Editing Banner Grabbing

'''Banner grabbing''' is a technique used to gain information about a computer system on a network and the services running on its open ports. Administrators can use this to take inventory of the systems and services on their network.
===Active banner grabbing===
This is the most popular type of banner grabbing, basically the act of sending packets to the remote host and waiting for their response to analyze the data.

Active banner grabbing techniques involve opening a [[TCP]] (or similar) connection between an origin host and a remote host. It can be considered active, as your connection will be logged in the remote system. This is the most risky approach to banner grabbing as it’s often detected by some [[IDS]].

===Passive banner grabbing===
On the other hand, passive banner grabbing enables you to get the same information while avoiding a high level of exposure from the origin connection. Different intermediate software and platforms can be used as a gateway to avoid a direct connection and still allow you to obtain the data you need.

Using 3rd party networks tools or services such as search engines, Shodan, or sniffing the traffic to capture and analyze packets, can help you determine software versions.

==Banner Grabbing Tools==

===Telnet or netcat===

[[Telnet]] or [[netcat]] allow basic information collection

<code>telnet IP PORT</code>

===Wget===

[[Wget]] is another great tool that can lead us to the remote banner of any remote or local server'

Example:

<code>wget 192.168.0.15 -q -S</code>

The -q will suppress the normal output, and the -S parameter will print the headers sent by the HTTP server or [[FTP]] servers.

===cURL===

[[cURL]] offers the same features to fetch remote banner information from HTTP servers.

<code> curl -s -I 192.168.0.15 | grep -e "Server: "</code>

===Nmap===

[[Nmap]]

<code>[[nmap -sV]] --version-intensity 5 xxxxxx.com -p 80</code>

The -sV option lets us fetch the software versions, and by adding --version-intensity 5, we can get the maximum number of possible details about the remote running software.

By using the powerful nmap [[NSE]] capabilities we can also try other scripts that will help us fetch remote banners easily:

<code>nmap -sV --script=banner IP</code>

===Netcat===

[[Netcat]] is the swiss army knife of the hackers. Netcat is used for file (exploit) transfer, finding open ports & remote administration (Bind & Reverse Shells). You can manually connect to any network service like HTTP using netcat. Another utility is to listen on any udp/tcp ports on your machine for any incoming connections.

<code><nc<IPaddress or FQDN> <port number></code>

==See also==
*{{Security}}
*[[Certified Ethical Hacker (CEH) Contents]]

[[Category:Security]]