Determining network topology from the outside

Question

To what extent can an attacker generate a map of a network from outside of it?

Are network scanning tools such as nmap the only means to do this? Otherwise what other types of tools or techniques could be used?

Say you have a network with internet facing servers in a DMZ, the internal network, then internal servers in a special subnet. Is it possible to prevent attacks outside the network from learning the IP addresses of the internal servers?

What could you do to prevent this?

NOTE: I am aware that too much effort should not go into hiding this information, I am just curious and wish to learn more about what is possible.

I am also aware there are a variety of ways to gather the addresses of the internal servers in my scenario, I am only interested in the scanning aspect however.

Answer 1

I tend to use my imagination, instead of tools -- to draw a picture in my mind of how the systems and subsystems are connected.

However, w3af, 0trace, Metasploit auxiliary scanners, and tools such as SHODAN, Yeti, Maltego, Netglub, and a variety of search engine technologies can be of varying usefulness depending on your position relative to the target.

The literature refers to this process as "footprinting", "enumeration" (wrong use of this word, IMO, though), "reconnaissance" (or the short-form, "recon"), and possibly other terms. You can find a good set of procedures, practices, and examples of tool usage in books such as "Network Security Assessment, Second Edition" by Chris McNab or "Backtrack 4: Assuring Security by Penetration Testing". I also recommend the videos and presentation lectures from HD Moore and Valsmith on "Tactical Exploitation" which discuss the targeting of business processes by using nping (from nmap), or predecessors to nping such as hping3, hping2, etc.

Additionally, you could also utilize social engineering or establishing a more than zero-knowledge relationships with clients/customers that are interested in help with their information security management and/or risk management programs through vulnerability assessment or penetration-testing activities. I have found that the latter approach works best for my clients and I. You'll see network engineers, sysadmins, and application developers handing me their Visio diagrams or drawing up their architectural components and their connectivity/dependencies on a whiteboard or napkin.

Answer 2

Natting can help, but there are places where information leakage is common. If you have internal mail servers you may be exposing your internal DNS naming conventions through mail headers. IP addresses could even be listed in those headers depending on your configuration.

Error pages on servers in the DMZ could expose the internal (ie DMZ) addresses of hosts, and sometimes can even expose information about systems with interfaces internal to the network.

How much should you work to mask this information? It depends on the sensitivity of the information you're protecting internally. If you're extremely worried you'd want to look at application level firewalls that can strip that sort of information on the fly, as a double check to your configurations. Further some systems just can't have these pieces of information hidden, and an inline solution could help cover the gaps.

Answer 3

An attacker will use anything to map your network, before or while performing an attack.

Depending on how your network is separated from the outside world, many techniques can be used. Have you ever wondered why nmap has so many scanning methods? Firewall misconfiguration can lead, for example, to situations where ACK or FIN scans pass through, because the firewall is only blocking SYN packets (as a way to block new connections to ports).

Other types of misconfigurations can provide more information. For example there is a large amount of cisco routers out there with default snmp community strings (or easily guessable), that can give you the whole configuration at request.

DNS servers are easily misconfigured to permit zone transfers and thus leak internal information to anyone.

If the attacker is able to sniff data 'outside' the network, he can also find lots of information about internal addresses in messages from various protocols.

Finally vulnerabilities in web applications or services visible from the outside can mean a compromise of that host, and when that happens, the attacker can further enumerate and probably map everything easily.

Answer 4

Are network scanning tools such as nmap the only means to do this?

No.

Otherwise what other types of tools or techniques could be used?

Does information leakage and data mining count? Simply browsing linkedin for the individuals responsible for the network management may reveal details as well as mining public postings for clues. Often you can derive the exact versions of the software or of the infrastructure equipment in use and occasionally you'll even run across a full posting of a switch or firewall configuration on a public forum.

If intelligence gathering is fair play then I'd suggest trying out Maltego http://www.paterva.com/web5/.

Answer 5

If you want to understand the structure of the network (e.g., the routers and the topology of the links), you could use traceroute. See also firewalk, which is a traceroute that goes through some firewalls.

Answer 6

Some http proxies may disclose the clients source IP address that made the request.

If you look at the traffic going from your proxy to the outside world you may see in the http header a field called X-Forwarded-For. This value is normally the clients IP address.

An attacker would need the users on the network to connect to a page on server that they control to access this information.