mailing list archives
Re: analysis of auditable port scanning techniques
From: Dan Harkless <dan-bugtraq () DILVISH SPEED NET>
Date: Thu, 4 Jan 2001 20:32:01 -0800
Guido Bakker <guidob () sentia nl> writes:
1.2.1 - reverse ident scanning
This technique involves issuing a response to the ident/auth daemon,
usually port 113 to query the service for the owner of the running
process. The main reason behind this is to find daemons running as root,
obviously this result would entice an intruder to find a vulnerable
overflow and instigate other suspicious activities involving this
port. Alternatively, a daemon running as user nobody (httpd) may not be as
attractive to a user because of limited access privileges. Unknowing to
most users is that identd could release miscellaneous private information
* user info
Although the identification protocol would appear as an authentication
mechanism, it was not designed or intended for this purpose. As the RFC
states, "At best, it provides some additional auditing information with
respect to TCP connections". Needless to say, it should not be used as an
access control service nor relied upon added host/username authenticity.
The formal syntax taken from RFC 1413 reveals the following EBNF:
<request> ::= <port-pair> <EOL>
<port-pair> ::= <integer> "," <integer>
<EOL> ::= "015 012" ; CR-LF End of Line Indicator, octal \r\n
<integer> ::= 1*5<digit> ; 1-5 digits.
Using this grammar applied to the data we send to an arbitrary host piped
to the ident/auth port will reveal the process owner running on a given
port, even though we initiated the connection.
Uh, no. With properly-written ident daemons, such as pidentd, the dameon
will only respond for connections initiated on the machine on which it's
running, and with a destination of the machine querying the daemon. Do you
have examples of ident daemons that don't enforce this?
Notoriously, the SYN method was first used to avoid a well used IDS, named
Eh? SATAN was a security scanner, not an intrusion detection system...
Dan Harkless | To prevent SPAM contamination, please
dan-bugtraq () dilvish speed net | do not mention this private email
SpeedGate Communications, Inc. | address in Usenet posts. Thank you.
Re: analysis of auditable port scanning techniques John Ladwig (Jan 08)