Difference between revisions of "Banner Grabbing"

From wikieduonline
Jump to navigation Jump to search
Tags: Mobile web edit, Mobile edit
 
(8 intermediate revisions by 2 users not shown)
Line 3: Line 3:
 
This is the most popular type of banner grabbing, basically the act of sending packets to the remote host and waiting for their response to analyze the data.
 
This is the most popular type of banner grabbing, basically the act of sending packets to the remote host and waiting for their response to analyze the data.
  
Active banner grabbing techniques involve opening a TCP (or similar) connection between an origin host and a remote host. It can be considered active, as your connection will be logged in the remote system. This is the most risky approach to banner grabbing as it’s often detected by some IDS.
+
Active banner grabbing techniques involve opening a [[TCP]] (or similar) connection between an origin host and a remote host. It can be considered active, as your connection will be logged in the remote system. This is the most risky approach to banner grabbing as it’s often detected by some [[IDS]].
  
 
===Passive banner grabbing===
 
===Passive banner grabbing===
 
On the other hand, passive banner grabbing enables you to get the same information while avoiding a high level of exposure from the origin connection. Different intermediate software and platforms can be used as a gateway to avoid a direct connection and still allow you to obtain the data you need.
 
On the other hand, passive banner grabbing enables you to get the same information while avoiding a high level of exposure from the origin connection. Different intermediate software and platforms can be used as a gateway to avoid a direct connection and still allow you to obtain the data you need.
  
Using 3rd party networks tools or services such as search engines, Shodan, or sniffing the traffic to capture and analyze packets, can help you determine software versions.
+
Using 3rd party networks tools or services such as [[search engines]], [[shodan.io]], or sniffing the traffic to capture and analyze packets, can help you determine software versions.
  
 
==Banner Grabbing Tools==
 
==Banner Grabbing Tools==
  
===Telnet===
+
===Telnet or netcat===
  
One of the most famous is [[Telnet]]
+
[[Telnet]] or [[netcat]] allow basic information collection
  
 
<code>telnet IP PORT</code>
 
<code>telnet IP PORT</code>
Line 26: Line 26:
 
<code>wget 192.168.0.15 -q -S</code>
 
<code>wget 192.168.0.15 -q -S</code>
  
The -q will suppress the normal output, and the -S parameter will print the headers sent by the HTTP server, which also works for FTP servers.
+
The -q will suppress the normal output, and the -S parameter will print the headers sent by the HTTP server or [[FTP]] servers.
 +
 
 +
===cURL===
 +
 
 +
[[cURL]] offers the same features to fetch remote banner information from HTTP servers.
 +
 
 +
<code> curl -s -I 192.168.0.15 | grep -e "Server: "</code>
 +
 
 +
===Nmap===
 +
 
 +
[[Nmap]]
 +
 
 +
<code>[[nmap -sV]] --version-intensity 5 xxxxxx.com -p 80</code>
 +
 
 +
The -sV option lets us fetch the software versions, and by adding --version-intensity 5, we can get the maximum number of possible details about the remote running software.
 +
 
 +
By using the powerful nmap [[NSE]] capabilities we can also try other scripts that will help us fetch remote banners easily:
 +
 
 +
<code>nmap -sV --script=banner IP</code>
 +
 
 +
===Netcat===
 +
 
 +
[[Netcat]] is the swiss army knife of the hackers. Netcat is used for file (exploit) transfer, finding open ports & remote administration (Bind & Reverse Shells). You can manually connect to any network service like HTTP using netcat. Another utility is to listen on any udp/tcp ports on your machine for any incoming connections.
 +
 
 +
<code><nc<IPaddress or FQDN> <port number></code>
  
 
==See also==
 
==See also==
 
*{{Security}}
 
*{{Security}}
 +
*[[Certified Ethical Hacker (CEH) Contents]]
 +
 +
[[Category:Security]]

Latest revision as of 00:09, 6 July 2021

Banner grabbing is a technique used to gain information about a computer system on a network and the services running on its open ports. Administrators can use this to take inventory of the systems and services on their network.

Active banner grabbing[edit]

This is the most popular type of banner grabbing, basically the act of sending packets to the remote host and waiting for their response to analyze the data.

Active banner grabbing techniques involve opening a TCP (or similar) connection between an origin host and a remote host. It can be considered active, as your connection will be logged in the remote system. This is the most risky approach to banner grabbing as it’s often detected by some IDS.

Passive banner grabbing[edit]

On the other hand, passive banner grabbing enables you to get the same information while avoiding a high level of exposure from the origin connection. Different intermediate software and platforms can be used as a gateway to avoid a direct connection and still allow you to obtain the data you need.

Using 3rd party networks tools or services such as search engines, shodan.io, or sniffing the traffic to capture and analyze packets, can help you determine software versions.

[edit]

Telnet or netcat[edit]

Telnet or netcat allow basic information collection

telnet IP PORT

Wget[edit]

Wget is another great tool that can lead us to the remote banner of any remote or local server'

Example:

wget 192.168.0.15 -q -S

The -q will suppress the normal output, and the -S parameter will print the headers sent by the HTTP server or FTP servers.

cURL[edit]

cURL offers the same features to fetch remote banner information from HTTP servers.

curl -s -I 192.168.0.15 | grep -e "Server: "

Nmap[edit]

Nmap

nmap -sV --version-intensity 5 xxxxxx.com -p 80

The -sV option lets us fetch the software versions, and by adding --version-intensity 5, we can get the maximum number of possible details about the remote running software.

By using the powerful nmap NSE capabilities we can also try other scripts that will help us fetch remote banners easily:

nmap -sV --script=banner IP

Netcat[edit]

Netcat is the swiss army knife of the hackers. Netcat is used for file (exploit) transfer, finding open ports & remote administration (Bind & Reverse Shells). You can manually connect to any network service like HTTP using netcat. Another utility is to listen on any udp/tcp ports on your machine for any incoming connections.

<nc<IPaddress or FQDN> <port number>

See also[edit]

Advertising: