Footprirvting a Target Network .p3

Lab 1

Footprinting a Target Network Using the Ping Utility

Ping is a computer network ad mini strati0)1 utility used to test the reachability of a host on an Internet protocol (IP) network and to measure the ronnd-trip timefor messages sent from the originating host to a destination computer.

Lab Scenario

As a professional penetration tester, you will need to check for the reachability of a computer 111 a network. Ping is one of the utilities that will allow you to gather important information like IP address, maximum Packet Fame size, etc. about the network computer to aid 111 successful penetration test.

Lab Objectives

Tins lab provides insight into the ping command and shows how to gather information using the ping command. The lab teaches how to:
■ Use ping
■ Emulate the tracert (traceroute) command with ping
■ Find maximum frame size for the network
■ Identity ICMP type and code for echo request and echo reply packets

Lab Environment

To carry out this lab you need:
■ Administrative privileges to run tools
■ TCP/IP settings correctly configured and an accessible DNS server
■ Tins lab will work 111 the CEH lab environment - on Windows Server 2012. Windows 8 , Windows Server 2008. and Windows 7

Lab Duration

Tune: 10 Minutes

Overview of Ping
The ping command sends Internet Control Message Protocol (ICMP) echo request packets to the target host and waits tor an ICMP response. During tins requestresponse process, ping measures the time from transmission to reception, known as die round-trip time, and records any loss of packets.

Lab Tasks

1. Find the IP address lor http:/ Avww.certihedhacker.com
2. To launch Start menu, hover the mouse cursor in the lower-left corner of the desktop

FIGURE 1.1: Windows Server 2012 — Desktop view

3. Click Command Prompt app to open the command prompt window

FIGURE 1.2: Windows Server 2012—Apps

4. Type ping www.certifiedhacker.com 111 the command prompt, and press Enter to find out its IP address

5. The displayed response should be similar to the one shown 111 the following screenshot

FIGURE 1.3: The ping command to extract die IP address for www.certifiedhacker.com

6. You receive the IP address of www.certifledhacker.com that is 202.75.54.101

7. You also get information 011 Ping Statistics, such as packets sent, packets received, packets lost, and Approximate round-trip time

8. Now, find out the maximum frame size 011 the network. 111 the command prompt, type ping www.certifiedhacker.com - f - l 1500

FIGURE 1.4: The ping command for www.certifiedhacker-com with —f —11500 options

9. The display Packet needs to be fragmented but DF s e t means that the frame is too large to be on the network and needs to be fragmented. Since we used -f switch with the ping command, the packet was not sent, and the ping command returned this error

10. Type ping www.certifiedhacker.com - f - l 1300

FIGURE 1.5: The ping command for www.certifiedhacker.com with —f —11300 options

11. You can see that the maximum packet size is le s s than 1500 bytes and more than 1300 bytes

12. Now, try different values until you find the maximum frame size. For instance, ping www.certifiedhacker.com - f - l 1473 replies with Packet needs to be fragmented but DF s e t and ping

www.certifiedhacker.com - f - l 1472 replies with a su c c e ssfu l ping. It indicates that 1472 bytes is the maximum frame size on tins machine network

Note: The maximum frame size will differ depending upon on the network

FIGURE 1.6: The ping command for www.certifiedhacker.com with —f —11473 options

FIGURE 1.7: Hie ping command for www.certifiedhacker.com with —f —11472 options

13. Now, find out what happens when TTL (Time to Live) expires. Ever}1 frame 011 the network has TTL defined. If TTL reaches 0, the router discards the packet. This mechanism prevents the lo ss of packets

14. 111 the command prompt, type ping www.certifiedhacker.com -i 3. The displayed response should be similar to the one shown 111 the following figure, but with a different IP address

FIGURE 1.8: The ping command for \vvvw cfrrifiedhacker.com with -i 3 options

15. Reply from 183.82.14.17: TTL expired in transit means that the router (183.82.14.17, students will have some other IP address) discarded the frame, because its TTL has expired (reached 0)

16. The Emulate tracert (traceroute) command, using ping - manually, found the route from your PC to ww~w.cert111edhacker.com

17. The results you receive are different from those 111 tins lab. Your results may also be different from those of the person sitting next to you

18. 111 the command prompt, type ping www.certifiedhacker.com -i 1 -n 1. (Use -11 1 in order to produce only one answer, instead of receiving four answers on Windows or pinging forever on Linux.) The displayed response should be similar to the one shown in the following figure

FIGURE 1.9: The ping command for ™ ׳!י cr rri fiedl1acker.com with —i 1 —n 1 options

19. 111 the command prompt, type ping www.certifiedhacker.com -i 2 -n 1. The only difference between the previous pmg command and tliis one is -i 2 . The displayed response should be similar to the one shown 111 the following figure

FIGURE 1.10: The ping command for www.certifiedl1acke1.co1n with -i 2 - 111 options

20. 111 the command prompt, type ping www.certifiedhacker.com -i 3 -n 1. Use -n 1 111 order to produce only one answer (instead of four on Windows or pinging forever on Linux). The displayed response should be similar to the one shown 111 the following figure

FIGURE 1.11: Hie ping command for www.cerdfiedl1acker.com with —i 3 —n 1 options

21. 111 the command prompt, type ping www.certifiedhacker.com -i 4 -n 1 . Use -n 1 111 order to produce only one answer (instead of four on Windows or pinging forever on Linux). The displayed response should be similar to the one shown 111 the following figure

FIGURE 1.12: Hie ping command for wT.vw.certifiedhacker.com with —i 4 —n 1 options

22. We have received the answer from the same IP address in two different the —1 s12e option means to . . . . _ . . . send the buffer size. steps. Tins one identifies the packet filter; some packet filters do not decrement TTL and are therefore invisible