CEH Study (tools)

Study online at quizlet.com/_3la4dl

1. Hping2 This uses TCP by default 7. NMAP -sS SYN scan or half open scan
Switches -sT TCP connect (3-way handshake)
2. Kismet Linux or OS X sniffing tool
-sF FIN scan
Truly passive per ECC council
-sX Xmas scan (FIN URG PSH set)
3. NBTSTAT Used to display netbios info like name -sC Run defaul script
tables, name cache, etc... -sP Ping scan
-a (lists remote machines name table given -sV Version detection
its hostname) -sU UDP scan
-A (lists remote machines name table given -sO IP Protocol scan
its IP) -O OS Scan
-c (lists NBT cache of remote machines -sA ACK Scan
names& IP) -sW Windows scan
-r (lists names resolved by broadcast via -sR RPC Scan (alias for -sV)
WINS) -sL List Scan
-R (Purges and reloads the remote cache -sI Idle Scan
name table) -b FTP Bounce Scan
-S (list sessions table with destination IP -P0 Dont ping
address) -PT TCP PING
-s (lists sessions table converting dest IP -PS SYN PING
address to Netbios names) -PI ICMP PING
-RR (Sends name release packets to WINS -PB PI and PT ping
and tehn starts a refresh process) -PP ICMP Timestamp
4. NetCat (NC) Ncat IPADDRESS PORTNUMBER (connects -PM ICMP Netmask
to IP as client -oN Normal output
ncat -l portnumber (listen mode for inbound -oX XML output
connections) -oG NMAP Grepable output
ncat -e programname (launch program on -oA NMAP All output
successful connection) -P specify port range (-P 1-2521)
ncat -L Listen harder; re-listen on closed 8. NSLookup Enter interactive mode by typing NSLOOKUP
socket Use "set type=" to search for specific record types
ncat -o local port number (MX, SOA, A, PTR, NS, CNAME, SRV, ANY)
ncat -t Answer telnet negotiation Specify server name using "server servername" if
ncat -u UDP mode you want a specific DNS server to reply
ncat -v verbose mode
9. WinDUMP Windows version of TCP dump
ncat -w seconds (timeout for connect)
ncat -n tells ncat not to perform DNS
lookups on machines found
5. Netstumbler Tool for windows
6. NMAP scan Paranoid Scan (slowest, -T0)
(speed) types Sneaky Scan -T1
Polite Scan -T2
Normal Scan (Default, -T3)
Aggressive Scan -T4
Insane Scan (fastest, -T5)