Chapter 3 - Enumeration and Scanning Your Network

In ethical hacking, the reconnaissance phase is followed by the scanning and enumeration phase where the information collected from reconnaissance phase is used to examine the target or target network further for getting specific details such as computer names, IP addresses, open ports, user accounts, running services, OS details, system architecture, vulnerabilities, etc. This chapter introduces different scanning and enumeration tools used in the scanning phase of the ethical hacking process in detail. One may use scanning and enumeration tools and techniques involving packet crafting tools, packet analyzers, port scanners, network mappers, sweepers, and vulnerability scanners during this phase. The chapter introduces tools like Hping3, NMAP security scanner, Colasoft packet builder to create custom packets, vulnerability scanners such as Nessus, Netbios enumeration technique, Hyena, remote administration of network devices using advanced IP scanner, global network inventory, network mapping using the dude network monitor, banner grabbing using ID serve, SNMP enumeration technique, creating NetBIOS null session to enumerate, etc. The chapter also provides the details of maintaining privacy and anonymity while carrying out such scanning and enumeration attacks.

Penetration testing helps to secure networks, and highlights the security issues. In this paper investigate different aspects of penetration testing including tools, attack methodologies, and defense strategies. More specifically, we performed different penetration tests using a private networks, devices, and virtualized systems and tools. We predominately used tools within the Kali Linux suite. The attacks we performed included: smartphone penetration testing, hacking phones Bluetooth, traffic sniffing, hacking WPA Protected Wifi, Man-in-the-Middle attack, spying (accessing a PC microphone), hacking phones Bluetooth, and hacking remote PC via IP and open ports using advanced port scanner. The results are then summarized and discussed. The paper also outlined the detailed steps and methods while conducting these attacks.

In today's distributed computing environment where computer networks and the Internet are the means of communication and information exchange, security is becoming more and more important. Security in computer networks and the Internet has serious implications for the current dynamic work environment. Security is now a basic requirement because distributed computing is insecure. In an organization, regardless of its size and volume, it is very important to improve the security of computer infrastructure. However, with the rapid emergence of new vulnerabilities and exploits, at some point even a fully-fledged system or network has security flaws. There are different security measures that can be applied to secure the network or system. The best way to ensure that your network or system is secure is Penetration Test, which can provide a realistic security assessment by identifying vulnerabilities and exploits in a network infrastructure. Penetration Test uses the same principles as hackers to infiltrate the computer network infrastructure and thus verify the presence of defects and vulnerabilities and help confirm security measures. The thesis begins with defining the theoretical background of a penetration test. It then proceeds to the phases that exist in a penetration test and the appropriate methodology. In the practical part we will see a simulation of attacks on a network with partial knowledge of the system or network. Open source tools for network monitoring, port scanners, vulnerability scanners and penetration test framework will be used. The aim of this thesis is to identify and explain a suitable methodology for penetration test, to illustrate relevant open source tools as well as to implement a vulnerability framework that can be used to ensure that an organization's network and systems are secure.

Port scanning is a first common discovering step which allows cyber malicious actors to gather valuable information about target hosts namely defense, governmental and banks servers by trying to identify instantly open ports, which correspond to specific services on the cloud, such as HTTP, DNS, and email. This paper aims to introduce a detection and evaluation approach for port scanning attacks in various contexts and levels of criticity based on fuzzy reasoning method. A new fuzzy logic controller, which uses fuzzy rules base and the Mamdani inference method is proposed as Intrusion Detection System as a Service, which dynamically detect and evaluate the criticity of port scanning. This SaaS enables network administrators and cyber security specialists to follow in real time the network traffic behavior, i.e., the Port Scanning Criticity Level (PSCL). A Dynamic dashboard is implemented to quickly and efficiently identify malicious port scanning activities. Experimentations and evaluations showed the efficiency of the proposed system in multilevel port scanning detection compared to Snort and the related IDS systems.

Mobile cloud computing (MCC) enables mobile devices to exploit seamless cloud services via offloading, and has numerous advantages and increased security and complexity. Penetration testing of mobile applications has become more complex and expensive due to several parameters, such as the platform, device heterogeneity, context event types, and offloading. Numerous studies have been published in the MCC domain, whereas few studies have addressed the common issues and challenges of MCC testing. However, current studies do not address MCC and penetration testing. Therefore, revisiting MCC and penetration testing domains is essential to overcoming the inherent complexity and reducing costs. Motivated by the importance of revisiting these domains, this paper pursues two objectives: to provide a comprehensive systematic literature review (SLR) of the MCC, security and penetration testing domains and to establish the requirements for penetration testing of MCC applications. This paper has systematically reviewed previous penetration testing models and techniques based on the requirements in Kitchenham's SLR guidelines. The SLR outcome has indicated the following deficiencies: the offloading parameter is disregarded; studies that address mobile, cloud, and web vulnerabilities are lacking; and a MCC application penetration testing model has not been addressed by current studies. In particular, offloading and mobile state management are two new and vital requirements that have not been addressed to reveal hidden security vulnerabilities, facilitate mutual trust, and enable developers to build more secure MCC applications. Beneficial review results that can contribute to future research are presented.

Defending a cyber asset from a targeted attack based on port scanning is a challenging task because attackers exploit protocol behavior essential for productive use of applications. For instance, TCP or UDP ports opened for applications such as file transfer or video can be exploited to launch denial of service attacks. There is a need for proactive methods that can detect port scanning based attacks at their initial stage so that countermeasures can be initiated before the attack impact is disruptive on a cyber asset. This paper presents methods to counteract the initial stages of network attacks involving TCP and UDP port scanning. Our methods analyze outgoing traffic to identify ICMP 3.3 and TCP RST response packets that indicate the beginning of an attack launch. We specifically describe two countermeasures based on software-defined networking controller (at the network level) and Linux utility (at the host level) modules we developed. To validate the effectiveness of our proactive detection based methodology, we set up a testbed with a scheme of a polygon and conducted experiments related to distortion of the port status of attacks. Our results demonstrate that our approach is effective and the accuracy of determining open TCP ports did not exceed 15%, and it did not reach 2% for the remaining ports (closed TCP, UDP of any type).

This paper focuses on evaluating the security challenges faced by mobile field hospitals, which play a crucial role in emergency response and disaster management in remote and austere environments. The authors conducted a penetration test using the Open Source Security Testing Methodology Manual (OSSTMM) framework to assess the security posture of a mobile field hospital. The methodology employed in the study included a combination of automated and manual techniques such as network scanning, vulnerability assessments, social engineering, and exploitation. The penetration test revealed several security vulnerabilities in the mobile field hospital, including weak passwords, unpatched software, and inadequate network segmentation. Additionally, the study identified vulnerabilities in the hospital's medical devices and equipment, posing a risk of cyber-attacks that could disrupt operations and compromise patient safety. The results underscore the importance of implementing enhanced security measures in mobile field hospitals to mitigate cyber threats and ensure the uninterrupted functioning of medical operations during emergencies and disasters. This study provides a comprehensive analysis of the mobile field hospital's security posture using the OSSTMM framework and emphasizes the urgent need for improved security practices in such settings. Keywords: Cybersecurity, Healthcare, Penetration Testing, Mobile Field Hospitals, Data, Emergency Response, Open Source, Security Testing, Ethical Hacking, Security Frameworks, Proceedings Citation Format Ahmed, N.B., Daclin, N., Olivaux, M. & 4usserre, G. (2023): Addressing the Dilemma of a “Crisis within a crisis”: Exploring the Penetration Testing challenges in a Mobile Field Hospital Setting. Proceedings of the Cyber Secure Nigeria Conference. Nigerian Army Resource Centre (NARC) Abuja, Nigeria. 11-12th July, 2023. Pp 67-80 https://www.csean.org.ng/. dx.doi.org/10.22624/AIMS/CSEAN-SMART2023P9

Due to increase in problems like space allocation, web hosting, hardware failure which results in the loss of data. This problem can be solved by new technologies in cloud computing. With the passing of time and the advancements in technology, the usage of cloud storage has increased tremendously which has resulted in the increase of the threats on cloud. Attackers can easily find vulnerabilities present in the system and exploit the data that it holds by using a port scanner. In such a way the DDOS (Distributed Denial of Service) attack will compromise the machine. In such type of attacks, multi-step exploitation, low frequency vulnerability scanning, compromises other machines to develop zombie systems. Lastly, the attacks that are caused by those compromised machines are the problem seen in such type of attacks. To detect and prevent an attack on the system, a network intrusion detection selection is done on them with the help of honeypots. Honeypots lure attackers away from the main system preventing it from the attack and protecting its integrity. A Nice-A agent continuously monitors the network. The VM Profillerwill update the database forsuch attacks taking place on open ports in the network. This attack type is analysed by attack analyser. After recognizing the type of attack, it gives notification to network controller and suggest the countermeasure to be taken. The attack is further directed to honeypot. A security mechanism honeypot which detects and deflects an unauthorized user trying to access the information system. Honeypot thus tracks the attacker IP and its signature attack.

OBJECTIVE. There are few articles in the literature describing the security and safety aspects of networked medical equipment in radiology departments. Most radiologists are unaware of the security issues. We review the security of the networked medical equipment of a typical radiology department. MATERIALS AND METHODS. All networked medical equipment in a radiology department was scanned for vulnerabilities with a port scanner and a network vulnerability scanner, and the vulnerabilities were classified using the Common Vulnerability Scoring System. A network sniffer was used to capture and analyze traffic on the radiology network for exposure of confidential patient data. We reviewed the use of antivirus software and firewalls on the networked medical equipment. USB ports and CD and DVD drives in the networked medical equipment were tested to see whether they allowed unauthorized access. Implementation of the virtual private network (VPN) that vendors use to access the radiology network was reviewed. RESULTS. Most of the networked medical equipment in our radiology department used vulnerable software with open ports and services. Of the 144 items scanned, 64 (44%) had at least one critical vulnerability, and 119 (83%) had at least one high-risk vulnerability. Most equipment did not encrypt traffic and allowed capture of confidential patient data. Of the 144 items scanned, two (1%) used antivirus software and three (2%) had a firewall enabled. The USB ports were not secure on 49 of the 58 (84%) items with USB ports, and the CD or DVD drive was not secure on 17 of the 31 (55%) items with a CD or DVD drive. One of three vendors had an insecure implementation of VPN access. CONCLUSION. Radiologists and the medical industry need to urgently review and rectify the security issues in existing networked medical equipment. We hope that the results of our study and this article also raise awareness among radiologists about the security issues of networked medical equipment.

Network security faces significant challenges due to the increasing number and complexity of system vulnerabilities. This study aims to develop and evaluate a full combination method (ABC) integrating port scanning (Nmap), vulnerability scanning (OpenVAS), and penetration testing (Metasploit), and compare it with partial combinations (AB, BC, AC) for more effective vulnerability detection. Using a quantitative experimental approach within a controlled GNS3 TestBed, three key indicators were analyzed: number of vulnerabilities detected, detection time, and exploit validity. Experimental results show that the ABC method detected 62 potential vulnerabilities, including 11 high and medium severity CVEs, matching the AB method but significantly outperforming AC, which detected none. In terms of detection time, the ABC method achieved a balanced performance at 91 minutes, which is 31.5% faster than AB (133 minutes), while maintaining full exploit validation. Notably, the ABC method successfully validated 100% of critical vulnerabilities using Metasploit, confirming the practical applicability and reliability of the integrated approach compared to dual combinations. Overall, the findings demonstrate that the full combination method (ABC) offers superior accuracy and comprehensiveness in detecting and validating network vulnerabilities. This research contributes to cybersecurity practices by proposing an integrated detection workflow that effectively balances speed and depth of analysis, setting a practical benchmark for vulnerability detection systems applicable to both simulated and real-world network environments.

This document presents a new approach to Internet network management without changing the basic rules of the interface and encapsulation mechanisms of standard management transport protocols. The Internet network services management framework (INSMF) tries to overcome the most important limitations of the Internet network management framework (INMF) by adding a new extension-model to it, using a network service management distributed architecture that provides services management functions with any desired level of functionality. The specification of a generic domain name service (DNS) management service is presented, as a way to illustrate the capabilities and potential of the proposed framework.

Security testing is a necessary first step for organizations whose goal is to determine the level of information security and enhance it for strengthening the protection. There are various methodologies and standards. Each individual methodology describes a process that an organization can perform to detect vulnerabilities. Companies can either create their own internal methodology or use an existing methodology, but most often specialists conduct security testing according to well-known methods. The article deals with a comparative analysis of methods and standards for testing the security of systems, networks, and web applications. The following were considered: OWASP WSTG web application security testing methodologies, NIST SP 800-115 Technical Information Security Testing and Evaluation Manual, PTES Penetration testing standard, ISSAF information system security assessment methodology, OSSTMM open source security testing methodology, BSI penetration testing model study methodology, Positive Technologies methodology. Their strengths and weaknesses have been identified. Based on the analysis, a methodology is proposed that focuses on efficiency, ease of implementation and adaptation to various projects. The practical significance of the work lies in the possibility of its application to increase the level of security in information systems. The results of the study may be useful to information security specialists and organizations seeking to minimize the risks of cyber attacks

As organizations face an ever-increasing number of cyber threats, the need for robust cybersecurity measures becomes paramount. Continuous Internal Penetration Testing (CIPT) has emerged as a proactive approach to identify and address vulnerabilities within an organization’s network infrastructure. This research paper explores the concept of CIPT, where penetration testing activities are integrated into daily operations rather than performed periodically. The study aims to investigate the benefits, challenges, and best practices for implementing continuous testing in an organizational context. Through a combination of literature review, case studies, and data analysis, this research examines the effectiveness of CIPT in enhancing an organization’s security posture and minimizing the risk of cyber attacks. The findings of this study contribute to the existing body of knowledge by providing insights into the unique advantages and potential limitations of CIPT, as well as practical recommendations for organizations looking to implement or optimize their CIPT programs. Ultimately, this research aims to facilitate the adoption of CIPT as a proactive cybersecurity measure, empowering organizations to protect their critical assets and safeguard against evolving cyber threats. Index Terms: Continuous Internal Penetration Testing (CIPT), Cybersecurity, Penetration Testing, Vulnerability Assessment, Risk Management, Threat Detection , Network Security, Information Security, Attack Surface, Security Posture, Security Controls, Incident Response, Security Assessment, Risk Mitigation, Security Testing, Red Teaming, Security Auditing, Security Monitoring, Security Operations, Security Best Practices.

In Western Australia the vast majority of government subsidized dental specialist services is provided through the University of Western Australia (UWA). With predicted expanding demand for services and the high cost of providing specialist services it is important that access to specialist care is targeted at need. In this study the waiting lists for oral surgery services at UWA was analyzed to test the hypothesis that demand for oral surgical care is distributed evenly across the eligible population of Western Australia. Data were obtained from de-identified waiting lists for oral surgery at UWA. This data included all patients on the oral surgery waiting list from November 2001 to December 2003. Results indicated significantly less entries on the waiting list for people in remote and very remote postcode regions, and people living in postcode regions associated with a fixed government clinic were significantly more likely to be on the waiting list for oral surgery. The data presented identify that demand for specialist services is not driven through the expected factors of disease burden as indicated by socio-economic status, but by access to general dental services.

He Italian Public Administration Services (IPAS) is a registry of services provided to Italian citizens likewise the Local Government Service List (UK), or the European Service List for local authorities from other nations. Unlike existing registries, IPAS presents the novelty of modelling public services from the view point of the value they have for the consumers and the providers. A value-added-service (VAS) is linked to a life event that requires its fruition, addresses consumer categories to identify market opportunities for private providers, and is described by non-functional-properties such as price and time of fruition. Where Italian local authorities leave the citizen-users in a daedal us of references to understand whether they can/have to apply for a service, the IPAS model captures the necessary back-ground knowledge about the connection between administrative legislation and service specifications, life events, and application contexts to support the citizen-users to fulfill their needs. As a proof of concept, we developed an operational web environment named ASSO, designed to assist the citizen-user to intuitively create bundles of mandatory-by-legislation and recommended services, to accomplish his bureaucratic fulfillments. Although ASSO is an ongoing project, domain experts gave preliminary positive feedback on the innovativeness and effectiveness of the proposed approach. © 2013 IEEE.