- Our goal with Banner Grabbing,
is to deduce information about two things.
One is the service that's running.
And secondly, the operating system that,
that service is running on.
Why do I say that?
So if we can deduce that it is OpenSSH version 3.2,
running on Red Hat enterprise Linux from 10 years ago,
what are the chances a vulnerability exists,
in either that old version of OpenSSH
or the operating system that it's running on?
Then we consult vulnerability databases,
we find something matching OpenSSH,
version three dot whatever,
and or Red Hat enterprise Linux version, long time ago
and maybe we get access based on that information.
So there's two different ways to grab this information,
that is the Banner, so we have active and passive.
With Active Banner Grabbing,
what we're going to do is actually connect to the service
and try to extract that information,
by querying it or maybe just upon connection it tells you,
as is the case with OpenSSH.
And then secondly, we have Passive Banner Grabbing.
With Passive Banner Grabbing,
we're going to sniff the network, capture the packets
and see if we can find when that session was established,
that banner information.
So let's take a look at this.
With active banner grabbing, we see an example right here.
We ran the command, telnet to 10.1.1.10 on port 22.
So telnet is primarily used TCP port 23
and it's just for remote administration.
It's rarely used these days,
because of its unencrypted method of communicating.
If you were to capture a telnet session,
you could see every character that was typed,
every username and password that was typed,
so a lot of good information in telnet sessions.
So with Active Banner Grabbing,
we're using the telnet command,
which simply takes bytes from the keyboard
and spits them out across a network socket,
to something on the other end
and we can use that to grab this information.
So we're connecting to port 22 and OpenSSH by default,
will output the version of OpenSSH that's running.
So I run it on Ubuntu, OpenSSH 7.2P2.
What vulnerabilities exist in open SSH 7.2P2,
running on a Ubuntu, that's where we go,
take a look at those vulnerability databases
and see what we can find out.
Here's another example.
In this case, we're going to use telnet, to figure out,
the version web server software that's running.
So we're going to telnet to example.com on port 80
and the HTTP protocol has different verbs,
that are available too.
You have GET, PUT, POST, DELETE, things like that.
In this case, we're going to execute,
GET/HTTP/1.1, host, example.com, hit the inner key twice
and that empty line delimiter,
tells the HTTP server that we're done,
with what we've wanted to type
and it will return a response as HTTP should.
It is operating as it's expected to.
It returns HTP 1.1, 200, okay, you made a valid request,
HTTP response 200 is a valid request.
We have a whole bunch of information,
that comes from the server.
One piece of information,
that's particularly important is the server header.
In this case, we see it is running on AWS ECS,
that's Amazon Web Services Elastic Container Store,
in San Jose.
So we even know the physical locality,
of this particular container running on AWS ECS.
You can do this with Netcat as well.
So Netcat is similar to telnet,
in that it will take what you do on the keyboard
and send it across the network.
The net is network cat, like the cat command,
in various Unix systems out there, concatenate.
So with Netcat what you type, goes across the network,
provided you have an established session.
So here we're running Netcat to web.com on port 80,
we send that same GET verb, with the path that we want
and HTTP version, host, web.com.
And we can see here that it is running on CloudFlare.
We can do this with Nmap as well.
So Nmap has a plugin script called Banner.
So we have a scan version, port 80 to doohickey.com.
And it deduces that the version of web that's run
or web server software,
that's running on the system, is Apache.
We can also look at file extensions.
So in this screenshot right here, I'm running Chrome
and with Chrome developer tools on that network tab,
I can actually see the files that are being requested.
So right over here, we see default.aspx,
that's an active server page,
so we know it's IIS in this case.
What can we do to protect ourselves from our services
and particularly web servers in the case of this slide,
how can we protect our web servers,
from divulging this information?
Apache, if you're running Apache,
gives you options to protect against it.
We have Server Signature Off, Server Tokens Production,
we can see the explanations over here,
it'll only return Apache in the server header.
You can also manually change what is returned,
in the server header set Server CheetOS version 1.2.
When that GET command is run,
that's where we're going to see, CheetOS 1.2.
For internet information server from Microsoft,
there is a lockdown wizard,
you can search on microsoft.com to get access to that.