The Dig command is
used to resolve name server information like nslookup.
124 Practical Hacking Techniques and Countermeasures
Lab 21: IP/Hostname Enumeration
Enumerate IP or Hostname: Nmblookup
Prerequisites: None
Countermeasures: Firewalls, Intrusion Detection Systems (IDS)
Description: The nmblookup application will query the NetBIOS name
and map that name to the IP address using NetBIOS over TCP/IP
queries. All queries are done over the UDP protocol. Using the ??“T in
place of the ??“A option will return the IP address for a given hostname.
Procedure: From a Linux shell type the following with the syntax of
nmblookup
(Hostname or IP Address)
In this example, www.texnet.net returns an IP address of 64.217.60.4.
Target Enumeration 125
Lab 22: RPC Reporting
Report the RPC of Target: Rpcinfo
Prerequisites: None
Countermeasures: Disable unneeded services; allow only needed ports
through the firewall
Description: The rpcinfo application makes a Remote Procedure Call
(RPC) to the target and reports the results. Attackers use the results to
identify what ports/exploits to attack/use.
Procedure: From a Linux shell type the following with the syntax of:
rpcinfo (Hostname)
In this example, the target 192.168.11.123 has 5 RPC ports open.
*Note: Notice rpcinfo reports both TCP and UDP ports. Many users forget there are
65535 TCP and 65535 UDP ports to be concerned with. Many times UDP is
overlooked.
Pages:
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73