Official (Closed), Non-Sensitive

ST2422 Ethical Hacking Essentials Practical 4a

Practical 4a
Objectives: Use dig, host, nslookup and zone transfers for footprinting
Gather information from the Internet

Exercise 1. Gathering Information from the Internet

1. Google Search can help in finding useful information.

Go to [Link] and search for “singapore polytechnic +tel” to get some
telephone numbers in Singapore Polytechnic.

2. In Google, search for “site:.[Link] email” to search for the word “email”
appearing in [Link] website.
Search for “site:.[Link] login” to search for the word “login” appearing in
[Link] website, including login forms.

3. You can also use Google Advanced Search. Visit [Link]/advanced_search to

see how detailed your search can be.

4. Netcraft provides useful information on websites around the world. Browse to

[Link]. Scroll down to find the section for What’s that site running. Enter
“[Link] (or any other website).
Look through the results to see what Netcraft can find out about the website.

5. Try searching the Whois databases.

(a) Go to [Link]
(b) In the Search Whois textbox, type “MIT” (or Massachusetts Institute of Technology)
(c) You may need to click on “Search ARIN’s Whois instead”. You may see some
network ranges listed. You may also see names and emails of technical staff.
Source Registry ARIN

Net Range [Link] - [Link]

Source Registry ARIN

-
CIDR [Link]/ 16
Kind Individual
Name MIT-LL2
Full Name
Handle NET-129-55-0-0-1
Handle
Parent N ET- 129-0-0-0-0
Email ■@[Link]
Telephone +1-617-910 \.00 Net Type DIRECT ASSIGNMENT

(d) Go to [Link].
(e) Under Tool, select Whois Search. Search for “[Link]”. You can see the details of
the DNS servers for [Link]. You may also see some emails or telephones
belonging to Singapore Polytechnic.
(f) Under Tools, select DNS. Search for “[Link]” again. You can also see the details
of the DNS servers for [Link], indicated by “NS” for nameserver.
(g) Under Tools, select Network Lookup. Search for “[Link]” again. You can see that
cloud technologies are being used.
Is there a contact person in charge of Singapore Polytechnic’s domain registration?

AY2324 Page 1 of 13
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4a

(h) You can also make whois queries through a command line. In Kali, type the
following command :
whois [Link]

6. The website [Link] provides information on IP addresses. The free service is limited to
1000 requests per day.
(a) Go to [Link] You will see your current IP address that is seen by the
Internet.
(b) Add to the URL any IP address that you want to get information about (eg
[Link] The website will provide details on which country
owns the IP address.
(c) You can also make queries to [Link] through a command line. In Kali, type the
following command :
curl [Link]/[Link]

7. Browse to [Link]. Search for “webcam”.

Without a login account, Shodan returns a limited set of results. You can click on the
webcams found, and see what ports they are running on.

Exercise 2. Use dig, host, nslookup and zone transfers for footprinting
Description :
A DNS Server for the domain “[Link]” has been set up on web-server2.

8. In Kali Linux, look at the man pages for dig and host.
man dig
man host

9. Run the dig command to find the IP address of [Link] from the DNS Server
on web-server2. The IP address would appear under the ANSWER section.

dig [Link] @[Link] Change to web-server2 IP

L $ dig server . [Link] @192.168.153 . 165

; <<>> DiG 9.16 . 11-Debian <<>> se [Link] @192 . 168.153.165

gl obal options : +cmd
Got answer:
->>HEAD ER<< - opcode: QUERY, status: NOERROR, id: 29130
f l ags: qr aa rd ra; QUERY: 1, ANSWER : 1, AUTHORITY: 1, ADDITIONAL: 1
OPT PSEUDOS ECTION:
; EDNS: version : 0, flags : ; udp: 4096
QUESTION SECTION:
''
;serve r .exampl e . com. IN A
ANSWER SECTION: IP address of [Link]
''
[Link] . com . 86400 IN A 192 . 168 . 6.200 .__ returned by the DNS Server
running on web-server2
AUTHORITY SECTION:
''
[Link]. 86400 IN NS server . [Link] .
Que ry time : 0 msec
SERVER: 192 . 168 . 153 .165#53( 192.168.153 . 165)
WHEN: Sun Apr 25 01:57:00 EDT 2021
MSG SIZE rcvd : 77

AY2324 Page 2 of 13
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4a

10. Run the host command to find the IP address of [Link] from the DNS
Server on web-server2.
host [Link] [Link] Change to your web-server2 IP

i
11. On Windows (either Host PC or VM), you can use the nslookup command.
In Windows, run the following commands to query the DNS Server on your web-server2
to find the IP address of [Link].

nslookup
Default Server: [Link]
Address: [Link]
>server [Link] Set the DNS Server to your web-server2
Default Server: [[Link]]
Address: [Link]
>[Link]
.... IP address displayed
>quit

12. If you have an IP address and you want to find its hostname, you can do a DNS reverse
lookup. Try any of the following methods to do a DNS reverse lookup.

For example, to use Kali to query the DNS Server on web-server2 to find the hostname
of [Link], you can use the dig command:

dig –x [Link] @[Link] Change to web-server2 IP

i

Or the host command:

host [Link] [Link] Change to web-server2 IP

i

To use Windows to query the DNS Server on web-server2 to find the hostname of
[Link], you can use nslookup

nslookup
Default Server: [Link]
Address: [Link]
1

>server [Link] Set the DNS Server to your web-server2

Default Server: [[Link]]
Address: [Link]
>set type=ptr
>[Link]
.... hostname displayed

AY2324 Page 3 of 13
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4a

13. In Kali Linux, run the following command to do a zone transfer of the domain
[Link] from the DNS Server.
dig @[Link] [Link] axfr Remember to set the DNS Server
to web-server2 IP

How many hosts (with IP addresses) can you find? Is there any host you would be
interested in?

Note : As the records in a zone transfer can give away info about the network setup to a
potential hacker, most DNS Servers do not allow zone transfers. Or only authorised
systems can perform a zone transfer.

Exercise 3. Finding Network Information about a company

In this exercise, we will try using DNS to find out information about a domain. We use the
domain [Link] just as an example.
14. In Kali Linux, using the dig command, find out the domain information about
[Link]
dig [Link]

15. Use the dig command to find out the information about DNS Servers in the domain
[Link].
dig -t ns [Link]
(Note : You may get different results from the following screenshot as organisations may
have changed their network setup)

L $ dig -t ns [Link] [Link]

; <<>> DiG 9 . 16.11-Debian <<>> -t ns sp . edu . sg

global options: +cmd
Got answe r :
->>HEADER<<- opcode: QUERY, status: NQERRQR, id: 54735
flags : q r rd ra; QUERY : 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL : 3
OPT PSEUDOSECTION:
; EONS: ve rsion: 0, flags:; MBZ: 0x0005, udp: 1280
;; QUESTION SECTION : The Answer section shows the DNS
;sp . edu . sg. IN NS Servers for [Link]. You may get
different results
; ; ANSWER SECTION:
[Link] . sg . 5 IN NS no va . [Link]. sg.
✓
[Link]. 5 IN NS [Link] . [Link] .
[Link] . sg . 5 IN NS [Link] . edu . sg.
The Additional section may give the
;; ADDITIONAL SECTI ON: .__ IP addresses for the servers listed in
[Link] . [Link]. 5 IN A [Link]
nova . np . [Link] . 5 IN AAAA 2402 :a900:0 : 24: :71 Answer section. If IP addresses are not
listed, you can do a dig on the names
of the DNS Servers to find their IP
addresses.

How many DNS Servers are there for [Link]? Do you have their hostnames?

16. In the screenshot above, the IP addresses for the DNS Server [Link] and
[Link] are not listed. Use the dig command to find their IP addresses.
dig [Link]

AY2324 Page 4 of 13
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4a

17. Use the dig command to find out the information about Mail Servers in the domain
[Link]
dig –t mx [Link]
(Note : You may get different results from the following screenshot as organisations may
have changed their network setup)

L $ dig -t mx [Link]

; <<>> Di G 9.16.11-Debian <<>> -t mx [Link] . sg

gl obal options: +cmd
Got answe r :
->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13166
f l ags: q r rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
OPT PSEUDOSECTION:
; EDNS: ve rsion: 0, flags:; MBZ : 0x0005, udp: 1280
;; QUESTION SECTION: The Answer section shows the Mail
;[Link] . IN MX Servers for [Link]
;; ANSWER SECTION:
[Link] . 5 IN MX 1 [Link]

18. How big is the [Link] network? We can use whois to find out.
In Kali Linux, use the whois command on one of the IP addresses belonging to [Link].
domain.
For example : You can also use [Link] and
whois [Link] do a Network Lookup on the IP address

You may be able to see an IP address range belonging to [Link] domain.

19. Using host command, we can check to see if a particular IP has a hostname registered in
the DNS. Choose one of the IP addresses from the range of IPs you have found.
For example,
host [Link]

Do you see any hostname?

Try running “host [Link]”, and then “host [Link]”, etc. (Change the IP
addresses to the range of IPs you have found)

20. It is possible to run through all the IP addresses in the range to see which IP has a
hostname registered in the DNS.
Of course, to be effective, a script can be used to automate this.

AY2324 Page 5 of 13
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4a

Exercise 4. Finding information on intermediate nodes

21. What is between you and a server? Use traceroute (or tracert on Windows) to find out the
nodes between your machine and an external IP address.
traceroute [Link] (you can use any reachable IP)
22. Traceroute may not work with virtual machines using NAT network adapter. Try running
the Windows command “tracert” on the Host PC.
tracert [Link] (you can use any reachable IP)

C: \> t racert 205 . 166 . 76 . 8

Tracing route to noa3dns - [Link] . com [ 205 . 166.76.8] Sample output of a traceroute.
over a maximum of 30 hops: Sometimes the intermediate
1 7 ms 5 ms 5 ms 164 . 78.252 . 1
routers do not return any info, so
2 7 ms 13 ms 5 ms 192 . 168.220 . 201 you see a series of * instead.
3 8 ms 5 ms 9 ms 164 . 78.250 . 41
4 8 ms 9 ms 5 ms gi- 1- 1 - 2 . a064 . mlnet. com . sg [ 203 . 123.26.49]
5 11 ms 6 ms 6 ms xe-8 - 2 - 0 . a089 . mlnet. com . sg [ 203 . 211.158.141]
6 13 ms 7 ms 8 ms t e-1 - 2.a062 . [Link] [ 203 . 211 . 158.73 ]
7 8 ms 7 ms 9 ms i x - xe - 10 - 1-2-0. tcorel. s vw - singapore. as6453. net [180 . 87 . 12.209 ]
8 95 ms 80 ms 117 ms i f-et - 23 - 2 . hcore2. k v 8-chiba . as6453 . net [ 180 . 87 . 67.33]
9 194 ms 206 ms 198 ms i f-ae - 53 - 2 . tcore2. l vw - los- angel es . as6453. net [ 64 . 86 . 252 . 56]
10 206 ms 203 ms 201 ms i f-ae - 2 - 2 . tcorel. l vw -los-angeles . as6453. net [ 66 . 110 . 59 . 1]
11 305 ms 310 ms 300 ms los-brdr - 02 . inet. qwest . net [ 63 . 146 . 26.145]
12 304 ms 305 ms 309 ms sea-edge - 13 . inet. qwest . net [ 67. 14 . 41.66 ]
13 307 ms 300 ms 304 ms 63 . 147.70 . 18
14 388 ms 412 ms 399 ms noa3dns - w. [Link] [ 205 . 166 . 76 . 8]

Trace complet e.

23. Alternatively, you can use online traceroute websites.

Go to [Link]
(a) Choose a server near you and start tracing to the target IP. Traceroute will return a
list of IP addresses.
(b) You may be able to see an IP address before it reaches [Link]/8, ie. the target
network. This IP could be the organisation’s ISP or hosting service.
(c) You can use various methods to learn more about the IP addresses listed (eg whois,
dig, online search).
Traceroute From Singapore To (Hostname/lP Address)

,~-------~II Subrmt j
Traceroute Result·

traceroute to 205 .166. 76. 8 (205 .166. 76. 8), 30 hops max, 60 byte packets
1 [Link] ([Link]) 0.167 ms 0.167 ms 0.166 ms
2 [Link] ([Link]) 33.091 ms 33.208 ms 33.212 ms
3 •••
4 +
5 * .. ♦
6 ....
7 + +
8 • + • Sample output of a traceroute
using online traceroute sites
9 + +
10 • * •
11 + •
12 * •
13 *•
14 • +
15 *+
16 *•
17 +
18 +
19 NINTENDO-OF .ear3. Seattle 1. Level3. net ( 4.16 .169 .178 ) 204. 520 ms ! X •

Traceroute Completed.

AY2324 Page 6 of 13
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4a

Task :
Using the publicly available online search engines and tools you have learnt, try to find the
following information :

(a) Finding out about Domain information :

1) Who is the owner of the domain [Link]?
You can use the Whois to find the owner of a domain.
(eg In Kali, run whois [Link])

2) How is the website [Link] hosted? Is it using a Content Delivery

Network?
When doing a dig or nslookup on [Link], the hostname returned
seems to be Cloudfront – it seems to be using Content Delivery Network

(b) Finding out more about the networks: [Link]:

1) What are some IP addresses belonging to [Link]?
If using [Link], do a Network Lookup for [Link]. An
IP range [Link] - [Link] is returned

2) What are the live systems in the IP range (that belongs to [Link])?
In Kali, can run "dig -t mx [Link]" to find mail servers belonging to
[Link] and then dig for their IP addresses.
Can try "host [Link]" or "ping [Link]" to see which systems are up.
To test the whole range, a script can be used. If ping is used, remember that not all
systems may reply to a ping echo request.

3) Any mail server in [Link]?

In Kali, can run "dig -t mx [Link]" to find mail servers belonging to
[Link] and then dig for their IP addresses.

(c) Finding out about the company

1) Find career postings for IT staff for a company. What sort of technologies are
listed in the job advertisement? This may also give you a clue on the technologies
used at that company.

Example of a Job Posting

System Administrator
Job Description These may be the technologies
Description: used in the company
• Design and implemented Integration between Active Directory w ith Azure Active
Directory using DirSync and Azu re Active Directory Connect.
• Design and Implemented Active Directory Doma in Consolidation and TierO
Consolidation meeting EY business comp liance.
• Collaboration and implemented Ente rprise wide DNS Migration to Bluecoat proxy
• Review the solutions designed by the Technical Engineers

AY2324 Page 7 of 13
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4a

(d) Finding out more about a person:

Do a web search for a person’s name.
You may be surprised by the amount of information available for a person on the
Internet.

Read the following article on guessing email addresses:

[Link]

Exercise 5. Using Web Tools for fingerprinting

Description:
BurpSuite can be used for gathering information from a web site.

In Kali VM
24. Click on the Kali icon in the top left corner and go to 03 Web Application Analysis ->
burpsuite. Or in a terminal, type “burpsuite”. If there is a message about the Java JRE,
click OK. You will need to Accept the Terms and Conditions for the BurpSuite
Community Edition. If asked to update the software, you can click Cancel.
25. Select Temporary Project and click Next. (see following diagram)

We lco m e t o Burp Suite Co mmun ity Editi on. Use t h e option s bel ow t o cr eate or op en a pr oj ect

Note.· Disk-based projects are only supported on Burp Suite Professional

BURPSUITE
----1►
• 0 Temporary project

New project on disk Name·

File: Choose file

Open existing project Na me Fi le

File: Choose file

~ ~ ◄◄-----

26. Use Burp Defaults and click Start Burp.

0 Use Burp defaults

Use optioM saved with project

0 Load from conf igurntion filc Fi le

File: ~ - - - - - - - - - - - - - - - - - - - - - - - - - - ~ [ Choose fi le•••

0 Default to the a ~ i11futu re

0 Dis..:i bleexte11siom;

Caocel ] [ Back ] [Link]•M +--

AY2324 Page 8 of 13
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4a

27. To see which port Burp is running on, click on the Proxy tab. Under the Proxy tab, click
on Options. By default, Burp is running on Port 8080. (see following diagram)

Da shb oard Target Intrud er Repeater Seq uencer Decoder Co mparer Extender Project op1

Inter cept HTTP hi st ory WebSocke t s hi st ory Options

(D Proxy Listeners
@ Burp Proxy uses li st ene rs t o receive in com in g HTTP request s from you r browse r. Yo u will need t o con fi gu r e yo L

Add Run nin g I Interfa ce I Invis ibl e I Red irect I Ce rtifi cat e
0 1 27 . 0. 0.1: 8080 Per-h ost
Edit

Remove ►
By default, Burp is running on Port 8080

28. Under Proxy tab, click on Intercept tab. Click on the Intercept button to toggle to
“Intercept is off”. (see following diagram)

Dashb o ard Tar get Proxy Intruder Repeater Seq uencer Decoder (

----1►► Intercept HTTP hi st ory We bSo ckets hist ory Opti ons

Forward Drop Inte r cept is off Action

Click to toggle to “Intercept is off”

29. In a terminal, type “netstat -tuna” to check that Burp is running on port 8080.

BurpSuite has provided an embedded Chromium Web Browser that we can use to browse the
Internet. By using this Chromium Web Browser, all our web requests and responses will pass
through Port 8080, where Burp is running. Burp is able to passively scan this data.

Chromium
Web Burpsuite Website
Browser
Web requests and responses pass through Burp.
Burp is able to capture and passively scan this data

30. In Burp, click on Open Browser.

Dashi>oard Tar9et Proxy Intruder Repeater Sequencer Decoder G

Inte rcept
- - ----
HTTP history
WebSockets history Opt ions

Forward Drop ( Intercept [Link] Action [ DpenBrowser ◄!ill----

31. The Chromium Web Browser is started up. If the following dialog box about “keyring”
appears, just click Cancel.
Choose password for new keyring

An application wants to create a new keyring called "Default keyring". Choose the password you want to use for it.

Password:

Confirm:

Cancel Continue

AY2324 Page 9 of 13
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4a

32. Browse to a web site (eg [Link]).

33. You may see a warning as the Web Browser has detected that Burp has intercepted and
changed the certificate of the webpage. You can click to check the reason of the warning
(the certificate is issued by PortSwigger, and not Singapore Polytechnic).

34. Browse a few pages in the website.

35. In Burp, click on the Target tab. Under the Site Map tab, you will see a list of the web
resources mapped by Burp. (see following diagram)

~ Tar11 et 1Pro xy ! intrud er 1Rep e ater 1Seq uencer j De code r 1Com parer 1Extender 1Project options I User opt ions J

[ Site map J Scope j Iss ue defin iti ons ]

Fi lt er : Hidin11 not found it em s hidin<< CSS , ima11e and 11enen1 I binary cont ent; h idini;i 4xx res pon ses hidin<< empty fo lders

► ii http s://[Link].e du. s 11 I Method I URL I Param s I Stat.. ~ Len,;ith I MIME type T itle I Com ment
►
l'l
http l/www. s p. ed u. s g
https: //wwwsp .e du .sg
D'
D LSC
► - SPContentlnterfa ce
- http s://[Link].s,;i
https ://www .sp .ed u. s,;i
http s ://www .sp .e [Link]
http s://www.s [Link]
http s://www .sp. edu. SQ
GET
GET
GET
GET
GET
/C wp/ a sse t s/s cripts/main .js
{[Link].U I. WebReso urc e.a xdJ T
,WebResou [Link]?d- pyn Gkmc FUV1
/ cwp/ass ets / s cr ipts /jque ry . m in.j s
✓
✓
85534
839380
145 04 2
24301
87730
HTML
script
script
script
script
Sim,apore Polytec hnic

► ■ Sitefinity
http s://www .sp. e du. s,;i GET /s b 70735 HTML Sc hool of Bu s iness
► 8 T eleri [Link] [Link]. We bRe s ourc e. 11xd http s ://www .sp .e du. s,;i GET /s p/ admissions/adm iss ions -exer cis es 64056 HTML Adm iss ion s Exerci ses
► $ WebRe s ource.a xd
Dabe
D career- interest-profilirig
~::::~~:::: ::: ::~: :~ ~~:;;::::::
http s ://www. sp, e dU. SQ
:- :z~:~:~:~:~c:::~:~::~~:~~::~~:;::~::~:~::~::;::~~~:~:::.::==---
GET /s p/e ducation/s chool s
6508 3
64788
66690
HTML
HTML
HTML
Ove rview
How t o Apply
School s
-
D els
► ■ cwp
► ■ enQ ineerin,;i-cluster
,.~ .
http s ://www. sp .e du. s,;i GET /C wp/ a sse t s/fonts/icom oo [Link]?m 0b 9al ✓ HTML 301 Mov ed Perman e

► ■ eservi celink.s
► ■ im,1g es
I Req ue st I Re sponse I
D life@sp
D mad
l~J Raw 1 Headers J Hex j HTML J Render J Vie wState J
► ■ [Link] l lfTTP/ l , l 2000K
D ms 2 Content-Typ e : t u t / ht11l; ch;uset ~ ut f ·B
D pan~ 3 Connecti on : cl ose
D ,, 4 Dat e ; Sat, 1 8 Apr 2020 04 ; 30:42 GMT
• ,b set- Coo kie : rp [Link].s,;i~2d f 1004f3ff 6d70708982e a725 5210ee : ht tp only; path~ / ; secure; Htt pOnly
D
about-biz-sch Set- Coo ki e : AwSA Le-
about-biz-sch 1FHS4d+ 11QXBl AFG5x He xj s8gUM+ v uQc + oWc j d ().J JwPXFKAa9 f 7Eq y qt i j MhEKe 68Qkb KXp29QSc / Rz 3eQ3Mf FPOI/+ r E11 HAAARMHek z z /-f,9x vWs osp g07g z ruQq nk ;
Expir es•Sa t , 2 5 Ap r 2020 0 4;30 :40 GMT; Path• /
D
alumni
7 Set- Coo kie : AWSALBCORS--
► ■ alumni
/ FH54d+ 11QX8l AFGSx He xj s8 gUM+ v uQc + oWc j d ().J JwPXFKAa9 f 7Eqy qt i j MhEKe 68Qkb KXp29QSc / Rz 3eQ3MfFPOI/+ r E11 HAAARMHek z z /-f,9xvWs os p g07g z ruQq nk ;
D """" Expir es•Sa t , 25 Ap r 2020 0 4: 30 :40 GMT; Path• / ; Sa me Sit e•Non e
► ■ courses 8 strict -Tran s po rt - Se curit y ; 11ax - ag e•31536000
D electives 9 X· FRAME· CPTIDNS : SAMEDRIGIN

These are the HTTP Response headers

► ■ electives 10 X· Content·Type· Cpti ons : nosniff
D life-@-biz-sch Ca che- Control ; max -a,;ie~ 86 400, public
► ■ life -@ -biz-sch 12 X- XSS·P rotection : l ; 11ode~ bl od

D
D
search
news 13
14
)(-Acces s-Control-Al low - Origin ·
Var y : Acc ept-E ncod i ng of the Web Response packet .
D ,m , 15 X- Cac he : Mi ss from cl oudfr ont

36. In the above diagram, in the left hand pane, if you click on the hostname (for example,
[Link] you will see a list of the web requests sent to that host in the
right top pane. Click on any of the web requests, and you can see the packet details of the
Request and Response packets for that particular request.

Exercise 6. Viewing HTTP headers

There are multiple ways to view the HTTP request and response headers sent by web
browsers and web servers. One way is by using intercepting web proxies like BurpSuite like
in the previous exercise. Many Web Browsers nowadays have built-in Developer Tools which
can also allow us to view the HTTP request and response headers.

37. Power on the web-server2 VM.

In Kali
38. Run Burp. In the Proxy tab, check that “Intercept is off”.
39. In Burp, under the Proxy tab, click Open Browser to start the Chromium Web Browser.
40. Browse to the IP address of your web-server2.

AY2324 Page 10 of 13
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4a

41. In Burp, under Target tab and Site Map tab, look at the HTTP response headers of the
Response packet sent by web-server2. Can you tell which web server is being used?
~ Target j Proxy ! intruder ) Repeat er 1Se qu enc er 1Decode r 1Com parer 1El<tender 1Project options 1Use r optio ns )

J Sit e map j Scope ) Issue definitions )

I
Filt e r · Hiding not fo und it ems hiding CSS image an d general bi na ry co nte nt hiding4xx r es po ns es h idin g em pty folders

ht+" :f/l 92 16B.HS183 I Meth od I URL I Params I St•

► t~ https //l ife . sp .edu . sg ~ 8 19S l 83G ET / 20(
► http :(fwww. s [Link] .s 9 http:f/192. 1 68 . l9Sl83 GET /login
► http s ://W Wl'O,Sp, [Link]
http:l/[Link] GET / wo rd

~ Re s pon se ]

J Raw j Headers 1Hex j HTM L 1Render ]

~:;~;:::~~;~~:[:~~:!c~:~~t:~;~'.~go~-~ips . _ Sometimes the HTTP response headers contain the

Server field, which can tell us which web server
ETa g : "a6-S9dbd2934e0bd"
Accept-R>lnges : bytes
Content -Lengt h : 166

(and even the operating system) is being used.

Connec t i on : close
9 Cont ent -Type : t ot / ht ■l: c har set•UTF- 8
w
11 Thi s i s t he deh ul t web page.<br ><br >

"1314 <~
<~
h " f • "/wo r d ">c'lick he" to go to th e Word for ■ </ ~ ><br ><br >
hr e f •" / l og in " >c'l i ck her e t o go t o t he Login for~ </ ~><b r ><br >

"

42. Close the Chromium Web Browser and exit Burp.

Using the Web Browser’s built-in Developer Tools to view HTTP headers
Most web browsers nowadays have built-in Developer Tools that you can use to view
network packets, and HTTP details.

In any system (Kali or Host PC)

43. In any Web Browser, press F12 to bring up the Developer Tools window.
44. Click on Network tab.
45. Browse to a website. You will see a list of network packets displayed in the Developer
Tools window.
46. Click on any network packet. In the right hand side, you can see the Request and
Response headers.
Sometimes the Response headers will contain information about the Web Server.
0 Inspector L Console @) Debugger { J Style Editor 0 Performan... 63
Method File Domain Type Cookies l Params _I_ Response Timings Pr
Request URL: http:/ /Ww'wl' . sp . edu. sg/

e 200 GET vp-spws Ii [Link] html Request method: GET

Remote address: 164. 78. 2s2 . 49: 80
• 200 GET [Link]? id=GTM-5D6H2P a [Link] ... js
Status code: .A 302 Found Edit and Resend Raw
0 200 GET semantic Tag Service .js ?language= en Ii [Link] js
Version: ITTTP/1. I
O 200 GET styles. jsp ?v = 20150812 &the meContextlnfo ... Ii [Link] .sg m a. Filter headers
O 200 GET js .jsp?v=20150812 Ii [Link] .sg js .. Response headers (0.480 KB)
o 200 GET menu_serv1ce .1s Ii [Link] .sg js Connection: MKeep-Ative·
0 200 GET context_n s6. js Ii [Link] js Content-Encoding: ~gzip"
Content-Length: "182"
o 200 GET [Link] Ii [Link] .sg js
Content-Type: ~text/html; charset =iso- 8859- r
e 200 GET js_prn.jsp Ii [Link] .sg js Date: "Fri, 04 Aug 2017 03:11:36 GMT'
o 200 GET qalleria .[Link] Ii [Link] .sq m Keep-Alive: "timeout=S"

- HTML
CSS JS XHR Fonts Images Media Flash Other 0 77 requests, 4.88 KB, 6.02 s

47. Press F12 again to close the Developer Tools.

AY2324 Page 11 of 13
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4a

Exercise 7. Viewing Email headers

Description:
Email headers are useful when tracing the origins of an email. Email headers are normally
hidden by most mail software, but there is usually an option to display them.
As an email is passed from one mail server to another, a new email header is added to the top.

The From and To headers in an email can be easily forged so the Received headers can
provide a clue to where the email really comes from. However, hackers can add fake
Received headers at the bottom of the list.
The X-Originating-IP header usually can tell us the IP address of the computer that had sent
the email. If it is not present, however, the Received headers have to be checked.

Email header example 1

X-Apparently-To: customer@[Link]; Tue, 16 Apr 2019 19:06:14 +0000
Return-Path: <bounce@[Link]>
Received-SPF: pass (domain of [Link] designates [Link] as
permitted sender)
X-Originating-IP: [[Link]]
Authentication-Results: [Link]
header.i=@[Link]; header.s=scph0616; dkim=pass (ok)
Received: from [Link] (EHLO [Link]) ([Link])
by [Link] with SMTPS; Tue, 16 Apr 2019 19:06:14 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=[Link];
s=scph0616; t=1555441574; i=@[Link];
bh=xfjjtNoG9cDwN2WG44diCEw3emOY/6L0N5AtlyURhV4=;
h=To:Message-ID:Date:Content-Type:Subject:From;
b=WHtl3UbJz0zfF4tOjGe9ZRcqjYftZHYu4E55DRfDdeqHMlEUCMhHhBsr8nGAYn2O1
osBPZmd0Z3B69HtXUtGwLJa30gFVcIcf1uNUXype6uvgYUPML5d387YCgn26lLoeXT
2XnCWVulotBOwSasyFaALwaqOPg2h9aSjaVNLPqE=
X-MSFBL: osnZjuM6KhUUNZX/3sop661yRvbwSeSFnSxb2c9j/6k=|eyJzdWJhY2NvdW50X2l
kIjoiMCIsIm1lc3NhZ2VfaWQiOiIwMDI1YTYyN2I2NWNjODI2OTg5YiIsInRlbmF
udF9pZCI6ImNvdXJzZXJhIiwiY3VzdG9tZXJfaWQiOiIxIiwiciI6InllaWxlZW5
AeWFob28uY29tIn0=
To: <customer@[Link]>
Message-ID: <89.B9.09928.6A726BC5@[Link]>
Date: Tue, 16 Apr 2019 19:06:14 +0000
Content-Type: multipart/alternative; boundary="_----
OAyR0Q4FNgaDyh/WNUvXcQ===_09/B9-09928-6A726BC5"
MIME-Version: 1.0
Subject: Deadlines for Online Degrees
From: "University of Michigan" <no-reply@[Link]>
Content-Length: 47897

48. Determine the IP address where the above email came from.
Where is it from? (you can try nslookup, dig or whois)

AY2324 Page 12 of 13
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4a

Email header example 2

X-Apparently-To: customer@[Link]; Tue, 09 Apr 2019 07:34:33 +0000
Return-Path: <arleen@[Link]>
X-YahooFilteredBulk: [Link]
Received-SPF: none (domain of [Link] does not designate permitted
sender hosts)
X-Originating-IP: [[Link]]
Authentication-Results: [Link] from=[Link];
dkim=neutral (no sig)
Received: from [Link] (EHLO [Link]) ([Link])
by [Link] with SMTP; Tue, 09 Apr 2019 07:34:26 +0000
Date: 9 Apr 2019 13:3:51
From: Cherry Edwards <arleen@[Link]>
Reply-To: arleen@[Link]
X-Priority: 3 (Normal)
To: customer@[Link]
Subject: Save 80% from this Pharmacy

49. Determine the IP address where the above email came from.

50. You can also try online email header analysers. For example, browse to the following
URL and paste the email headers of one of your emails to find out where the email is
from.
[Link]

Exercise 8. What information am I giving to websites?

Description:
When we browse websites, we are also giving information about our client setup to the web
servers.

51. On your Host PC, go to [Link]. The public IP address that you are providing to
the Internet is listed, plus other details.
52. Click on the link “More Info” to see more information that your web browser can provide
to the web server.

End of Practical

AY2324 Page 13 of 13
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4b

Practical 4b
Objectives: Use nmap and other port scanning software
Try ping sweeps
Use hping to craft packets

Exercise 1. Use nmap and inspect the packets sent

Description :
You will be running nmap against your web-server2 VM. Your web-server2 will have several
services running, but not the Telnet server. The firewall on the web-server2 will allow clients
to connect to a number of ports, including the Telnet port 23.

In web-server2
1. Check that the firewall configuration file /etc/firewalld/zones/[Link] contains the
following line to allow incoming connections to Telnet port 23.
<service name= "telnet"/>
If the above line is not in the file, add it in. Run “systemctl restart firewalld” to restart the
Firewall.

2. Edit the file /etc/xinetd.d/telnet. Change the following line to disable telnet
disable = yes
3. Restart the xinetd service if it is not already running.
systemctl restart xinetd

In Kali Linux
4. Look at the options available for nmap.
nmap -h
What is the option for running a SYN Scan? (Ans : -sS)

5. Start a Wireshark capture.

6. Use nmap to run a SYN scan against your web-server2.

sudo nmap –sS [Link] Change to the IP of your web-server2

7. Stop Wireshark when nmap has finished running.

8. Look at the results of nmap. Port 21 and other ports are reported as “opened”, while Port
23 is reported as “closed”.

9. In Wireshark, apply the following filter to see only the SYN packets.
Filter: [Link] .syn == 1

10. Scroll through the filtered packets to see the ports targeted. Look for any SYN packet
going to port 21 (ftp).
You can either search manually or you can apply a filter
Filter: [Link] .syn == 1 and [Link] == 21

AY2324 Page 1 of 8
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4b

11. To see all the packets going to or coming from port 21, try the following filter :
Filter: [Link] == 21

How did your web-server2 respond to the SYN packet sent to the opened port 21? What
kind of packet did it send back?
How did nmap respond to the packet sent by the web-server2 VM?
(Answer : example of a packet capture below
.. .. /· , ( v ~JI[ fail.., i.:Ji ~I
••
~-~'ttl ~

t'1a. llnui S<:1<1.1r-<:~ l>il"ld11 lll'n Prat{l1;{ll [Link] lr)fo

l3 o . O~l54000 l82 . l6e .i48. l~ l~-l68. :'2$.19Di icP 98 ~n19 ftp [Sm] ~ - =O '[Link]- 024 Le
1a o . ~SQOO Hl2.168.2'18.l30 192.1158 , 248 , 132 TCP 60 fq1 ;,, 4717'9 (SH~, ACK) Se:q;zC Ack..-1
1si o.~5000 l:iiil . .l~.2411.132 l~.100.246 , -LOO TCP S4 47179 > ftip f~T S.q'-l 1n;;0 l..qn;QI

Packer 13 is the SYN packet sent to port 21. In Packet 18, the web-server2 responded
with a SYN/ACK packet. In Packet 19, nmap responded with a RST packet.)

12. Change the filter to see all the packets going to or coming from port 23.

How did your web-server2 respond to the SYN packet sent to the closed port 23? What
kind of packet did it send back?
(Answer : example of a packet capture below

..,.,,, ...........................r. ~~: I i

~~ ~~~

N,;. 'l'lll'tl S<.11un:e thntiht11Rlon Pr,,n(l cl tigtl fnt'o

8 o. ~8!000 ltn , 116S. ~ -l'.32 ~.1~."248 1.30 TOP S'S 4)'17:9< > o1l'i • [S!'Nl • Cl~ · ·•n;:1,024
17 ,e. o:31;1101000 192 , 1,aa ..248.130 192.151i, :[Link] CiP 60 telnet 4717,9 l[,psr ,I l,CI{) :Seq~l iftc" -

In Packet 17, the web-server2 responded with a RST packet. This RST packet also has
the ACK flag set.)

13. Change the filter to see all the packets going to or coming from port 445.

How did your web-server2 respond to the SYN packet sent to port 445 which is blocked
by the firewall? Did it send any packet back?
(Ans : It did not send back any packet. Sometimes the firewall blocking the port may
send back an ICMP destination unreachable packet)
Use the table below to record whether a SYN/ACK packet or a RST packet was returned
or no packet was returned at all.

Response from web-server2

Port 21 (service running and not blocked by firewall) [RST]
Port 23 (service not running and port not blocked by firewall) [ RST, ACK]
Port 445 (service not running and port blocked by firewall) [SYN]

AY2324 Page 2 of 8
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4b

Exercise 2. FIN Scan

Description :
You will now use Nmap to send FIN packets to a range of ports on a range of IP addresses.
Pick a range of IP addresses that include your web-server2.
For example, if your web-server2 IP is [Link], you can pick the range [Link]
to [Link]

In Kali Linux
14. Start a Wireshark capture.

15. Use nmap to run a FIN scan against your range of IP addresses. This time, to reduce
network traffic, only scan ports 21,23,25,53, 80 and 110. For example, if your target
network range is [Link] – [Link], you will run :

sudo nmap –sF –p 21,23,25,53,80,110 [Link]-102

16. Stop the Wireshark capture when nmap has finished running.

17. Using the Wireshark capture, find out how the different systems in your range of IP
addresses responded to the FIN packet on the different ports. Use the table below to
record whether each system replied with a SYN/ACK or a RST packet or did not reply at
all. Sometimes the firewall blocking the ports may send back an ICMP destination
unreachable packet.

web-server2
Port 21 ICMP Destination unreachable
Port 23 [RST, ACK]
Port 25 [RST, ACK]
Port 53 ICMP Destination unreachable
Port 80 [RST, ACK]
Port 110 [RST, ACK]

Exercise 3. ACK Scan

Description :
ACK scans can be used to detect the presence of stateful firewalls.

In Kali Linux
18. Start a Wireshark capture.

19. Run an ACK scan against your web-server2 VM. Currently the firewall on web-server2
is blocking some ports while allowing other ports.
sudo nmap –sA [Link] Change to the IP of your web-server2

20. Stop Wireshark when nmap has finished running.

AY2324 Page 3 of 8
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4b

21. An ACK scan can be used to find if there a firewall blocking the ports. In the screenshot
below, the ten ports listed as “unfiltered” are not blocked by the firewall. Another 990
ports have also been scanned and are listed as “filtered” (blocked by firewall).
L $ sudo nmap - sA [Link]
Starting Nmap 7.91 ( https:// nma p .o rg ) at 202 1- 04-30 22:04 EDT
Nmap scan report fo r [Link]
Host is up (0.00091s latency).
Not shown: 990 f i lte red ports .,.◄,---- 990 ports found to be blocked by firewall
PORT STATE
21/tcp unfiltered ftp
SERVICE (filtered)
22/tcp unfil t ered ssh
23/ tcp unf il t e red t elnet
25/tcp unfiltered smtp ..,__ These ports are not blocked by firewall
53/tcp unf il t ered domain (unfiltered)
80/tcp unfiltered http
110/ tcp unf il t ered pop3
443/tc p unfiltered https
993/tcp unfilt ered i maps
995/tcp unfiltered pop3s
MAC Address: 00:0C:29 :41: 54:D8 (VMwa re)
Nmap done: 1 IP add ress ( 1 host up ) scanned in 6.60 seconds

22. Using the Wireshark capture, find out how your web-server2 VM responded to the ACK
packets. Use the table below to record whether a RST packet was returned or no packets
were returned at all. If a RST packet is received, the firewall allowed the ACK packet to
that port to go through.
Sometimes the firewall blocking the ports may send back an ICMP destination
unreachable packet.

Your web-server2 VM Is the port blocked by firewall?

Port 21 RST No
Port 22 RST No
Port 23 RST No
Port 25 RST No
Port 445 RST No
Poer 3389 RST No

In web-server2
23. Run the following command to turn the firewall off.
systemctl stop firewalld

In Kali Linux
24. Start the Wireshark capture again. Repeat the ACK scan.

25. Stop Wireshark when nmap has finished running.

26. Using the Wireshark capture, find out how your web-server2 responded to the ACK
packets. This time, with no firewall enabled, a RST packet should be returned to every
ACK packet sent by nmap.
L $ ·sudo nmap - sA 192. 168. 153 .16 5
Starti ng Nmap 7.91 ( https ://[Link] ) at 2021-04-30 22:12 EDT
Nmap sca n report for 192. 168.153 .165
Host is up (0.00023s l atency). Nmap reports that all 1000 scanned ports
All 1000 sca nned ports on [Link] are unfi l tered .,.◄,---­
MAC Address: 00:0C:29:41:54:D8 (VMware) are not blocked by firewall (unfiltered)
Nmap done: 1 IP address (1 host up) scanned in 0.42 seconds

AY2324 Page 4 of 8
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4b

In web-server2
27. Run the following command to turn the firewall on again.
systemctl start firewalld

Exercise 4. UDP Scans

Description :
UDP ports can also be opened on a system, and attackers can also scan for these opened UDP
ports. Note that UDP port scanning can take much longer than TCP port scanning. This is
because many opened UDP ports only responds to UDP packets containing specific data.
When Nmap send generic UDP packets in the UDP scan, it may not receive replies from most
of the UDP ports, and spends a while waiting for the time out.

In Kali Linux
28. Start a Wireshark capture.

29. Run a UDP scan on ports 21,53, 80 and 161 against your web-server2.

sudo nmap -sU –p 21,53,80,161 [Link] Change to the IP of your web-server2

30. Stop Wireshark when nmap has finished running.

31. Which UDP ports are opened? What services are normally running on these ports?

t:l CJ • I Expressior
No. Time Isource Destination IProtoco l :Length Info
26 0 . 085927073 172.16 108 . 134 192 . 168.6 211 DNS 54 Server status request 0x0000
27 0. 0874 76764 192.168.6 . 211 [Link] DNS 60 Server stat us reques t response 0x0000
28 0 087558953 172 16 108 134 192 168 6 211 ICMP 82 Destrnation unreachable Port unreacha

(UDP Port 53 replied to the UDP scan)

32. In the screenshot below, UDP port 53 is reported to be opened. Nmap is not sure if UDP
port 161 is opened or blocked by firewall, as it did not receive any reply from UDP port
161.
L $ ·sudo nmap -sU -p21,53,80,161 192 . 168 . 153 . 165
Starting Nmap 7 . 91 ( ht tps ://nmap . org ) at 2021-04-30 22 :47 EDT
Nmap scan report f or [Link]
Host is up (0 .00082s l atency) .
PORT STATE SERVIC E
21/udp filtered ftp
53/udp open domain
80/udp f il tered http
161/udp open I fil tered snmp

AY2324 Page 5 of 8
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4b

Exercise 5. Other nmap scans

33. In Kali Linux, try other nmap options. For example, the -sV option to determine the
version number of the service.
sudo nmap -sV [Link] Change to the IP of your web-server2

34. Try the -sV option with UDP port scanning to increase the chances of finding out if the
UDP ports are opened, plus the version number of the UDP service.
sudo nmap -sV –sU –p21,53,80,161 [Link]
t
Change to the IP of your web-server2

35. If you do a UDP scan without specifying any ports, Nmap will scan 1000 most-
frequently ports, which will take a long time
.
sudo nmap -sU [Link]
Change to the IP of your web-server2
Press Control-C to stop the UDP scan.

36. You can add the -v or -vv option (verbose or more verbose) to see what Nmap is doing
during the scan.
.
sudo nmap -sU –vv [Link] Change to the IP of your web-server2

Press Control-C to stop the UDP scan.

37. You can add the --reason option to see what kind of packet the scanned port returned (or
did not return) for Nmap to make its deduction if the port is open, closed or filtered.
.
sudo nmap -sS --reason [Link] Change to the IP of your web-server2

The following screenshot shows an example of using the --reason option.

L $ ·sudo nmap -sS --reason 192.168.153 . 165

Starting Nmap 7.91 ( https: // nmap.o rg ) at 2021 -04-30 22 : 49 EDT
Nmap scan report f o r 192.168 . 153.165
Host is up, received arp-response (0 . 00089s latency).
Reason: 978 no - responses and 12 host - prohibiteds +-- 990 ports are listed as filtered because 978 ports
Not shown : 990 filtered po rts
PORT STATE SERVICE REASON did not respond, and another 12 ports replied with
21/tcp open ftp syn-ack ttl 64 an ICMP Destination Unreachable “Host
22/tcp open ssh syn-ack ttl 64
23 / tcp closed telnet reset tt l 64 Prohibited” packet
25/tcp open smtp syn -ack ttl 64
53/tcp open domain syn-ack ttl 64
80/tcp open http syn-ack ttl 64
syn-ack ttl 64 +--
110/ tcp open
443/tcp open
pop3
https syn-ack ttl 64 These ports are listed as open or closed
993 / tcp open imaps syn -ack ttl 64 because Nmap received these packets
995 / tcp open pop3s syn -ack ttl 64

38. Try the -O option to guess the operating system.

sudo nmap -O [Link] Change to the IP of your web-server2
You can also try the nmap -O option against your Win10 VM or your Host PC. Note : it
is only a best-guess of the operating system.

AY2324 Page 6 of 8
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4b

39. View the file /usr/share/nmap/nmap-services to see the list of common ports, their
service names and frequencies.

40. Try the –top-ports option to scan the top 10 most frequently ports according to the nmap-
services file.
sudo nmap --top-ports 10 [Link] Change to the IP of your web-server2

Exercise 6. Ping Sweeps and other methods to discover hosts in network

Description :
Fping can be used to ping a group of IP addresses. However, it may not always work as
firewalls may block the ping packets.
Netdiscover and Nmap can be used to send ARP requests to discover alive hosts in the
current network.

In Kali Linux
41. Use fping command to ping the range of addresses from [Link] to [Link]. Which
system is up?
fping -g [Link] [Link]
kali@kali :- $ fping -g 8.8 . 8.1 8 . 8 . 8.10
8 . 8.8.8 is alive
[Link] is unreachable You may see results like this. [Link] is the
[Link] is unreachabl e
8 . 8.8.3 is unreachabl e IP address of Google’s public DNS Server
8 . 8.8.4 is unreachable
8 . 8.8.5 is unreachable
8 . 8.8.6 is unreachabl e
8 . 8.8.7 is unreachabl e
[Link] is unreachable
8 . 8.8.10 is un reachable

42. Use Netdiscover to send ARP broadcast requests to the subnet of your Kali. Which
system is up? Replace with the subnet of your Kali.
sudo netdiscover –i eth0 –r [Link]/24 For example, if your Kali IP is
[Link] with netmask [Link]
then replace with [Link]/24
Currently scanning: Finished! Screen View: Unique Hosts
In this example,
5 Captu red ARP Req / Rep packets , f rom 5 hosts. Total size: 300
two IP addresses
are discovered : IP At MAC Address Count Len MAC Vendor/ Hostname
[Link] [Link] 00:50 :56:c0 :00:08 60 VMware, Inc.
and [Link]
[Link]
00:50 :56:e8 : f8:33
00 : 0c : 29 : ab :e9:96
60
60
VMware,
VMware,
Inc.
I nc.
[Link] [Link] 00 : 0c : 29:7c : f3:aa 60 VMware, Inc.
. [Link] 0~ : 50 : 56 : e0 :7a:70 60 VMware, I nc.

[Link] is the Host PC

[Link] is the VMware Gateway and DNS Server
[Link] is the VMware DHCP Server

Note : Netdiscover may take a while to display the results.

43. Use Nmap to do host discovery by sending ARP broadcast requests to the local network.
Which system is up? Replace with the subnet of your Kali.
sudo nmap –sn [Link]/24 For example, if your Kali IP is [Link] with netmask
[Link] then replace with [Link]/24

AY2324 Page 7 of 8
 Official (Closed), Non-Sensitive
ST2422 Ethical Hacking Essentials Practical 4b

Exercise 7. Crafting packets

You will use hping to craft ICMP packets with a spoofed source IP.

In Kali Linux
44. Start a Wireshark capture.
45. Type “icmp” in the Filter textbox to see only ICMP packets.
46. Use hping to send 2 ICMP packets to your Win10 VM or web-server2 VM.

sudo hping3 –c 2 –-icmp [Link] Change to the IP of your Win10 or web-

server2 VM

47. While Wireshark is running, look at the ICMP packets captured. Note that the ICMP
echo request packets have the source IP of your Kali.

48. Use hping to send 2 ICMP packets to your Win10 VM or web-server2 VM with a
spoofed IP

sudo hping3 –c 2 –a [Link] –-icmp [Link]

t
This is the fake IP
t
Change to the IP of your Win10 or web-
server2 VM

49. Look at the ICMP packets captured. This time the ICMP echo request packets have the
fake source IP.

(Important : Do not scan other people’s systems or networks without their permission!)

End of Practical

AY2324 Page 8 of 8