite
and personal action that has the effect of getting you closer to the
system under inspection.
The principle first off...
A portscan can only tell you what ports are actually open and running
services. It would take allot of programming to create a Port Surfer.
Port Surfing involves sending commands at the open service, noting its
version and program information and also even trying to use the service
manually to get a feel for it.
Remember that for each service (mail, web server, etc) there are dozens
of varients and upgrades. Each varient and upgrade has specific flaws
and weakness's. It is the art of Port Scanning that makes these flaws
apparent.
Who me ?
Its necessary as in most hacking techniques to hide your presence and
activity. The simple art of portscanning a server CAN put its defenses
on gaurd and force it to reject ALL your further incoming connections.
Portscanning can just be a loop that attempts to connect to a port
number and log if it can, then move to the next port. But all these
connections will be logged in the system logs. So on later inspection
your attention will be noticed. The answer is the SYN scan. The TCP
three-way handshake consists of an initial data packet from your
computer, a reply from the server and a final packet from you, the
connection is then open. A program could be made that simply started
the connection routine, but didn't actually send the final packet.
This would still have to result of discovering if the port is open
without leaving a trace of the connection in the logs.
Once you physically intend to connect to the port, you should take
some small efforts at hiding your presence. Hiding your real connection
is also part of Port Surfing. All of the basic ideas of boucing your
connection are applicable. Bouncing off vulnerable Wingate systems,
setting up 'Back Orific' redirects or even just using an 'aquired' ISP
account. I have also done an article on this whole topic for this
issue, read that for a more detailed look.
Vers and stuff...
Connecting to the port number will most likely give you a text output
something along the lines of "SSH ver 1.2" or "HTTP/1.2". The basic
introductionary text is unnecessary, it is merely advertising for a
specific piece of software. The version of the running software is
vital if weaknesses are to be found, but the problem is that these
outputs can be altered to give false information. I know of a server
running Qmail mail software but the port outputs the text "Sendmail
5.0.5" which is a non-existant version of the buggy sendmail daemon.
Once you've received all the text information you could try to throw
arbitary commands at the server. See if you can get a list of commands
and try to work out its real specifications. 'Version', 'info' or even
'help' might all retrieve information. There is no hard and fast rules
at this point. This is where Port Sufing becomes an art. You must ad-
lib and learn from your attempts. If you find that 'help' gives you an
error message, see if the message gives any clues with which to procede.
I'm sorry I have to be so vague here, but the art of Port Surfing is
not a step-by-step routine, more a hunt guided by gut feeling.
Manual (Ab)use !
If you can get a basic outline of how the service works, you might try
manually using the service by hand. A HTTP server specifically outputs
HTML coded text that is readable by a Web Browser. The specifications
of the HTTP commands is fairly basic. Easily typed and understood.
I'm not going to go the specifics of server software commands because
there are literally dozens of different protocols. The sheer number of
possibilities makes the idea undigestable.
I be sorry...
I realise that this article is getting less and less technical. And for
that I apologise. You must see hacking as I do. In the past I have
refered to it as a hunt. Trying to find the pray (weakness) before
it escapes (patched). You must use gut instinct on the hunt and make
decisions at the time, not before hand. If you feel a server that you
are 'probing' is somewhat sluggish and yet a Ping on the server shows
decent connection times, you might figure out that the server is running
out of resources internally - such as CPU processes and Hard Drive
space.
All of this detecting is an intregral part of Port Surfing. You are
trying to get closer to the server. Get to understand its workings. If
you find it has peak times of connection speeds you may find that at
these times the office is closed. These discoveries help you plan an
attack.
A traceroute command might show that for some strange reason your
connections always bounce through another specific server, this kind
of information would seem to point to a router at an ISP or head
office. The logical conclusion now would follow that this server
acts as a firewall. A firewall usually has a trust based relationship
with the protected server. This trust could possibly be exploited.
Again another example of what I call theoretical hacking...
... intoxicated with the madness ...
cronus (at) iol (dot) ie
___________ ____ ____ __ __ ______
_/ ___\_ __ \/ _ \ / \| | \/ ___/
\ \___| | \( <_> ) | \ | /\___ \
\___ >__| \____/|___| /____//____ >
\/ \/ \/
http://homepages.iol.ie/~cronus
