13. Preparation for Port Scanning

Python provides various modules that can be used to hack a network. The typical ones are “scapy” and “pcapy”. “scapy” is a multi-purpose tool that can be used for network hacking and providing various functions like Packet Sniffing and Port Scanning. However, powerful tools like NMap, Wireshark, and Metasploit have also been developed, and development of the Python hacking module has been interrupted. These are also difficult to install, and it is difficult to even obtain the right module for your specific environment. Python also supports application hacking by providing an interface to NMap and Wireshark.

First, let's look at the hacking environment. Most of the information in security guides has banned opening FTP ports. It is common to upload files via FTP ports due to speed and ease of management. For the test, it is assumed that the administrator opened another FTP port in an environment running an Apache Web server.

Hacking via port scanning proceeds in the following manner.

Figure 13-1 Port Scanning Hacking Procedure

• Installing NMap and Python nmap

First, install the Python nmap and the NMap module. For NMap, you can access the “http://nmap.org/download.html” website and download the installation file. For Python nmap, access the “http://xael.org/norman/python/python-nmap” website and download the zipped file. Extract the installation file, and first, make sure that the system configuration for the “Path” specifies the directory where Python is installed. Open the command program on Windows and go to the folder where you have unzipped the file. It is possible to install the program if you run the command as “python setup.py install”.

• Port Scanning hacking procedure

After the program has been installed, you can discover the open ports via port scanning. Nmap provides information on the open ports and services that can be used together. If port 21 is open for FTP, you can find the password by performing a Password Cracking hack. The FTP protocol supports a command that can provide directory information as well as file transfers. A Python program can therefore be used to find the directory information that is used by the web service (Apache). Finally, upload a script that is capable of conducting a Web Shell attack in that directory, and then run the file through a browser.