Wednesday, January 13, 2010

Backtrack 4: Information Gathering: Route: Protos – IP protocol scanner

The tool I will be reviewing is from the same suite of tools as netenum and netmask. Protos is a IP protocol scanner. It goes through all possible IP protocols and uses a negative scan to sort out unsupported protocols which should be reported by the target using ICMP protocol unreachable messages.
Lets have a look at our options:

01root@666:~# protos -h
02protos: invalid option -- 'h'
03Usage: ./protos -i eth0 -d 10.1.2.3 -v
04-v             verbose
05-V             show which protocols are not supported
06-u             don't ping targets first
07-s             make the scan slow (for very remote devices)
08-L             show the long protocol name and it's reference (RFC)
09-p x           number of probes (default=5)
10-S x           sleeptime is x (default=1)
11-a x           continue scan afterwards for x seconds (default=3)
12-d dest        destination (IP or IP/MASK)
13-i interface   the eth0 stuff
14-W             don't scan, just print the protocol list

If you just use the -W option, Protos will spit out a list of all the protocols it can detect: (the output is truncated)
view source
print?
01root@666:~# protos -W
020       HOPOPT       IPv6 Hop-by-Hop Option [RFC1883]
031       ICMP         Internet Control Message [RFC792]
042       IGMP         Internet Group Management [RFC1112]
053       GGP          Gateway-to-Gateway [RFC823]
064       IPenc        IP in IP (encapsulation) [RFC2003]
075       ST           Stream [RFC1190,IEN119]
086       TCP          Transmission Control [RFC793]
097       CBT          CBT [Ballardie]
108       EGP          Exterior Gateway Protocol [RFC888,DLM1]
119       IGP          any private interior gateway [IANA]
1210      BBN-RCC-MON  BBN RCC Monitoring [SGC]
1311      NVP-II       Network Voice Protocol [RFC741,SC3]
1412      PUP          PUP [PUP,XEROX]
1513      ARGUS        ARGUS [RWS4]
1614      EMCON        EMCON [BN7]
1715      XNET         Cross Net Debugger [IEN158,JFH2]
1816      CHAOS        Chaos [NC3]
1917      UDP          User Datagram [RFC768,JBP]
2018      MUX          Multiplexing [IEN90,JBP]
2119      DCN-MEAS     DCN Measurement Subsystems [DLM1]
2220      HMP          Host Monitoring [RFC869,RH6]
2321      PRM          Packet Radio Measurement [ZSU]
2422      XNS-IDP      XEROX NS IDP [ETHERNET,XEROX]
2523      TRUNK-1      Trunk-1 [BWB6]
2624      TRUNK-2      Trunk-2 [BWB6]

Lets try a run at a real IP:

001root@666:~# protos -i eth0 -d 72.47.202.218 -v -L
00272.47.202.218 is alive
003
TARGET  72.47.202.218
004Running in verbose mode
005        Afterscan delay is 3
006        running in fast scan - pause every 1 probes
007        continuing scan afterwards for 3 secs
008        supported protocols will be reported
009        you supplied the target(s) 72.47.202.218
010Scanning 72.47.202.218
011>>>>>>>>> RESULTS >>>>>>>>>>
012
01372.47.202.218 may be running (did not negate):
014HOPOPT          IPv6 Hop-by-Hop Option [RFC1883]
015ICMP            Internet Control Message [RFC792]
016IGMP            Internet Group Management [RFC1112]
017TCP             Transmission Control [RFC793]
018EGP             Exterior Gateway Protocol [RFC888,DLM1]
019BBN-RCC-MON     BBN RCC Monitoring [SGC]
020PUP             PUP [PUP,XEROX]
021EMCON           EMCON [BN7]
022CHAOS           Chaos [NC3]
023UDP             User Datagram [RFC768,JBP]
024HMP             Host Monitoring [RFC869,RH6]
025TRUNK-1         Trunk-1 [BWB6]
026LEAF-1          Leaf-1 [BWB6]
027RDP             Reliable Data Protocol [RFC908,RH6]
028ISO-TP4         ISO Transport Protocol Class 4 [RFC905,RC77]
029MFE-NSP         MFE Network Services Protocol [MFENET,BCH2]
030SEP             Sequential Exchange Protocol [JC120]
031IDPR            Inter-Domain Policy Routing Protocol [MXS1]
032DDP             Datagram Delivery Protocol [WXC]
033TP++            TP++ Transport Protocol [DXF]
034IPv6            Ipv6 [Deering]
035IPv6-Route      Routing Header for IPv6 [Deering]
036IDRP            Inter-Domain Routing Protocol [Sue Hares]
037GRE             General Routing Encapsulation [Tony Li]
038BNA             BNA [Gary Salamon]
039AH              Authentication Header for IPv6 [RFC1826]
040SWIPE           IP with Encryption [JI6]
041MOBILE          IP Mobility [Perkins]
042SKIP            SKIP [Markson]
043IPv6-ICMP       ICMP for IPv6 [RFC1883]
04461              any host internal protocol [IANA]
04563              any local network [IANA]
046KRYPTOLAN       Kryptolan [PXL1]
047IPPC            Internet Pluribus Packet Core [SHB]
048SAT-MON         SATNET Monitoring [SHB]
049IPCV            Internet Packet Core Utility [SHB]
050CPHB            Computer Protocol Heart Beat [DXM2]
051PVP             Packet Video Protocol [SC3]
052SUN-ND          SUN ND PROTOCOL-Temporary [WM3]
053WB-EXPAK        WIDEBAND EXPAK [SHB]
054VMTP            VMTP [DRC3]
055VINES           VINES [BXH]
056NSFNET-IGP      NSFNET-IGP [HWB]
057TCF             TCF [GAL5]
058OSPFIGP         OSPFIGP [RFC1583,JTM4]
059LARP            Locus Address Resolution Protocol [BXH]
060AX.25           AX.25 Frames [BK29]
061MICP            Mobile Internetworking Control Pro. [JI6]
062ETHERIP         Ethernet-within-IP Encapsulation [RDH1]
06399PrivEncr      any private encryption scheme [IANA]
064IFMP            Ipsilon Flow Management Protocol [Hinden]
065PIM             Protocol Independent Multicast [Farinacci]
066SCPS            SCPS [Durst]
067A/N             Active Networks [Braden]
068SNP             Sitara Networks Protocol [Sridhar]
069IPX-in-IP       IPX in IP [Lee]
070IATP            Interactive Agent Transfer Protocol [Murphy]
071SRP             SpectraLink Radio Protocol [Hamilton]
072SMP             Simple Message Protocol [Ekblad]
073PTP             Performance Transparency Protocol [Welzl]
074FIRE            [Partridge]
075CRUDP           Combat Radio User Datagram [Sautter]
076IPLT            [Hollbach]
077PIPE            Private IP Encapsulation within IP [Petri]
078FC              Fibre Channel [Rajagopal]
079135             [IANA]
080137             [IANA]
081139             [IANA]
082141             [IANA]
083143             [IANA]
084145             [IANA]
085147             [IANA]
086149             [IANA]
087151             [IANA]
088153             [IANA]
089155             [IANA]
090157             [IANA]
091159             [IANA]
092161             [IANA]
093163             [IANA]
094165             [IANA]
095167             [IANA]
096169             [IANA]
097171             [IANA]
098173             [IANA]
099175             [IANA]
100177             [IANA]
101179             [IANA]
102181             [IANA]
103183             [IANA]
104185             [IANA]
105187             [IANA]
106189             [IANA]
107191             [IANA]
108193             [IANA]
109195             [IANA]
110197             [IANA]
111199             [IANA]
112201             [IANA]
113203             [IANA]
114205             [IANA]
115208             [IANA]
116209             [IANA]
117212             [IANA]
118214             [IANA]
119216             [IANA]
120218             [IANA]
121220             [IANA]
122222             [IANA]
123224             [IANA]
124226             [IANA]
125228             [IANA]
126230             [IANA]
127232             [IANA]
128234             [IANA]
129236             [IANA]
130238             [IANA]
131240             [IANA]
132242             [IANA]
133244             [IANA]
134246             [IANA]
135248             [IANA]
136250             [IANA]
137252             [IANA]
138254             [IANA]

Thats really all the output it gives. I will be honest I do not see much use for this tool however since we are reviewing every tool and I had to do this one.
Posted by SE4l at 10:53 PM

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)