02/28 - A description on how to use the Firewalk network tool

Firewalk is an active reconnaissance network security tool that attempts to determine what layer 4 protocols a given IP forwarding device will pass. Firewalk works by sending out TCP or UDP packets with a TTL one greater than the targeted gateway. If the gateway allows the traffic, it will forward the packets to the next hop where they will expire and elicit an ICMP_TIME_EXCEEDED message. If the gateway host does not allow the traffic, it will likely drop the packets on the floor and we will see no response.

To get the correct IP TTL that will result in expired packets one beyond the gateway we need to ramp up hop-counts. We do this in the same manner that traceroute works. Once we have the gateway hopcount (at that point the scan is said to be `bound`) we can begin our scan.

It is significant to note the fact that the ultimate destination host does not have to be reached. It just needs to be somewhere downstream, on the other side of the gateway, from the scanning host.

Here is the usage information:
Firewalk 5.0 [gateway ACL scanner]
Usage : firewalk [options] target_gateway metric
[-d 0 - 65535] destination port to use (ramping phase)
[-h] program help
[-i device] interface
[-n] do not resolve IP addresses into hostnames
[-p TCP | UDP] firewalk protocol
[-r] strict RFC adherence
[-S x - y, z] port range to scan
[-s 0 - 65535] source port
[-T 1 - 1000] packet read timeout in ms
[-t 1 - 25] IP time to live
[-v] program version
[-x 1 - 8] expire vector

And here is an example on how to use it. We first do a traceroute to www.google.com
[me@host ~]$ traceroute -n www.google.com
traceroute: Warning: www.google.com has multiple addresses; using 66.249.91.103
traceroute to www.l.google.com (66.249.91.103), 30 hops max, 38 byte packets
1 * * *
2 * * *
3 195.69.144.247 0.959 ms 1.102 ms 0.933 ms
4 209.85.248.88 0.957 ms 1.325 ms 209.85.248.93 1.106 ms
5 64.233.175.246 3.876 ms 209.85.248.79 3.908 ms 3.772 ms
6 72.14.233.77 5.032 ms 4.967 ms 5.123 ms
7 66.249.94.146 8.294 ms 7.444 ms 7.198 ms
8 66.249.91.103 5.305 ms 5.328 ms 5.375 ms

So now we will look which ports are not filtered by the last hop (6.249.94.146):
[me@host ~]# firewalk -n -p tcp -s 80 -d 80 66.249.94.146 66.249.91.103
Firewalk 5.0 [gateway ACL scanner]
Firewalk state initialization completed successfully.
TCP-based scan.
Ramping phase source port: 80, destination port: 80
Hotfoot through 66.249.94.146 using 66.249.91.103 as a metric.
Ramping Phase:
1 (TTL 1): *no response*
2 (TTL 2): *no response*
3 (TTL 3): expired [195.69.144.247]
4 (TTL 4): expired [209.85.248.88]
5 (TTL 5): expired [209.85.248.79]
6 (TTL 6): expired [72.14.233.77]
7 (TTL 7): expired [66.249.94.146]
Binding host reached.
Scan bound at 8 hops.
Scanning Phase:
port 1: *no response*
port 2: *no response*
.
.
port 79: *no response*
port 80: A! open (port listen) [66.249.91.103]
port 81: *no response*
.
.
port 112: *no response*
port 113: A! open (port not listen) [66.249.91.103]
port 114: *no response*
.
.
port 1025: *no response*

Scan completed successfully.

Total packets sent: 139
Total packet errors: 0
Total packets caught 20
Total packets caught of interest 8
Total ports scanned 132
Total ports open: 2
Total ports unknown: 0

So we see that the router before www.google.com will allow access to www.google.com on port 80 and port 113, although port 113 is not listening on the host www.google.com.

View the original article here

This post was made using the Auto Blogging Software from WebMagnates.org This line will not appear when posts are made after activating the software to full version.

02/28 - A description on how to use the Firewalk network tool

Firewalk is an active reconnaissance network security tool that attempts to determine what layer 4 protocols a given IP forwarding device will pass. Firewalk works by sending out TCP or UDP packets with a TTL one greater than the targeted gateway. If the gateway allows the traffic, it will forward the packets to the next hop where they will expire and elicit an ICMP_TIME_EXCEEDED message. If the gateway host does not allow the traffic, it will likely drop the packets on the floor and we will see no response.

To get the correct IP TTL that will result in expired packets one beyond the gateway we need to ramp up hop-counts. We do this in the same manner that traceroute works. Once we have the gateway hopcount (at that point the scan is said to be `bound`) we can begin our scan.

It is significant to note the fact that the ultimate destination host does not have to be reached. It just needs to be somewhere downstream, on the other side of the gateway, from the scanning host.

Here is the usage information:
Firewalk 5.0 [gateway ACL scanner]
Usage : firewalk [options] target_gateway metric
[-d 0 - 65535] destination port to use (ramping phase)
[-h] program help
[-i device] interface
[-n] do not resolve IP addresses into hostnames
[-p TCP | UDP] firewalk protocol
[-r] strict RFC adherence
[-S x - y, z] port range to scan
[-s 0 - 65535] source port
[-T 1 - 1000] packet read timeout in ms
[-t 1 - 25] IP time to live
[-v] program version
[-x 1 - 8] expire vector

And here is an example on how to use it. We first do a traceroute to www.google.com
[me@host ~]$ traceroute -n www.google.com
traceroute: Warning: www.google.com has multiple addresses; using 66.249.91.103
traceroute to www.l.google.com (66.249.91.103), 30 hops max, 38 byte packets
1 * * *
2 * * *
3 195.69.144.247 0.959 ms 1.102 ms 0.933 ms
4 209.85.248.88 0.957 ms 1.325 ms 209.85.248.93 1.106 ms
5 64.233.175.246 3.876 ms 209.85.248.79 3.908 ms 3.772 ms
6 72.14.233.77 5.032 ms 4.967 ms 5.123 ms
7 66.249.94.146 8.294 ms 7.444 ms 7.198 ms
8 66.249.91.103 5.305 ms 5.328 ms 5.375 ms

So now we will look which ports are not filtered by the last hop (6.249.94.146):
[me@host ~]# firewalk -n -p tcp -s 80 -d 80 66.249.94.146 66.249.91.103
Firewalk 5.0 [gateway ACL scanner]
Firewalk state initialization completed successfully.
TCP-based scan.
Ramping phase source port: 80, destination port: 80
Hotfoot through 66.249.94.146 using 66.249.91.103 as a metric.
Ramping Phase:
1 (TTL 1): *no response*
2 (TTL 2): *no response*
3 (TTL 3): expired [195.69.144.247]
4 (TTL 4): expired [209.85.248.88]
5 (TTL 5): expired [209.85.248.79]
6 (TTL 6): expired [72.14.233.77]
7 (TTL 7): expired [66.249.94.146]
Binding host reached.
Scan bound at 8 hops.
Scanning Phase:
port 1: *no response*
port 2: *no response*
.
.
port 79: *no response*
port 80: A! open (port listen) [66.249.91.103]
port 81: *no response*
.
.
port 112: *no response*
port 113: A! open (port not listen) [66.249.91.103]
port 114: *no response*
.
.
port 1025: *no response*

Scan completed successfully.

Total packets sent: 139
Total packet errors: 0
Total packets caught 20
Total packets caught of interest 8
Total ports scanned 132
Total ports open: 2
Total ports unknown: 0

So we see that the router before www.google.com will allow access to www.google.com on port 80 and port 113, although port 113 is not listening on the host www.google.com.

View the original article here

This post was made using the Auto Blogging Software from WebMagnates.org This line will not appear when posts are made after activating the software to full version.

02/28 - A description on how to use the Firewalk network tool

Firewalk is an active reconnaissance network security tool that attempts to determine what layer 4 protocols a given IP forwarding device will pass. Firewalk works by sending out TCP or UDP packets with a TTL one greater than the targeted gateway. If the gateway allows the traffic, it will forward the packets to the next hop where they will expire and elicit an ICMP_TIME_EXCEEDED message. If the gateway host does not allow the traffic, it will likely drop the packets on the floor and we will see no response.

To get the correct IP TTL that will result in expired packets one beyond the gateway we need to ramp up hop-counts. We do this in the same manner that traceroute works. Once we have the gateway hopcount (at that point the scan is said to be `bound`) we can begin our scan.

It is significant to note the fact that the ultimate destination host does not have to be reached. It just needs to be somewhere downstream, on the other side of the gateway, from the scanning host.

Here is the usage information:
Firewalk 5.0 [gateway ACL scanner]
Usage : firewalk [options] target_gateway metric
[-d 0 - 65535] destination port to use (ramping phase)
[-h] program help
[-i device] interface
[-n] do not resolve IP addresses into hostnames
[-p TCP | UDP] firewalk protocol
[-r] strict RFC adherence
[-S x - y, z] port range to scan
[-s 0 - 65535] source port
[-T 1 - 1000] packet read timeout in ms
[-t 1 - 25] IP time to live
[-v] program version
[-x 1 - 8] expire vector

And here is an example on how to use it. We first do a traceroute to www.google.com
[me@host ~]$ traceroute -n www.google.com
traceroute: Warning: www.google.com has multiple addresses; using 66.249.91.103
traceroute to www.l.google.com (66.249.91.103), 30 hops max, 38 byte packets
1 * * *
2 * * *
3 195.69.144.247 0.959 ms 1.102 ms 0.933 ms
4 209.85.248.88 0.957 ms 1.325 ms 209.85.248.93 1.106 ms
5 64.233.175.246 3.876 ms 209.85.248.79 3.908 ms 3.772 ms
6 72.14.233.77 5.032 ms 4.967 ms 5.123 ms
7 66.249.94.146 8.294 ms 7.444 ms 7.198 ms
8 66.249.91.103 5.305 ms 5.328 ms 5.375 ms

So now we will look which ports are not filtered by the last hop (6.249.94.146):
[me@host ~]# firewalk -n -p tcp -s 80 -d 80 66.249.94.146 66.249.91.103
Firewalk 5.0 [gateway ACL scanner]
Firewalk state initialization completed successfully.
TCP-based scan.
Ramping phase source port: 80, destination port: 80
Hotfoot through 66.249.94.146 using 66.249.91.103 as a metric.
Ramping Phase:
1 (TTL 1): *no response*
2 (TTL 2): *no response*
3 (TTL 3): expired [195.69.144.247]
4 (TTL 4): expired [209.85.248.88]
5 (TTL 5): expired [209.85.248.79]
6 (TTL 6): expired [72.14.233.77]
7 (TTL 7): expired [66.249.94.146]
Binding host reached.
Scan bound at 8 hops.
Scanning Phase:
port 1: *no response*
port 2: *no response*
.
.
port 79: *no response*
port 80: A! open (port listen) [66.249.91.103]
port 81: *no response*
.
.
port 112: *no response*
port 113: A! open (port not listen) [66.249.91.103]
port 114: *no response*
.
.
port 1025: *no response*

Scan completed successfully.

Total packets sent: 139
Total packet errors: 0
Total packets caught 20
Total packets caught of interest 8
Total ports scanned 132
Total ports open: 2
Total ports unknown: 0

So we see that the router before www.google.com will allow access to www.google.com on port 80 and port 113, although port 113 is not listening on the host www.google.com.

View the original article here

This post was made using the Auto Blogging Software from WebMagnates.org This line will not appear when posts are made after activating the software to full version.

02/28 - A description on how to use the Firewalk network tool

Firewalk is an active reconnaissance network security tool that attempts to determine what layer 4 protocols a given IP forwarding device will pass. Firewalk works by sending out TCP or UDP packets with a TTL one greater than the targeted gateway. If the gateway allows the traffic, it will forward the packets to the next hop where they will expire and elicit an ICMP_TIME_EXCEEDED message. If the gateway host does not allow the traffic, it will likely drop the packets on the floor and we will see no response.

To get the correct IP TTL that will result in expired packets one beyond the gateway we need to ramp up hop-counts. We do this in the same manner that traceroute works. Once we have the gateway hopcount (at that point the scan is said to be `bound`) we can begin our scan.

It is significant to note the fact that the ultimate destination host does not have to be reached. It just needs to be somewhere downstream, on the other side of the gateway, from the scanning host.

Here is the usage information:
Firewalk 5.0 [gateway ACL scanner]
Usage : firewalk [options] target_gateway metric
[-d 0 - 65535] destination port to use (ramping phase)
[-h] program help
[-i device] interface
[-n] do not resolve IP addresses into hostnames
[-p TCP | UDP] firewalk protocol
[-r] strict RFC adherence
[-S x - y, z] port range to scan
[-s 0 - 65535] source port
[-T 1 - 1000] packet read timeout in ms
[-t 1 - 25] IP time to live
[-v] program version
[-x 1 - 8] expire vector

And here is an example on how to use it. We first do a traceroute to www.google.com
[me@host ~]$ traceroute -n www.google.com
traceroute: Warning: www.google.com has multiple addresses; using 66.249.91.103
traceroute to www.l.google.com (66.249.91.103), 30 hops max, 38 byte packets
1 * * *
2 * * *
3 195.69.144.247 0.959 ms 1.102 ms 0.933 ms
4 209.85.248.88 0.957 ms 1.325 ms 209.85.248.93 1.106 ms
5 64.233.175.246 3.876 ms 209.85.248.79 3.908 ms 3.772 ms
6 72.14.233.77 5.032 ms 4.967 ms 5.123 ms
7 66.249.94.146 8.294 ms 7.444 ms 7.198 ms
8 66.249.91.103 5.305 ms 5.328 ms 5.375 ms

So now we will look which ports are not filtered by the last hop (6.249.94.146):
[me@host ~]# firewalk -n -p tcp -s 80 -d 80 66.249.94.146 66.249.91.103
Firewalk 5.0 [gateway ACL scanner]
Firewalk state initialization completed successfully.
TCP-based scan.
Ramping phase source port: 80, destination port: 80
Hotfoot through 66.249.94.146 using 66.249.91.103 as a metric.
Ramping Phase:
1 (TTL 1): *no response*
2 (TTL 2): *no response*
3 (TTL 3): expired [195.69.144.247]
4 (TTL 4): expired [209.85.248.88]
5 (TTL 5): expired [209.85.248.79]
6 (TTL 6): expired [72.14.233.77]
7 (TTL 7): expired [66.249.94.146]
Binding host reached.
Scan bound at 8 hops.
Scanning Phase:
port 1: *no response*
port 2: *no response*
.
.
port 79: *no response*
port 80: A! open (port listen) [66.249.91.103]
port 81: *no response*
.
.
port 112: *no response*
port 113: A! open (port not listen) [66.249.91.103]
port 114: *no response*
.
.
port 1025: *no response*

Scan completed successfully.

Total packets sent: 139
Total packet errors: 0
Total packets caught 20
Total packets caught of interest 8
Total ports scanned 132
Total ports open: 2
Total ports unknown: 0

So we see that the router before www.google.com will allow access to www.google.com on port 80 and port 113, although port 113 is not listening on the host www.google.com.

View the original article here

This post was made using the Auto Blogging Software from WebMagnates.org This line will not appear when posts are made after activating the software to full version.

02/28 - A description on how to use the Firewalk network tool

Firewalk is an active reconnaissance network security tool that attempts to determine what layer 4 protocols a given IP forwarding device will pass. Firewalk works by sending out TCP or UDP packets with a TTL one greater than the targeted gateway. If the gateway allows the traffic, it will forward the packets to the next hop where they will expire and elicit an ICMP_TIME_EXCEEDED message. If the gateway host does not allow the traffic, it will likely drop the packets on the floor and we will see no response.

To get the correct IP TTL that will result in expired packets one beyond the gateway we need to ramp up hop-counts. We do this in the same manner that traceroute works. Once we have the gateway hopcount (at that point the scan is said to be `bound`) we can begin our scan.

It is significant to note the fact that the ultimate destination host does not have to be reached. It just needs to be somewhere downstream, on the other side of the gateway, from the scanning host.

Here is the usage information:
Firewalk 5.0 [gateway ACL scanner]
Usage : firewalk [options] target_gateway metric
[-d 0 - 65535] destination port to use (ramping phase)
[-h] program help
[-i device] interface
[-n] do not resolve IP addresses into hostnames
[-p TCP | UDP] firewalk protocol
[-r] strict RFC adherence
[-S x - y, z] port range to scan
[-s 0 - 65535] source port
[-T 1 - 1000] packet read timeout in ms
[-t 1 - 25] IP time to live
[-v] program version
[-x 1 - 8] expire vector

And here is an example on how to use it. We first do a traceroute to www.google.com
[me@host ~]$ traceroute -n www.google.com
traceroute: Warning: www.google.com has multiple addresses; using 66.249.91.103
traceroute to www.l.google.com (66.249.91.103), 30 hops max, 38 byte packets
1 * * *
2 * * *
3 195.69.144.247 0.959 ms 1.102 ms 0.933 ms
4 209.85.248.88 0.957 ms 1.325 ms 209.85.248.93 1.106 ms
5 64.233.175.246 3.876 ms 209.85.248.79 3.908 ms 3.772 ms
6 72.14.233.77 5.032 ms 4.967 ms 5.123 ms
7 66.249.94.146 8.294 ms 7.444 ms 7.198 ms
8 66.249.91.103 5.305 ms 5.328 ms 5.375 ms

So now we will look which ports are not filtered by the last hop (6.249.94.146):
[me@host ~]# firewalk -n -p tcp -s 80 -d 80 66.249.94.146 66.249.91.103
Firewalk 5.0 [gateway ACL scanner]
Firewalk state initialization completed successfully.
TCP-based scan.
Ramping phase source port: 80, destination port: 80
Hotfoot through 66.249.94.146 using 66.249.91.103 as a metric.
Ramping Phase:
1 (TTL 1): *no response*
2 (TTL 2): *no response*
3 (TTL 3): expired [195.69.144.247]
4 (TTL 4): expired [209.85.248.88]
5 (TTL 5): expired [209.85.248.79]
6 (TTL 6): expired [72.14.233.77]
7 (TTL 7): expired [66.249.94.146]
Binding host reached.
Scan bound at 8 hops.
Scanning Phase:
port 1: *no response*
port 2: *no response*
.
.
port 79: *no response*
port 80: A! open (port listen) [66.249.91.103]
port 81: *no response*
.
.
port 112: *no response*
port 113: A! open (port not listen) [66.249.91.103]
port 114: *no response*
.
.
port 1025: *no response*

Scan completed successfully.

Total packets sent: 139
Total packet errors: 0
Total packets caught 20
Total packets caught of interest 8
Total ports scanned 132
Total ports open: 2
Total ports unknown: 0

So we see that the router before www.google.com will allow access to www.google.com on port 80 and port 113, although port 113 is not listening on the host www.google.com.

View the original article here

This post was made using the Auto Blogging Software from WebMagnates.org This line will not appear when posts are made after activating the software to full version.

Tagged: The Social Network Underdog

In the age of Facebook, many social networking companies aren’t able to compete and rarely see any sort of growth. However, while it might be impossible to imagine any site ever overtaking Facebook, there are sites out there that are going to grow none the less.

Tagged is a social networking site based out of San Francisco that reported that it had a tremendous 2010 year. According to representatives of the website, they ended the year with more than 100 million subscribers. And, more importantly, they had their third straight year of profitability.

For this unknown company–I’ve never heard of it before–they have definitely seen a lot of growth. They are currently behind Facebook which has 600 million members and behind Twitter which has 200 million members. But, Tagged has more members that LinkedIn which just announced its plans to go public. In other words, this company is one of the top social networking sites.

The ultimate question is: how can a company like this grow in the shadow of Facebook?

It’s in the marketing strategy. Facebook likes to help users strengthen their current network. It’s all about building stronger relationships with the people you currently know.

Tagged, on the other hand, is more about helping users build new connections. They’ve developed their features to allow this sort of expansionist mentality when it comes to finding people.

According to VentureBeat, Tagged has seen “a total revenue of more than $32 million and subscription revenue up 50% since 2009.”

Reported from a leaked e-mail, Tagged intends on doubling its staff and giving all of their current employees a 10% raise. In other words, things are look good at Tagged.

View the original article here

This post was made using the Auto Blogging Software from WebMagnates.org This line will not appear when posts are made after activating the software to full version.

IsItUp Network Monitor 7.09 (Trial)

IsItUp Network Monitor is a website monitor, email system monitor and server monitor. It continuously monitors multiple IP devices, websites, servers & alerts you via email or pager.

Website content check; runs as a service; maintains performance statistics for each device it monitors - up time, maximum response time, minimum response time, standard deviation & error log. IsItUp tracks the last successful and last failed Traceroute.

Taro Software's IsItUp - When you need to know the status of your network. IsItUp continuously monitors multiple "pingable" devices using TCP/IP's Ping utility; it tests email servers by bouncing messages off auto-reply accounts and websites by using HTTP. Devices are monitored at specified intervals, notifying you, by email alert, pager alert or phone, when they go down - or come back up.

Here are some key features of "IsItUp Network Monitor":

· Full featured Windows based IP monitor, email monitor, and Website
· Monitor any number of devices, 24 hours a day, 365 days a year
· Runs as a Service and on the system tray
· Checks TCP/IP (ping) devices, websites, LAN servers, email servers, switches, routers, etc.
· Graphical interface is easy to customize and use
· Configuration "wizard" makes it easy to add devices and configure options
· Watch any mail system by sending email messages and looking for returned echos (Mail systems must have auto reply turned on and a test account with auto reply rule turned on (delivery receipt))
· System tests reports on uptime, average response time, and logs all data to a Microsoft Access database for you to work with on your ow
· Email message tells how many times failed, return to operation email tells how long it was the down time
· Monitor a website for text changes or for a checksum
· Website content check lets you know if your website is defaced
· HTTP support for GET, POST, and HEAD, Proxy Server

Requirements:

· Intel Pentium III 450 MHz or higher
· 64 MB of RAM (128 MB or more recommended)
· 1MB hard drive space for device data - depends on number of devices monitored
· Windows-compatible display with at least 800x600 resolution
· Windows-compatible mouse or pointing device

Limitations:

· 30 days trial

What's New in This Release: [ read full changelog ]

· adds a new feature to the ping monitor.
· Basic ping parameters such as response time, number of retries,and packet size can be set as defaults for monitor creation as well as modified for each ping monitor individually.

View the original article here

This post was made using the Auto Blogging Software from WebMagnates.org This line will not appear when posts are made after activating the software to full version.

Setup a DIY Network ‘DropBox’ (aka PirateBox)

PirateBox allows you to quickly setup a mobile wireless file sharing network. Basically, it’s a P2P file-sharing device that can turn any space into a temporary, but secure wireless file sharing network.

Multiple users within range of the device can connect to the network without any log-in and immediately start downloading or uploading files via their computers or mobile devices. As it is not connected to the internet, the system is secure from outside attacks. Also, users remain anonymous as no user logs are generated.

The PirateBox is made up of a wireless router and light-weight Linux server connected to a USB hard drive. It can run on AC power or on batteries for portability.  Feel free to make your own with the help of detailed instructions on how to build your own PirateBox for about $100.

AKPC_IDS += "11857,";Comments are closed.

View the original article here

This post was made using the Auto Blogging Software from WebMagnates.org This line will not appear when posts are made after activating the software to full version.