Re: IPhone and nmap scan on wireless network

["Jaime Reza" <turinreza () gmail com>]

I tried this against a regular iphone

http://dmiessler.com/blog/how-a-default-iphone-113-looks-to-nmap-350
nmap.exe -p 1-65535 -sV -O 177.17.1.12

doesn't seem to be working... just stuck

i then tried

nmap.exe -v  -sV -O -A -T Insane -p 1-65535 177.17.1.12

Note: Host seems down. If it is really up, but blocking our ping probes, try
-PN

i tried that but it doesn't get past the ping
Nmap done: 1 IP address (0 hosts up) scanned in 0.641 seconds
           Raw packets sent: 2 (84B) | Rcvd: 0 (0B)

no received..

any thoughts?

On Thu, Apr 10, 2008 at 2:55 PM, Brandon Enright <bmenrigh () ucsd edu> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Thu, 10 Apr 2008 13:08:10 -0700
> "Jaime Reza" <turinreza () gmail com> wrote:
>
> > hiya
> > anyone tried to fingerprint /scan an iphone that is hooked up to  a
> > wireless network?
> > i can see my iphone on the wireless network and it has an ip address
> > but it's not being picked up by nmap (no packets received)
> >
> > -PN
> >
> > turin
>
> Sure; do it all the time.  We have so many of these on campus that we
> have to really stay on top of unlocked iPhones with OpenSSH installed
> that still have the default root password.
>
> I don't have any example scans for you right now but here is the logic
> in one of my scripts that finds iPhones and alerts me when they are
> running SSH:
>
>    # iPhone (based on port open and weak TCP Sequence Prediction)
>    if ((exists $misc{'TCPSeqPred'}) &&
>        ($misc{'TCPSeqPred'} == 0) &&
>        (exists $port{62078}) &&
>        ($port{62078}{'Service'} eq 'tcpwrapped')) {
>        push @warning, {('name'=>'IPHONE',
>                         'severity'=>2,
>                         'text'=>'iPhone (weak TCP sequence'
>                         . ' is easily hackable)')};
>
>        # Detect possible SSH on iPhone
>        if ((exists $port{22}) &&
>            ($port{22}{'Service'} eq 'ssh')) {
>            push @warning, {('name'=>'IPHONE_SSH',
>                             'severity'=>3,
>                             'text'=>'iPhone may have known '
>                             . 'default root password (\'alpine\')')};
>        }
>    }
>
>
> Note that the check for TCPSeqPred == 0 requires -O or -A and the port
> 62078 eq 'tcpwrapped' requires -sV or -A.  This code was written before
> the OS DB had a iPhone fingerprint so you'd probably do better now to
> check the OS Nmap says it is running.
>
> It would be very easy to turn the above code into a hostrule NSE
> script.  I haven't because while the check works, it's a hack.
>
> How often does someone run OpenSSH on their phone without changing the
> root password, you ask?  All the ****ing time.  We've found the check
> to be _very_ valuable.
>
> Brandon
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.7 (GNU/Linux)
>
> iD8DBQFH/ozbqaGPzAsl94IRAkhxAKC/UaHlqbLTpvxp/eyDLbGuZrwSvQCfcNcG
> XPIZbCD7Eo7y0SanTEst0FA=
> =IsO2
> -----END PGP SIGNATURE-----

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org