12

Hackers usually attack open ports and services, but I want to know how they find security holes in specific ports or services.

7
  • 2
    I re-tagged your question with some answers to your question.
    – schroeder
    Jul 21, 2020 at 7:18
  • Thanks but how do you vulnerability scan a port? Also what are you suppose to look for when you are information gathering? Jul 21, 2020 at 8:08
  • Please google "vulnerability scanners"
    – schroeder
    Jul 21, 2020 at 8:09
  • 1
    @ghostghoster Re. "what more is there to figure out about a port other than the service that runs on it"... essentially, nothing. The port is just a "connector" between the outside world and a process/service that might be running behind it. The tools described in the other answers are not about finding vulnerabilities in ports, but in the processes connected to those ports.
    – TripeHound
    Jul 21, 2020 at 10:51
  • 8
    Ports don't have vulnerabilities, services do.
    – user253751
    Jul 21, 2020 at 16:29

2 Answers 2

23

Basically some tools (like nmap) try to open session over each port of a target. If the session is opened, the tool will try to dialog with the port in every way it knows (http, ftp, smtp, mysql, ...) until it finds the good protocol.

For UDP, the first step is omitted as this is a sessionless protocol.

Before trying every protocol, the scanner can often rely on the banner sent by the server after the session is opened (for example something like "welcome to OpenSSH server v2.2, only the corporate users are allowed to login").

Knowing an open port and the associated protocol the hacker can start to look for vulnerabilities.
There are 3 main ways to do that:

  • recognize a specific version displayed in the banner and look for publicly known vulnerabilities associated with this version (based on the CVE database for example)
  • active exploitation: try to run exploits (a program written to exploit a vulnerability) against the target and see which ones are succeeding
  • read or deduce how the service is configured to discover vulnerabilities due to misconfiguration (most of the time, a service displays its configuration, if not, it is possible to deduce if a specific setting is present or not by trying to call the associated function)

If your question was more about how the vulnerabilities are discovered at the first time. It's more by code audits, bug bounties, whitebox testing, reverse engineering, ... in a controlled environment.
Then the discovered vulnerabilities are registered in the CVE database (maintained by the MITRE) and become public vulnerabilities that everyone can know if a host is affected knowing the version it uses.

4
  • 3
    Should mention that they don't always get registered in a public database. Some vulnerabilities are kept and hoarded as zero-days so that they can be used later or sold. Sometimes this is done by government agencies and used as weapons
    – slebetman
    Jul 22, 2020 at 1:55
  • 1
    I wrote the dedicated article on wikipedia french fr.wikipedia.org/wiki/Scanner_de_vuln%C3%A9rabilit%C3%A9 but the english version is not well documented
    – Sibwara
    Jul 22, 2020 at 10:45
  • @Sibwara Thanks for sharing. C'est plutôt rare de tomber sur des articles wikipedia avec davantage de contenu en français qu'en anglais.
    – Gainz
    Jul 22, 2020 at 13:17
  • 1
    @Gainz. You're welcome. But since my all rebuild of the initial article, many "commercial oriented paragraphs" were added. C'est un peu énervant
    – Sibwara
    Jul 22, 2020 at 15:34
11

Tools like Metasploit can be used to automate this process. The tool scans the target host for open ports, then attempts to identify the services running on these ports, then attempts to exploit known vulnerabilities in these services.

These tools can also be used to find and exploit vulnerabilities resulting common mistakes made by developers, such as SQL injection vulnerabilities, XSS vulnerabilities, etc.

0

Not the answer you're looking for? Browse other questions tagged .