Class-B MaDe Ez
Doing a Class-B?
[+] Hypothetical Scenario:
[+] You just joined a Company, Organization, or Enterprise and they want you to conduct an external penetration test or assessment of their perimeter.
[+] You have been tasked to assess and build a map of what assets are externally facing. Further, you need to scan a possible 65,534 hosts in the 176.134.0.0 range. That means we have to cover 176.134.0-255.0-255.
[+] But you have one week to do it.
Oh no...
[+] Yeah, intense right? Well - let me assist you with some tactical ways of addressing this issue.
[+] First things first - schedule a meeting with your Stakeholders if they haven't already scheduled one for ya.
[+] I also have a fantastic Scoping Call Template that will assist you through the process of speaking with Stakeholders.
1. Introductions and Ice-Breaking:
"Let's start with introductions to ease any potential nerves."
(It's common for stakeholders to feel apprehensive when interacting with cybersecurity professionals, even though our intentions are purely constructive.)
--------------------------------------------------------------------------------------------------
2. Purpose of the Scoping Call:
"Hey guys, do we're going to be discussing the purpose of this Scoping Call to emphasize its importance for this engagement and future engagements. Understanding the objectives and expectations early on ensures a smoother process from now, to our recon phases, active recon, analysis, and formal report."
--------------------------------------------------------------------------------------------------
3. Defining the Target Scope:
"What exactly is the target scope of our assessment? Are we focusing on a single application, or are we looking at a broader Class-C or Class-B assessment?"
Target Scope:
--------------------------------------------------------------------------------------------------
4. Whitelisting Considerations:
"Should we consider whitelisting or allowing specific IPs, Workstation-IDs, or Active Directory credentials? This approach would prevent IDS/IPS systems from flagging our activities as malicious, enabling us to comprehensively map the target scope without frequent interruptions to coordinate with the firewall team. Ultimately, this efficiency helps us adhere to our timeline. Just makes things smoother for everybody involved."
(Have your Workstation ID, AD Creds, and Public or Private IP address ready depending on whether it's an internal or external assessment.)
--------------------------------------------------------------------------------------------------
5. Concerns and Focus Areas:
"Are there any particular endpoints on your web servers that raise concerns or require special attention? Highlighting these areas early on will ensure they are thoroughly addressed in the formal report. Really, we just want to make sure that we aren't targeting sensitive assets with anything that could even potentially be destructive."
Concerns / Areas of Sensitivity:
--------------------------------------------------------------------------------------------------
6. Information for Grey-Box Assessments:
"If we're conducting a grey-box assessment, could you provide the port numbers for the services under review? Having this information upfront will me and my team significantly enhance the efficiency and precision of our Host Discovery phase. What this means is that we can more accurately scan relevant hosts for purposes of discovery as opposed to wasting time with un-assigned IPs, un-used ports and services - etc."
Grey Box Information:
--------------------------------------------------------------------------------------------------
7. Contact Information for Key Personnel:
"Could you share the email addresses of the Project Leads, Team Leads, Technical Leads, or Project Managers? I'd like to share our Scoping Call notes to keep everyone informed and facilitate ongoing communication. This will be especially useful for urgent communications arising from the assessment and for distributing the formal report or other deliverables."
Key Personnel and Points of Contact:[+] Okay great, so you can just copy and paste/use or modify that to your liking - but it's a start.
[+] Always grow your template for calls with Stakeholders and customize it to your Organization's needs.
==========================================================================================
[+] Okay great, so you got your teamplate, you had your meeting.
Yea
[+] Now comes time for the engagement right?
Yea
[+] So the idea here is that we don't want to perform an nmap -p- scan to check for all 65,535 ports.
"Why not?"
[+] You'll be done next year.
"Oh."
[+] That's right - so we get the ports ahead of time in our Scoping Call with some recon - that way we can meet deadlines and at the same time cover ~65,000 machine IP spaces.
"That's kinda smart......"
"So what's the scan? We gonna use Nessus? OpenVAS? Qualys?"
[+] Nope.
"Why not?"
[+] Money and licensing - plus we need want to be more surgical with our scans. That means straight Nmap.
"Okay I got Nmap, etc - but what about the reporting format? The Stakeholder wants a report."
[+] I got you covered.
"Huh?"
[+] So basically you need to have a list for 255.255.x.x for both the third and fourth octet - a list in increments. For example, we have the range 176.134.0.0 right?
"Okay I'm tracking."
[+] Super. So you need to create a flat-file called "full-scope.txt" that will look something like this (obviously replace the digits for the first and second octets with what your actual scope will be. In-fact, the best way to do this is with a Bash Script to create your scope file.)
"Makes sense!"
[+] Yup 😉
Create-Scope.sh
(for scenario/hypothetical range 176.134.0.0)
#!/bin/bash
# Define the base IP
base="176.134"
# Loop through the third octet from 0 to 255
for i in {0..255}; do
echo "$base.$i.0-255" >> full-scope.txt
doneResult?
176.134.0.0-255
176.134.1.0-255
176.134.2.0-255
176.134.3.0-255
176.134.4.0-255
176.134.5.0-255
176.134.6.0-255
176.134.7.0-255
176.134.8.0-255
176.134.9.0-255
176.134.10.0-255
176.134.11.0-255
176.134.12.0-255
176.134.13.0-255
176.134.14.0-255
176.134.15.0-255
176.134.16.0-255
176.134.17.0-255
176.134.18.0-255
176.134.19.0-255
176.134.20.0-255
176.134.21.0-255
176.134.22.0-255
176.134.23.0-255
176.134.24.0-255
176.134.25.0-255
176.134.26.0-255
176.134.27.0-255
176.134.28.0-255
176.134.29.0-255
176.134.30.0-255
176.134.31.0-255
176.134.32.0-255
176.134.33.0-255
176.134.34.0-255
176.134.35.0-255
176.134.36.0-255
176.134.37.0-255
176.134.38.0-255
176.134.39.0-255
176.134.40.0-255
176.134.41.0-255
176.134.42.0-255
176.134.43.0-255
176.134.44.0-255
176.134.45.0-255
176.134.46.0-255
176.134.47.0-255
176.134.48.0-255
176.134.49.0-255
176.134.50.0-255
176.134.51.0-255
176.134.52.0-255
176.134.53.0-255
176.134.54.0-255
176.134.55.0-255
176.134.56.0-255
176.134.57.0-255
176.134.58.0-255
176.134.59.0-255
176.134.60.0-255
176.134.61.0-255
176.134.62.0-255
176.134.63.0-255
176.134.64.0-255
176.134.65.0-255
176.134.66.0-255
176.134.67.0-255
176.134.68.0-255
176.134.69.0-255
176.134.70.0-255
176.134.71.0-255
176.134.72.0-255
176.134.73.0-255
176.134.74.0-255
176.134.75.0-255
176.134.76.0-255
176.134.77.0-255
176.134.78.0-255
176.134.79.0-255
176.134.80.0-255
176.134.81.0-255
176.134.82.0-255
176.134.83.0-255
176.134.84.0-255
176.134.85.0-255
176.134.86.0-255
176.134.87.0-255
176.134.88.0-255
176.134.89.0-255
176.134.90.0-255
176.134.91.0-255
176.134.92.0-255
176.134.93.0-255
176.134.94.0-255
176.134.95.0-255
176.134.96.0-255
176.134.97.0-255
176.134.98.0-255
176.134.99.0-255
176.134.100.0-255
176.134.101.0-255
176.134.102.0-255
176.134.103.0-255
176.134.104.0-255
176.134.105.0-255
176.134.106.0-255
176.134.107.0-255
176.134.108.0-255
176.134.109.0-255
176.134.110.0-255
176.134.111.0-255
176.134.112.0-255
176.134.113.0-255
176.134.114.0-255
176.134.115.0-255
176.134.116.0-255
176.134.117.0-255
176.134.118.0-255
176.134.119.0-255
176.134.120.0-255
176.134.121.0-255
176.134.122.0-255
176.134.123.0-255
176.134.124.0-255
176.134.125.0-255
176.134.126.0-255
176.134.127.0-255
176.134.128.0-255
176.134.129.0-255
176.134.130.0-255
176.134.131.0-255
176.134.132.0-255
176.134.133.0-255
176.134.134.0-255
176.134.135.0-255
176.134.136.0-255
176.134.137.0-255
176.134.138.0-255
176.134.139.0-255
176.134.140.0-255
176.134.141.0-255
176.134.142.0-255
176.134.143.0-255
176.134.144.0-255
176.134.145.0-255
176.134.146.0-255
176.134.147.0-255
176.134.148.0-255
176.134.149.0-255
176.134.150.0-255
176.134.151.0-255
176.134.152.0-255
176.134.153.0-255
176.134.154.0-255
176.134.155.0-255
176.134.156.0-255
176.134.157.0-255
176.134.158.0-255
176.134.159.0-255
176.134.160.0-255
176.134.161.0-255
176.134.162.0-255
176.134.163.0-255
176.134.164.0-255
176.134.165.0-255
176.134.166.0-255
176.134.167.0-255
176.134.168.0-255
176.134.169.0-255
176.134.170.0-255
176.134.171.0-255
176.134.172.0-255
176.134.173.0-255
176.134.174.0-255
176.134.175.0-255
176.134.176.0-255
176.134.177.0-255
176.134.178.0-255
176.134.179.0-255
176.134.180.0-255
176.134.181.0-255
176.134.182.0-255
176.134.183.0-255
176.134.184.0-255
176.134.185.0-255
176.134.186.0-255
176.134.187.0-255
176.134.188.0-255
176.134.189.0-255
176.134.190.0-255
176.134.191.0-255
176.134.192.0-255
176.134.193.0-255
176.134.194.0-255
176.134.195.0-255
176.134.196.0-255
176.134.197.0-255
176.134.198.0-255
176.134.199.0-255
176.134.200.0-255
176.134.201.0-255
176.134.202.0-255
176.134.203.0-255
176.134.204.0-255
176.134.205.0-255
176.134.206.0-255
176.134.207.0-255
176.134.208.0-255
176.134.209.0-255
176.134.210.0-255
176.134.211.0-255
176.134.212.0-255
176.134.213.0-255
176.134.214.0-255
176.134.215.0-255
176.134.216.0-255
176.134.217.0-255
176.134.218.0-255
176.134.219.0-255
176.134.220.0-255
176.134.221.0-255
176.134.222.0-255
176.134.223.0-255
176.134.224.0-255
176.134.225.0-255
176.134.226.0-255
176.134.227.0-255
176.134.228.0-255
176.134.229.0-255
176.134.230.0-255
176.134.231.0-255
176.134.232.0-255
176.134.233.0-255
176.134.234.0-255
176.134.235.0-255
176.134.236.0-255
176.134.237.0-255
176.134.238.0-255
176.134.239.0-255
176.134.240.0-255
176.134.241.0-255
176.134.242.0-255
176.134.243.0-255
176.134.244.0-255
176.134.245.0-255
176.134.246.0-255
176.134.247.0-255
176.134.248.0-255
176.134.249.0-255
176.134.250.0-255
176.134.251.0-255
176.134.252.0-255
176.134.253.0-255
176.134.254.0-255
176.134.255.0-255
[+] There, so now you have full-scope.txt
"DUDE. NICE!"
[+] We're not done yet.
"Right...right - okay following."
[+] Excellent. Now we're going to break this into two phases.
[+] Phase 1: Just find out what's alive down there. Pure host discovery - we aren't looking to check services, versions, mis-configs or anything else. We just want to know what's online and what's not with respect to our specific port numbers.
"Okay, so we just determine what's online first."
[+] Yes.
"Then we use whatever turned up out of those ~65,000 IPs into a separate scope file for actual enumeration?"
Phase 2: Throw enumeration at the identified alive hosts only.
[+] This will be a separate scope file that you will create after the first Host Discovery scan is done.
Nmap HOST DISCOVERY scan (Evasive - Phase 1):
nmap -p21,22,23,25,53,80,110,111,135,139,143,161,443,445,465,587,636,993,995,1433,1521,2222,3306,3389,3780,5432,5601,5900,5985,5986,6379,7001,8000,8080,8081,8088,8090,8443,8888,9200,9300,10000,10001,10050,10443,11211,20000,27000,27017,33848,50000,50030,50070,61616,62078 -T4 -sX -oA Host-Discovery-Report --stylesheet https://raw.githubusercontent.com/honze-net/nmap-bootstrap-xsl/master/nmap-bootstrap.xsl -iL full-scope.txtNmap scan (In the scenario of Allow-Listed Ahead of Time - Phase 1):
nmap -p21,22,23,25,53,80,110,111,135,139,143,161,443,445,465,587,636,993,995,1433,1521,2222,3306,3389,3780,5432,5601,5900,5985,5986,6379,7001,8000,8080,8081,8088,8090,8443,8888,9200,9300,10000,10001,10050,10443,11211,20000,27000,27017,33848,50000,50030,50070,61616,62078 -T4 -oA Host-Discovery-Report --stylesheet https://raw.githubusercontent.com/honze-net/nmap-bootstrap-xsl/master/nmap-bootstrap.xsl -iL full-scope.txt[+] Ok dude, now you should have a report that looks something like the below once you run "firefox Host-Discovery-Report.xml"
[+] The cool thing is now that we have our Host Discovery scan of this hypothetical Class-B done - we also have it in XML format. This means we can use bash to extract a list of Online Hosts to add to our new file.
[+] I tested this on my Internal LAN in order to show you how we can extract all the Online Hosts from the XML document in one single line.
[+] We also don't want duplicate IPs to be in our new scope file after having scanned for 48 hours or so.
"How do we fix that?"
[+] Pipe all the output from a ridiculous sed command to "sort -u" of course.
"Genius.."
Extract from your Host-Discovery-Online.xml all IP Addresses and Sort by UNIQUE such that no duplicate IPs are in your output.
$ grep -oE '((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])' Host-Discovery-Report.xml |sort -u > ONLINE-ACTUAL-SCOPE.txt
192.168.1.REDACTED
192.168.1.REDACTED
192.168.1.REDACTED
192.168.1.REDACTED
192.168.1.REDACTED
192.168.1.REDACTED
Phase 2 (Perform your Enumeration of ports/services with SIMPLE SCRIPTS and a TCP Banner Grab at the Least.).
[+] After all, you'll end up having TONS of IPs return. Right? But you don't want to be TOO invasive - just enough to get back simple information that you can then either attack later or straight up drop and report on.......
[+] Remember, this is a Class-B Engagement and that usually means a way for an Organization to understand and visualize their perimeter.
[+] Therefor, consider the -sV -sC option in your sweep of these ONLINE HOSTS. This is ultimately going to be up to you, but I can provide you an Nmap scan that will get you started in the right direction of course.
nmap -p21,22,23,25,53,80,110,111,135,139,143,161,443,445,465,587,636,993,995,1433,1521,2222,3306,3389,3780,5432,5601,5900,5985,5986,6379,7001,8000,8080,8081,8088,8090,8443,8888,9200,9300,10000,10001,10050,10443,11211,20000,27000,27017,33848,50000,50030,50070,61616,62078 -sV -sC -T4 -oA Host-Enumeration-Report --stylesheet https://raw.githubusercontent.com/honze-net/nmap-bootstrap-xsl/master/nmap-bootstrap.xsl -iL ONLINE-ACTUAL-SCOPE.txt[+] Good luck, Intruders.
Comments are closed.