Protocols

From Grayhat cheatsheets
Jump to navigationJump to search

This page describes briefly different protocols that the pentester is likely to find when researching a host. Sometimes these protocols are new to the researcher, and time needs to be spent learning about the protocol, instead of the pentest. This page describes briefly some tools that can be used against protocols.


SMB (ports 139, 445)[edit | edit source]

Server Message Block. It is a client-server protocol to connect hosts and allow them to share files or printers accross a network. Different implementations of this protocol exist, based on the platform. Two common ones are Microsoft's, and Linux's Samba. This protocol lets computers exchange messages, and one acts as the server. We may find a machine which is acting as an SMB server, with ports 139 and 445 open. Attack vectors are described in more detail in the SMB page.


FTP (ports 20, 21)[edit | edit source]

File transfer protocol, used to upload and download files from and to a server. Anonymous connections may be possible. If the use of port 20 is enabled, port 20 is used for file transfers, and port 21 for ftp commands. If not, both files and commands go through port 21, resulting in a slower speed. Attack vectors are described in more detail in the FTP page.


HTTP, HTTPS (ports 80, 443)[edit | edit source]

The usual HyperText Transfer Protocol, used to transfer HTML pages from a server to a web browser, allowing us to browse the web. On port 443 it is encrypted (HTTPS). Attack vectors are described in more detail in the HTTP page.

RPC (port 135)[edit | edit source]

Microsoft Remote Procedure Call defines a powerful technology for creating distributed client/server programs. The RPC run-time stubs and libraries manage most of the processes relating to network protocols and communication. This enables you to focus on the details of the application rather than the details of the network.


SNMP (port 161)[edit | edit source]

Simple Network Management Protocol is an Internet Standard protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior. Usually allows the attacker to enumerate various elements of the victim. The program onesixtyone is useful for this

Kerberos (ports 88, 750)[edit | edit source]

Kerberos is a computer network authentication protocol that works on the basis of tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner.


WebDAV[edit | edit source]

WebDAV (Web Distributed Authoring and Versioning) is an extension of HTTP 1.1. Originally the web was only used to display information, and webapps are clever ways to make it interactive. But WebDAV aims at making the wave something interactive from the ground up, so it allows writing content directly to a remote server via HTTP as if we were working on a local server. Given the appropriate circumstances, we can use Cadaver to upload files if WebDAV is available. It can be installed as a plugin for example in the Apache server.