Network Enumeration with Nmap
Firewall and IDS/IPS Evasion — Easy Lab
Question: Our client wants to know if we can identify which operating system their provided machine is running on. Submit the OS name as the answer.
Answer:
we know http is running port 80 (status page)
Firewall and IDS/IPS Evasion — Medium Lab
Question: After the configurations are transferred to the system, our client wants to know if it is possible to find out our target’s DNS server version. Submit the DNS server version of the target as the answer.
Answer:
DNS runs on port 53
every time it appeared filtered then i noticed the note :
a filtered port means nmap cannot determine if the port is open or closed — bc the packets are being blocked or dropped.
so i retried considering the note:
-sUV: Combining two flags
-sU: UDP Scan
- sV: Version Detection
Firewall and IDS/IPS Evasion — Hard Lab
Answer:
Get Abdelhamid Houari’s stories in your inbox
Join Medium for free to get updates from this writer.
checking for open ports, but no wanted results
So i decide to check again but with a trusted source “— source-port 53”
a non-standard port shown “p50000”.
scan the port its self but no flag here just showing that its open
tying with to connect to the port with “ncat” and see if its bring something new, but the source port 53 was already in use.
So for a a fast solution i tried to use a different source port “5353”, but the lab only accept the 53 port.
after some search i found this command to print what occupy the port, but the problem no process name appeared, after i find out that the port is locked by WSL internal DNS and i can’t free it (i am using a WSL machine)
so i switch to “htb machine”, the is in use
the port is occupied by “dnsmasq”, but stopping it doesn’t doing the thing
so i tried killing the process by the pid, and it worked the remaining is 5353 so no worries
i finally connecting to port using “ncat ”printed the “flag ”
