Internet Protocol Archives - Hackercool Magazine

Virtual pentesting lab is a lab created on a single system using any virtualization software. It can be very helpful for people practicing for CEH or similar certification. Any penetration testing lab has two machines, attacker and victim. In this lab we will set up Kali Linux as the attacker and Windows XP( most favorite victim machine ) as the victim. I am going to set up this lab in Vmware Workstation 9. Hope this will be helpful.

First of all install Kali Linux and Windows XP in Vmware Workstation.

Shut them down. In the Vmware Workstation menu, Select “Edit” and click on Virtual Network editor.

The window below will open showing the virtual network adapters. Click on “Add network”.

Vmware provides nine virtual networks from 0 to 9. Vmnet0, Vmnet1 and Vmnet8 are automatically assigned for bridged, Host-only and NAT types of network respectively. Select the network “Vmnet3″.

We can see that our network is added as Host-Type with a automatically assigned subnet IP.

Click on our network. We can see its settings below.

Deselect the option ‘Connect a host virtual adapter to the network’. This’. This‘.This will make our network a custom type. Change the subnet IP to 10.10.10.0( choice is yours). Select the ‘Use local DHCP service to distribute IP address to VMs‘ option. This will automatically assign IP addresses to our machines. Click on ‘DHCP settings‘.

You will see the below window. Make changes if you like. I am going to leave it default. Click OK twice to exit.

We have successfully created our custom network. Now let’s add our machines to the network. Open the tab of Kali Linux and click on ‘network adapter‘ setting.

In the settings, select the ‘custom‘ radio button and select the network ‘Vmnet3 from the dropdown menu. Click on OK.

Do the same for Windows XP. Then let’s boot up our victim machine and check it’s IP address by typing ‘ipconfig‘ in the command line. The DHCP server has automatically assigned it the IP address 10.10.10.129.

Boot the attacker machine and check it’s IP address by typing ‘ifconfig’ in the terminal. It has been assigned the address 10.10.10.128.

Ping the victim IP machine (10.10.10.129) to see whether the two machines can communicate.

We have successfully created a virtual pentesting lab. Happy testing.

Scanning plays a very important role in hacking a system. Scanning is a phase in which we find out the ports which are open and the services listening on those ports. Nmap is the most popular port scanner being used security guys nowadays. However it is very important to understand classification of ports by Nmap while scanning. Nmap classifies ports into six states. They are, open, closed, filtered, unfiltered, open | filtered and closed | filtered. Let us find out when Nmap classifies ports into specific states. For this, I use two virtual machines,

1. Kali Linux as attacker (with IP 10.10.10.2)

2. XP as victim (with IP 10.10.10.3)

On the victim machine, Telnet server is running and an exception is provided for it in windows firewall.

1. Open

Nmap classifies a port as open if an application is actively accepting TCP connections, UDP datagrams or SCTP associations on this port.

When I perform a default Nmap scan from the attacker of port 23 of the victim,

Nmap –p 23 10.10.10.3

The result I get is open. This is because the Telnet server is actively accepting connections.

2. Closed

Nmap classifies a port as closed when the port is accessible but there is no application listening on it. On our victim machine, let’s stop the the telnet service as shown below.

Now when we perform the above scan again, the port is shown as closed because although the port is accessible we don’t have any application listening on it.(i.e telnet is stopped)

3. filtered

Nmap classifies a port as filtered when it can’t determine whether the port is open or closed because packet filtering prevents its probes from reaching the port. On our victim machine, let’s select ‘Don’t Allow Exceptions’ option in the firewall settings.

When we perform the above scan once again, the port is classified as filtered because firewall filtering blocks the probes of Nmap. When Nmap classifies a port as filtered, it is most likely that a firewall is blocking our probes.

4. Unfiltered.

Nmap classifies a port as unfiltered when a port is accessible but it can’t determine whether it is open or closed. A port is classified as unfiltered only with the ACK scan.

Let’s start the telnet service again on our victim machine and allow an exception for telnet in the firewall.

Then let us perform the ACK scan.

nmap -sA –p 23 10.10.10.3

The scan couldn’t determine whether the port is open or closed.

5. open | filtered

A port is classified as open | filtered when Nmap is unable to determine whether a port is open or filtered. This happens for scan types in which open ports give no response. The UDP,IP protocol, FIN, NULL and XMAS scans classify ports this way. Let’s go to our machine and once again block telnet using firewall.

And then perform FIN scan and NULL scan respectively.

The port is classified as open | filtered in both cases because Nmap can’t determine whether the port is open or filtered.

6. closed | filtered

Nmap can’t find out whether a port is closed or filtered. A port is classified this way only for IP IDLE scan. Now what is IDLE scan? Idle scan is a scan in which we use a zombie host to scan the victim. In our example, we use another host with IP 10.10.10.3 as a zombie to perform IDL scan on our victim.