This document discusses common tools used for network reconnaissance, including Wireshark, NetWitness Investigator, OpenVAS, FileZilla, PuTTY, and Zenmap. Wireshark is used to capture network packet data, which is then analyzed by NetWitness Investigator. OpenVAS scans networks remotely for vulnerabilities. FileZilla and PuTTY transfer files securely. Zenmap performs detailed scans to reveal network information, programs, and firewall configurations. Fisheye bubble charts can visually display network activity and relationships between devices. Identifying these tools is important for security experts to understand networks and protect against cyberattacks.
The project entitled with “Network Security System” is related to hacking attacks in computer systems over internet. In today’s world many of the computer systems and servers are not secure because of increasing the hacking attacks or hackers with growing information, so information security specialist’s requirement has gone high.
A 1-day short course developed for visiting guests from Tecsup on network forensics, prepared in a day : ]
The requirements/constraints were 5-7 hours of content and that the target audience had very little forensic or networking knowledge. [For that reason, flow analysis was not included as an exercise, discussion of network monitoring solutions was limited, and the focus was on end-node forensics, not networking devices/appliances themselves]
Layered Approach for Preprocessing of Data in Intrusion Prevention SystemsEditor IJCATR
Due to extensive growth of the Internet and increasing availability of tools and methods for intruding and attacking
networks, intrusion detection has become a critical component of network security parameters. TCP/IP protocol suite is the defacto
standard for communication on the Internet. The underlying vulnerabilities in the protocols is the root cause of intrusions. Therefor
Intrusion detection system becomes an important element in network security that controls real time data and leads to huge
dimensional problem. Processing large number of packets and data in real time is very difficult and costly. Therefor data preprocessing
is necessary to remove redundant and unwanted information from packets and clean network data. Here, we are focusing on
two important aspects of intrusion detection; one is accuracy and other is performance. The layered approach of TCP/IP model can be
applied to packet pre-processing to achieve early and faster intrusion detection. Motivation for the paper comes from the large impact
data preprocessing has on the accuracy and capability of anomaly-based NIPS. In this paper it is demonstrated that high attack
detection accuracy can be achieved by using layered approach for data preprocessing in Internet. To reduce false positive rate and to
increase efficiency of detection, the paper proposed framework for preprocessing in intrusion prevention system. We experimented
with real time network traffic as well as he KDDcup99 dataset for our research.
The project entitled with “Network Security System” is related to hacking attacks in computer systems over internet. In today’s world many of the computer systems and servers are not secure because of increasing the hacking attacks or hackers with growing information, so information security specialist’s requirement has gone high.
A 1-day short course developed for visiting guests from Tecsup on network forensics, prepared in a day : ]
The requirements/constraints were 5-7 hours of content and that the target audience had very little forensic or networking knowledge. [For that reason, flow analysis was not included as an exercise, discussion of network monitoring solutions was limited, and the focus was on end-node forensics, not networking devices/appliances themselves]
Layered Approach for Preprocessing of Data in Intrusion Prevention SystemsEditor IJCATR
Due to extensive growth of the Internet and increasing availability of tools and methods for intruding and attacking
networks, intrusion detection has become a critical component of network security parameters. TCP/IP protocol suite is the defacto
standard for communication on the Internet. The underlying vulnerabilities in the protocols is the root cause of intrusions. Therefor
Intrusion detection system becomes an important element in network security that controls real time data and leads to huge
dimensional problem. Processing large number of packets and data in real time is very difficult and costly. Therefor data preprocessing
is necessary to remove redundant and unwanted information from packets and clean network data. Here, we are focusing on
two important aspects of intrusion detection; one is accuracy and other is performance. The layered approach of TCP/IP model can be
applied to packet pre-processing to achieve early and faster intrusion detection. Motivation for the paper comes from the large impact
data preprocessing has on the accuracy and capability of anomaly-based NIPS. In this paper it is demonstrated that high attack
detection accuracy can be achieved by using layered approach for data preprocessing in Internet. To reduce false positive rate and to
increase efficiency of detection, the paper proposed framework for preprocessing in intrusion prevention system. We experimented
with real time network traffic as well as he KDDcup99 dataset for our research.
Detecting and Preventing Attacks Using Network Intrusion Detection SystemsCSCJournals
Intrusion detection is an important technology in business sector as well as an active area of research. It is an important tool for information security. A Network Intrusion Detection System is used to monitor networks for attacks or intrusions and report these intrusions to the administrator in order to take evasive action. Today computers are part of networked; distributed systems that may span multiple buildings sometimes located thousands of miles apart. The network of such a system is a pathway for communication between the computers in the distributed system. The network is also a pathway for intrusion. This system is designed to detect and combat some common attacks on network systems. It follows the signature based IDs methodology for ascertaining attacks. A signature based IDS will monitor packets on the network and compare them against a database of signatures or attributes from known malicious threats. It has been implemented in VC++. In this system the attack log displays the list of attacks to the administrator for evasive action. This system works as an alert device in the event of attacks directed towards an entire network.
Network Forensics is scientifically proven technique to accumulate, perceive, identify, examine, associate, analyse and document digital evidence from multiple systems for the purpose of uncovering the fact of attacks and other problem incident as well as performing the action to recover from the attack. Many systems are proposed for designing the network forensic systems. In this paper we have prepared comparative analysis of various models based on different techniques.
Combating cyber security through forensic investigation toolsVenkata Sreeram
cyber security's important because it encompasses everything that pertains to protecting our sensitive data, personally identifiable information (PII), protected health information (PHI), personal information, intellectual property, data, and governmental and industry information systems from theft and damage attempted by criminals and adversaries.
Cyber security risk is increasing, driven by global connectivity and usage of cloud services, like Amazon Web Services, to store sensitive data and personal information. Widespread poor configuration of cloud services paired with increasingly sophisticated cyber criminals means the risk that your organization suffers from a successful cyber attack or data breach is on the rise.
Gone are the days of simple firewalls and antivirus software being your sole security measures. Business leaders can no longer leave information security to cyber security professionals.
THREATS are possible attacks.
It includes
The spread of computer viruses
Infiltration and theft of data from external hackers
Engineered network overloads triggered by malicious mass e-mailing
Misuse of computer resources and confidential information by employees
Unauthorized financial transactions and other kinds of computer fraud conducted in the company's name
Electronic inspection of corporate computer data by outside parties
Damage from failure, fire, or natural disasters
The development of intelligent network forensic tools to focus on specific type of network traffic analysis is a challenge in terms of future perspective.
This will reduce time delays, less computational resources requirement; minimize attacks, providing reliable and secured evidences, and efficient investigation with minimum efforts
Security Attack Analysis for Finding and Stopping Network AttacksSavvius, Inc
Network breaches are on the rise, and the consequences are getting more dire. Needless to say, you don't want to be the next Target.You've invested in security tools like firewalls and IPS systems. But today's stealthy attacks can still get through. When you suspect an attack, you need your insurance policy—network forensics.
In this seminar, you'll learn how network forensics—network recording along with powerful search and analysis tools—can enable your in-house security team to track down, verify, and characterize attacks.
You'll also learn about the requirements for effective forensics on today's 10G and 40G networks.
And you'll learn some best practices for configuring captures to help you and your team pinpoint and remediate anomalous behavior that could signal an attack.
FORTIFICATION OF HYBRID INTRUSION DETECTION SYSTEM USING VARIANTS OF NEURAL ...IJNSA Journal
Intrusion Detection Systems (IDS) form a key part of system defence, where it identifies abnormal
activities happening in a computer system. In recent years different soft computing based techniques have
been proposed for the development of IDS. On the other hand, intrusion detection is not yet a perfect
technology. This has provided an opportunity for data mining to make quite a lot of important
contributions in the field of intrusion detection. In this paper we have proposed a new hybrid technique
by utilizing data mining techniques such as fuzzy C means clustering, Fuzzy neural network / Neurofuzzy and radial basis function(RBF) SVM for fortification of the intrusion detection system. The
proposed technique has five major steps in which, first step is to perform the relevance analysis, and then
input data is clustered using Fuzzy C-means clustering. After that, neuro-fuzzy is trained, such that each
of the data point is trained with the corresponding neuro-fuzzy classifier associated with the cluster.
Subsequently, a vector for SVM classification is formed and in the last step, classification using RBF-
SVM is performed to detect intrusion has happened or not. Data set used is the KDD cup 1999 dataset
and we have used precision, recall, F-measure and accuracy as the evaluation metrics parameters. Our
technique could achieve better accuracy for all types of intrusions. The results of proposed technique are
compared with the other existing techniques. These comparisons proved the effectiveness of our
technique.
Analysis and Design for Intrusion Detection System Based on Data MiningPritesh Ranjan
Reference:
Dyuanyang Zhao, Zhilin Feng, Qingxiang Xu, “Analysis and design for Intrusion detection system based on data mining” in proceedings of 2010 IEEE second international workshop on education technology and computer science
Network traffic analysis with cyber securityKAMALI PRIYA P
We are students from SRM University pursuing B.TECH in Computer Science Department. We took a small initiative to make a PPT about how network traffic can be analyzed through Cyber Security. We have also mentioned the known network analyzers and future scope for network traffic analysis with cyber security.
Sniffing is the process of monitoring and capturing all the packets passing through a given network using sniffing tools. It is a form of “tapping phone wires” and get to know about the conversation. It is also called wiretapping applied to the computer networks.
There is so much possibility that if a set of enterprise switch ports is open, then one of their employees can sniff the whole traffic of the network. Anyone in the same physical location can plug into the network using Ethernet cable or connect wirelessly to that network and sniff the total traffic.
In other words, Sniffing allows you to see all sorts of traffic, both protected and unprotected. In the right conditions and with the right protocols in place, an attacking party may be able to gather information that can be used for further attacks or to cause other issues for the network or system owner.
Detecting and Preventing Attacks Using Network Intrusion Detection SystemsCSCJournals
Intrusion detection is an important technology in business sector as well as an active area of research. It is an important tool for information security. A Network Intrusion Detection System is used to monitor networks for attacks or intrusions and report these intrusions to the administrator in order to take evasive action. Today computers are part of networked; distributed systems that may span multiple buildings sometimes located thousands of miles apart. The network of such a system is a pathway for communication between the computers in the distributed system. The network is also a pathway for intrusion. This system is designed to detect and combat some common attacks on network systems. It follows the signature based IDs methodology for ascertaining attacks. A signature based IDS will monitor packets on the network and compare them against a database of signatures or attributes from known malicious threats. It has been implemented in VC++. In this system the attack log displays the list of attacks to the administrator for evasive action. This system works as an alert device in the event of attacks directed towards an entire network.
Network Forensics is scientifically proven technique to accumulate, perceive, identify, examine, associate, analyse and document digital evidence from multiple systems for the purpose of uncovering the fact of attacks and other problem incident as well as performing the action to recover from the attack. Many systems are proposed for designing the network forensic systems. In this paper we have prepared comparative analysis of various models based on different techniques.
Combating cyber security through forensic investigation toolsVenkata Sreeram
cyber security's important because it encompasses everything that pertains to protecting our sensitive data, personally identifiable information (PII), protected health information (PHI), personal information, intellectual property, data, and governmental and industry information systems from theft and damage attempted by criminals and adversaries.
Cyber security risk is increasing, driven by global connectivity and usage of cloud services, like Amazon Web Services, to store sensitive data and personal information. Widespread poor configuration of cloud services paired with increasingly sophisticated cyber criminals means the risk that your organization suffers from a successful cyber attack or data breach is on the rise.
Gone are the days of simple firewalls and antivirus software being your sole security measures. Business leaders can no longer leave information security to cyber security professionals.
THREATS are possible attacks.
It includes
The spread of computer viruses
Infiltration and theft of data from external hackers
Engineered network overloads triggered by malicious mass e-mailing
Misuse of computer resources and confidential information by employees
Unauthorized financial transactions and other kinds of computer fraud conducted in the company's name
Electronic inspection of corporate computer data by outside parties
Damage from failure, fire, or natural disasters
The development of intelligent network forensic tools to focus on specific type of network traffic analysis is a challenge in terms of future perspective.
This will reduce time delays, less computational resources requirement; minimize attacks, providing reliable and secured evidences, and efficient investigation with minimum efforts
Security Attack Analysis for Finding and Stopping Network AttacksSavvius, Inc
Network breaches are on the rise, and the consequences are getting more dire. Needless to say, you don't want to be the next Target.You've invested in security tools like firewalls and IPS systems. But today's stealthy attacks can still get through. When you suspect an attack, you need your insurance policy—network forensics.
In this seminar, you'll learn how network forensics—network recording along with powerful search and analysis tools—can enable your in-house security team to track down, verify, and characterize attacks.
You'll also learn about the requirements for effective forensics on today's 10G and 40G networks.
And you'll learn some best practices for configuring captures to help you and your team pinpoint and remediate anomalous behavior that could signal an attack.
FORTIFICATION OF HYBRID INTRUSION DETECTION SYSTEM USING VARIANTS OF NEURAL ...IJNSA Journal
Intrusion Detection Systems (IDS) form a key part of system defence, where it identifies abnormal
activities happening in a computer system. In recent years different soft computing based techniques have
been proposed for the development of IDS. On the other hand, intrusion detection is not yet a perfect
technology. This has provided an opportunity for data mining to make quite a lot of important
contributions in the field of intrusion detection. In this paper we have proposed a new hybrid technique
by utilizing data mining techniques such as fuzzy C means clustering, Fuzzy neural network / Neurofuzzy and radial basis function(RBF) SVM for fortification of the intrusion detection system. The
proposed technique has five major steps in which, first step is to perform the relevance analysis, and then
input data is clustered using Fuzzy C-means clustering. After that, neuro-fuzzy is trained, such that each
of the data point is trained with the corresponding neuro-fuzzy classifier associated with the cluster.
Subsequently, a vector for SVM classification is formed and in the last step, classification using RBF-
SVM is performed to detect intrusion has happened or not. Data set used is the KDD cup 1999 dataset
and we have used precision, recall, F-measure and accuracy as the evaluation metrics parameters. Our
technique could achieve better accuracy for all types of intrusions. The results of proposed technique are
compared with the other existing techniques. These comparisons proved the effectiveness of our
technique.
Analysis and Design for Intrusion Detection System Based on Data MiningPritesh Ranjan
Reference:
Dyuanyang Zhao, Zhilin Feng, Qingxiang Xu, “Analysis and design for Intrusion detection system based on data mining” in proceedings of 2010 IEEE second international workshop on education technology and computer science
Network traffic analysis with cyber securityKAMALI PRIYA P
We are students from SRM University pursuing B.TECH in Computer Science Department. We took a small initiative to make a PPT about how network traffic can be analyzed through Cyber Security. We have also mentioned the known network analyzers and future scope for network traffic analysis with cyber security.
Sniffing is the process of monitoring and capturing all the packets passing through a given network using sniffing tools. It is a form of “tapping phone wires” and get to know about the conversation. It is also called wiretapping applied to the computer networks.
There is so much possibility that if a set of enterprise switch ports is open, then one of their employees can sniff the whole traffic of the network. Anyone in the same physical location can plug into the network using Ethernet cable or connect wirelessly to that network and sniff the total traffic.
In other words, Sniffing allows you to see all sorts of traffic, both protected and unprotected. In the right conditions and with the right protocols in place, an attacking party may be able to gather information that can be used for further attacks or to cause other issues for the network or system owner.
Team research paper and project on network vulnerabilities with multiple attacks and defesnses:
Cybersecurity
-For this project, our class was paired with teams to attempt to find vulnerabilities in other teams networks and to successfully beach their network.
-My role in this group was to help breach other team vulnerabilities through different attacks like responder attacks, honeypots, etc.
-The main challenges of this project were trying to find the vulnerabilities successfully, as the whole team had troubles with each of our different attacks and defenses.
-We learned how to use cybersecurity tools to help find vulnerabilities in networks and how to protect against them better. For example, in the honeypot we used we deployed it to port 80, when the attacker tried to access our fake server we were notified. We also deployed palto alto firewall to create our private and secure network. For an attack, we also used password crackers like john the ripper. This project taught us how to breach networks as a team.
DEPLOYMENT OF INTRUSION PREVENTION SYSTEM ON MULTI-CORE PROCESSOR BASED SECUR...IJCNCJournal
After tightening up network perimeter for dealing with external threats, organizations have woken up to the
threats from inside Local Area Networks (LAN) over the past several years. It is thus important to design
and implement LAN security strategies in order to secure assets on LAN by filtering traffic and thereby
protecting them from malicious access and insider attacks. Banking Financial Services and Insurance
(BFSI) industry is one such segment that faces increased risks and security challenges. The typical
architecture of this segment includes several thousands of users connecting from various branches over
Wide Area Network (WAN) links crossing national and international boundaries with varying network
speed to access data center resources. The objective of this work is to deploy LAN security solution to
protect the data center located at headquarters from the end user machines. A LAN security solution should
ideally provide Network Access Control (NAC) along with cleaning (securing) the traffic going through it.
Traffic cleaning itself includes various features like firewall, intrusion detection/prevention, traffic anomaly
detection, validation of asset ownership etc. LANenforcer (LE) is a device deployed in front of the data
center such that the traffic from end-user machines necessarily passes through it so that it can enforce
security. The goal of this system is to enhance the security features of a LANenforcer security system with
Intrusion Prevention System (IPS) to enable it to detect and prevent malicious network activities. IPS is
plugged into the packet path based on the configuration in such a way that the entire traffic passes through
the IPS on LE.
A Data Hiding Techniques Based on Length of English Text using DES and Attack...IJORCS
The comparing recent proposal for multimedia applications network security remains an important topic for researchers. The security deals with both wired and wireless communication. Network is defined as it is a large system consisting of many similar parts that are connected together to allow the movement or communication between or along the parts or between the parts and a control center. There are the main components of the network information system such as end systems (terminals, servers) and intermediate systems (hubs, switches, gateways). Every node has its own set of vulnerabilities that can be related to hardware, software, protocol stack etc. Nodes are interconnected by physical supports in a network for example connected with cables in wired Local Area Network (LAN) or radio waves (Wi-Fi) in Wireless Local Area Network (WLAN). Some nodes are able to provide services (FTP, HTTP browsing, database access). If two nodes want to communicate together, they must be interconnected physically and logically. Network security deals with also information hiding technique. Now day’s security deals with heterogeneous networks. The use of different wireless and wired network which are working on different platform is heterogeneous. So design of network security for such type of heterogeneous network is difficult task.
Topic Since information extracted from router or switch interfaces.docxjuliennehar
Topic Since information extracted from router or switch interfaces to not provide specific evidence of a particular crime in most cases, what use is the information collected from these devices.
Read and respond to atleast two other students Discussions. (5-6 lines would be more sufficient)
#1.Posted by Srikanth
Routers and switches give the availability, both inside the demilitarized Zone (DMZ) environment and to different tareas of the system to which the DMZ is connected. This makes Routers and switches prime targets for hackers to exploit and gather data about the system or just use as springboards on other devices. This section presents data on the best way to information and arrange some significant router and switch security includes that enable run safely and ensure the devices that they associate. Routers direct traffic all through the undertaking system and are normally the first line of barrier when the system is associating with the Internet. Hackers try to infiltrate routers to gather data or use them as launching pads for further attacks. This is the reason it is critical to secure switches' management interfaces and services to make them trouble for an interloper to hack. Similarly as with routers, switches have an expanding job in system security. The switch gives numerous highlights, including port security. VLANs and PVLANs give the tools to keep the devices on the DMZ secure. It is additionally imperative to secure the switch's management interfaces and services with the goal that hackers can't break into the switch to change VLAN designs, change port settings, or utilize the switch to connect with different parts of the network.
Network forensics is capture, recording and analysis of network packets in order to determine the source of network security attacks. The major goal of network forensics is to collect evidence. It tries to analyze network traffic data, which is collected from different sites and different network equipment, such as firewalls and IDS. In addition, it monitors on the network to detect attacks and analyze the nature of attackers. Network forensics is also the process of detecting intrusion patterns, focusing on attacker activity.
Computer documents, emails, text and instant messages, transactions, images and Internet histories are examples of information that can be gathered from electronic devices and used very effectively as evidence. For example, mobile devices use online-based based backup systems, also known as the “cloud”, that provide forensic investigators with access to text messages and pictures taken from a particular phone. These systems keep an average of 1,000–1,500 or more of the last text messages sent to and received from that phone.In addition, many mobile devices store information about the locations where the device traveled and when it was there. To gain this knowledge, investigators can access an average of the last 200 cell locations accessed by a mobile device. Satellite navig ...
During the 1980s, most digital forensic investigations consisted of "live analysis", examining digital media directly using non-specialist tools. In the 1990s, several freeware and other proprietary tools (both hardware and software) were created to allow investigations to take place without modifying media. This first set of tools mainly focused on computer forensics, although in recent years similar tools have evolved for the field of mobile device forensics.[1] This list includes notable examples of digital forensic tools.
Kali Linux is a Debian-derived Linux distribution designed for digital forensics and penetration testing, formerly known as BackTrack.[2]
Parrot Security OS is a cloud-oriented GNU/Linux distribution based on Debian and designed to perform security and penetration tests, do forensic analysis, or act in anonymity. It uses the MATE Desktop Environment, Linux Kernel 4.6 or higher and it is available as a live lightweight installable ISO image for 32-bit, 64-bit and ARM processors with forensic options at boot, optimizations for programmers, and new custom pentesting tools
Types of Networks Week7 Part4-IS RevisionSu2013 .docxwillcoxjanay
Types of Networks
Week7 Part4-IS
RevisionSu2013
Types of Networks
There are different types of networks. Each type has different characteristics and
therefore different security needs. Some of the fundamental differentiating attributes of
the various types of networks are:
the physical distance the network spans
the topology of the network nodes
the types of media used for communication between nodes in the network
the different devices supported on the network
the different applications supported on the network
the different groups of users permitted on the network
the different protocols supported on each network
Depending on the type of network there may be different information security
requirements requiring that various protocols, security services, security mechanisms are
used in a fashion to support that type of network.
While each network environment has some characteristics and security needs unique to
that environment, there are many security techniques that should be universally applied to
all environments. For example; sound policies and procedures, risk assessment of the
assets, user awareness training, encryption technology, authentication technology, sound
credential (password) selection and protection, malware protection, firewalls are a few
security techniques that need to be applied in all of the networks albeit in configurations
that best suits a particular environment.
Local Area Network (LAN)
A LAN network covers a small geographic area that takes advantage of high speed data
transfers usually implemented through Ethernet or fiber. A LAN could be a home, office,
group of building with local proximity (university, business). LANs typically share
resources such as file servers and printers.
Wide Area Network (WAN)
A WAN covers a large geographic area that may require connection through satellite,
high speed dedicated lines and other means. The internet is a WAN. WANs can connect
LANs together into a larger organizational structure that can be used to share resources
such as file, email, dns servers to name a few. Resources can be shared using slower
connections on geographically separated areas across the WAN.
Wireless Networks and Mobile Networks
The movement to laptop systems at home and workplaces accelerated the mobility of
computing.
As employees traveled between offices, client sites, home and various other remote
locations they could remain connected to company servers as long as the remote site had
connectivity to the companies’ intranet. Initially this connectivity was provided by
having Ethernet cabling available for remote users to physically plug their laptops into.
Eventually, companies started installing wireless hotspots that could be automatically
detected by systems that had wireless cards.
The proliferation of wireless connectivity and internet use spread from the workplace to
genera ...
Whenyour computer isconnected to the Internet, you expose your computer to a variety of potentialthreats. The Internet isdesigned in such a waythat if you have access to the Internet, all other computers on the Internet canconnect to yourcomputer.Thisleavesyouvulnerable to variouscommonattacks. This isespeciallytroubling as severalpopular programs open services on your computer thatallowothers to view files on your computer! Whilethisfunctionalityisexpected, the difficultyisthatsecurityerrors are detectedthatalwaysallow hackers to attackyour computer with the ability to view or destroy sensitive information stored on your computer. To protectyour computer fromsuchattacksyouneed to "teach" your computer to ignore or resistexternaltestingattempts. The commonname for such a program is Firewall. A firewall is software thatcreates a secureenvironmentwhosefunctionis to block or restrictincoming and outgoing information over a network. These firewalls actually do not work and are not suitable for business premises to maintain information securitywhilesupporting free exchange of ideas. Firewall are becoming more and more sophisticated in the day, and new features are beingadded all the time, sothat, despitecriticism and intimidatingdevelopmentmethods, they are still a powerfuldefense. In thispaper, weread a network firewall thathelps the corporateenvironment and other networks thatwant to exchange information over the network. The firewall protects the flow of trafficthrough the internet and limits the amount of external and internal information and provides the internal user with the illusion of anonymous FTP and www online communications.
2. Performing Reconnaissance and Probing Using
Common Tools
(2015)
Juanita M. McConnell
Computer Network Systems
ITT Technical Institute, Philadelphia, PA 19106
Contact:
JMcConnell152@email.itt-tech.edu
3. Cybercriminals and hackers have a great advantage over Information Technology (IT)
Professionals specializing in Security. Unlike IT security experts hackers do not need to
study networks and networking protocols in great depth. They typically have to make one
clean attack on a network to do damage, i.e. one vulnerability or knowledge of a tool that
attacks specific vulnerabilities.
Approximately every two years, IT routinely changes to prevent attacks and improve
manageability. Patches and updates are performed on computer hardware and software, on
the seemingly daily or weekly basis. IT is a field that will forever be on developmental
mode. This adversity does not stop thousands of workers from entering the field each year.
Similar to police officers, medical professionals, and especially the military who combat
hardships on a defensive front everyday, IT experts are committed to protecting liberty,
prosperity and assets in our technological world.
4. When cybercriminals and hackers attempt to attack a network, they engage in what can be described
as a 5-step method which includes:
Reconnaissance – Choosing or identifying a target and gathering
any available information.
Scanning – Using tools to scan a network and monitoring
the connection.
Vulnerability Analysis – Preparing for the attack ~ the when, the where,
the how and what to be gained.
Exploitation – The actual attack.
Post-Activities – Gathering and/or distributing data, assets or
preparing for additional harmful attacks such as
a backdoor to a system.
5. The focus of this project is Reconnaissance.
Reconnaissance is the process in which hackers identify a target and acquire
any and all information about the target. They will scan a network to identify
Internet Protocol (IP) hosts, open ports, and services, enabled on servers and
work stations.
In this project, I identify several common programs that hackers use to
identify vulnerabilities in a given network.
Focus
6. Learning Objectives and Outcomes
5. Explain how attackers use common network scanning and analysis tools to
compromise networks.
1. Explore common network scanning and analysis tools.
2. Perform network reconnaissance and probing on the machines in the Virtual
Security Cloud Lab (VSCL).
3. Use Zenmap to perform an Intense scan on a entire subnetwork (172.30.0/24).
4. Create a Fisheye Bubble Chart to explain the relationships between devices on a
network.
8. Wireshark is a protocol analyzer tool, also known as a
“packet sniffer.” It is used to aid other programs in capturing
Internet Protocol (IP) traffic.
Wireshark
A packet is the unit of data that is travels from one place to another on the Internet.
9. • A data analyst will use
Wireshark to ping a
network and subsequently
capture traffic packets
using Internet Control
Message Protocol
(ICMP).
• In this screen capture, I
was able to show data
traffic using a Virtual
Student Cloud
Environment on network
172.30.0.10.
Capturing Traffic Packets on a Network
10. NetWitness Investigator is an application that allows you to view, analyze, and
compare packets captured by Wireshark and other similar traffic monitoring
programs. It can recognize and order IP addresses, Web addresses, E-mail addresses,
User accounts, and actions such as logins, sendtos, sendfroms, attachments etc.
NetWitness Investigator
11. OpenVAS
OpenVAS is a program that performs remote scans and audits of systems like
UNIX, network infrastructures. It can also perform network discovery on
operating systems, databases, devices, applications, and services running on
theses systems. It is furnished with a Greenbone Security Assistant program
guide for ease of use.
12. FileZilla
FileZilla is an application that is used to transfer files using File Transfer
Protocol (FTP) on remote workstations.
13. Tftpd64
Tftpd64 is another application that is used to transfer files using File Transfer
Protocol (FTP) on remote workstations.
14. PuTTy
PuTTY is another type of file transfer application, terminal emulator, and serial
console. PuTTY uses the Secure Shell (SSH) protocol to access remote
computer in a secure fashion. The Linux Command terminal shell window is
launched upon connection. The following images depict command-line access
on the Linux and Cisco terminals and a PuTTY configuration window.
15. Zenmap
Zenmap is program that scans networks
and performs a targeted IP subnetwork
Intense Scan which identifies what hosts are
available on the network including services
such as applications (name and version),
operating systems (name and version) and
what security features are in place including
packet filters and fire walls.
The image features a ZenMap ping Scan.
A host is a system that contains data. Also defined as a computer or electronic
device that has, sends, or receives information over the Internet.
16. Fisheye Bubble Topology Chart
of IP Hosts on Network 172.30.0.10.
• A bubble chart is a type of graph used to show
relationships, by size, of different variables across
an XY axis.
• A fisheye lens is a tool that can be used to change
the shape and orientation of the graph.
• A fisheye bubble chart combines the two features.
This topology identifies the hosts on network 172.30.0.10 and the level of activity from each host
in relation to one another. Activity includes several variables across the XY axis i.e. Web
addresses, E-mail addresses, User Accounts, and actions such as logins, sendtos, sendfroms,
attachments etc. Network 172.30.0.10 has the greatest threats followed by the networks with
yellow circles, followed by the ones with green circles.
17. Summary
There are many programs to use when scanning a network for vulnerabilities. I have identified several
applications and programs including WireShark, NetWitness Investigator, OpenVAS, FileZilla, Tftpd64,
PuTTy, Zenmap. These programs are used interchangeably to handle different functions of the scanning
process.
First, WireShark is used to take a detailed picture or scan of a given network. Second, the files that
Wireshark has gathered are then analyzed by programs such as NetWitness Investigator to identify
vulnerabilities into more easily recognizable terms such as, web addresses, email addresses, users
accounts etc.
OpenVAS is a program that is able to scan networks from a remote location. Secondary programs such
as FileZilla and Tftpd64 are able to transfer files collected by OpenVAS in a secure manner.
18. Summary continued…
PuTTY is another file transfer program that is able work across the board in terms of different
operating systems like Windows and various version of Linux. PuTTy uses Linux command terminals
and Cisco operating systems to fulfill its versatile capabilities in file transfers.
Last but not least is Zenmap, which is a program designed to scan networks revealing specific
program names and versions Zenmap is even able to expose precise information about network
firewalls!
The use of topology charts such as Fisheye charts are an easy tool to use when presenting network
findings in a meeting.
Identifying common network scanning tools and how to use them is a great start to protecting a
network. If at any time a data analyst is able to find vulnerabilities before a cybercriminal or hacker
does than, that is a day for a short celebration and boost of energy for the next challenge.
19. THE END
Author Note
Juanita M. McConnell, Computer Network Systems, ITT Technical Institute.
Juanita McConnell is a student at ITT Technical Institute studying Computer
Networking, Computer Infrastructure and Computer Programming.
Correspondence concerning this PowerPoint should be addressed to
Juanita McConnell,
Computer Network Systems,
ITT Technical Institute, 105 South 7th St., Suite 100 Philadelphia, PA 19106
Contact: JMcConnell152@email.itt-tech.edu
Introduction to Information Systems Security (IT255P)
Performing Reconnaissance and Probing Using Common Tools
(2015)
The information used in this presentation was derived from Lab Assignment Reconnaissance
by ITT Technical Institute IT255P course curriculum.